net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         ASSERT_RTNL();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  84                         if (have_ifidx && wdev->netdev &&
  85                             wdev->netdev->ifindex == ifidx) {
  86                                 result = wdev;
  87                                 break;
  88                         }
  89                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  90                                 result = wdev;
  91                                 break;
  92                         }
  93                 }
  94
  95                 if (result)
  96                         break;
  97         }
  98
  99         if (result)
 100                 return result;
 101         return ERR_PTR(-ENODEV);
 102 }
 103
 104 static struct cfg80211_registered_device *
 105 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 106 {
 107         struct cfg80211_registered_device *rdev = NULL, *tmp;
 108         struct net_device *netdev;
 109
 110         ASSERT_RTNL();
 111
 112         if (!attrs[NL80211_ATTR_WIPHY] &&
 113             !attrs[NL80211_ATTR_IFINDEX] &&
 114             !attrs[NL80211_ATTR_WDEV])
 115                 return ERR_PTR(-EINVAL);
 116
 117         if (attrs[NL80211_ATTR_WIPHY])
 118                 rdev = cfg80211_rdev_by_wiphy_idx(
 119                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 120
 121         if (attrs[NL80211_ATTR_WDEV]) {
 122                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 123                 struct wireless_dev *wdev;
 124                 bool found = false;
 125
 126                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 127                 if (tmp) {
 128                         /* make sure wdev exists */
 129                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 130                                 if (wdev->identifier != (u32)wdev_id)
 131                                         continue;
 132                                 found = true;
 133                                 break;
 134                         }
 135
 136                         if (!found)
 137                                 tmp = NULL;
 138
 139                         if (rdev && tmp != rdev)
 140                                 return ERR_PTR(-EINVAL);
 141                         rdev = tmp;
 142                 }
 143         }
 144
 145         if (attrs[NL80211_ATTR_IFINDEX]) {
 146                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 147                 netdev = dev_get_by_index(netns, ifindex);
 148                 if (netdev) {
 149                         if (netdev->ieee80211_ptr)
 150                                 tmp = wiphy_to_dev(
 151                                                 netdev->ieee80211_ptr->wiphy);
 152                         else
 153                                 tmp = NULL;
 154
 155                         dev_put(netdev);
 156
 157                         /* not wireless device -- return error */
 158                         if (!tmp)
 159                                 return ERR_PTR(-EINVAL);
 160
 161                         /* mismatch -- return error */
 162                         if (rdev && tmp != rdev)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         rdev = tmp;
 166                 }
 167         }
 168
 169         if (!rdev)
 170                 return ERR_PTR(-ENODEV);
 171
 172         if (netns != wiphy_net(&rdev->wiphy))
 173                 return ERR_PTR(-ENODEV);
 174
 175         return rdev;
 176 }
 177
 178 /*
 179  * This function returns a pointer to the driver
 180  * that the genl_info item that is passed refers to.
 181  *
 182  * The result of this can be a PTR_ERR and hence must
 183  * be checked with IS_ERR() for errors.
 184  */
 185 static struct cfg80211_registered_device *
 186 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 187 {
 188         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 189 }
 190
 191 /* policy for the attributes */
 192 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 193         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 194         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 195                                       .len = 20-1 },
 196         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 197
 198         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 199         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 200         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 201         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 202         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 203
 204         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 205         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 206         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 207         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 208         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 209
 210         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 211         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 212         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 213
 214         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 215         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 216
 217         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 218         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 219                                     .len = WLAN_MAX_KEY_LEN },
 220         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 221         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 222         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 223         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 224         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 225
 226         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 227         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 229                                        .len = IEEE80211_MAX_DATA_LEN },
 230         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 231                                        .len = IEEE80211_MAX_DATA_LEN },
 232         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 233         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 234         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 235         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 236                                                .len = NL80211_MAX_SUPP_RATES },
 237         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 238         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 239         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 240         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 241                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 242         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 243
 244         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 245         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 246
 247         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 248         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 249         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 250         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 251                                            .len = NL80211_MAX_SUPP_RATES },
 252         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 253
 254         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 255         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 256
 257         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 258
 259         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 260         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 261                               .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 263         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 264
 265         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 266                                 .len = IEEE80211_MAX_SSID_LEN },
 267         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 268         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 269         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 270         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 271         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 272         [NL80211_ATTR_STA_FLAGS2] = {
 273                 .len = sizeof(struct nl80211_sta_flag_update),
 274         },
 275         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 276         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 277         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 278         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 279         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 280         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 281         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 282         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 283         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 284                                  .len = WLAN_PMKID_LEN },
 285         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 286         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 287         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 288         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 289                                  .len = IEEE80211_MAX_DATA_LEN },
 290         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 291         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 292         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 293         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 294         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 295         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 296         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 297         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 298         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 300         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 301         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 302         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 303         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 304         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 305         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 306         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 307         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 308         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 309         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 310                                          .len = IEEE80211_MAX_DATA_LEN },
 311         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 312                                          .len = IEEE80211_MAX_DATA_LEN },
 313         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 314         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 315         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 316         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 317         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 318         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 319         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 320         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 321         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 322         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 323                                       .len = IEEE80211_MAX_DATA_LEN },
 324         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 325         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 326         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 327                 .len = NL80211_HT_CAPABILITY_LEN
 328         },
 329         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 330         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 331         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 332         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 333         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 334         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 335         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 336         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 337         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 338         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 339         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 340         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 341         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 342         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 343         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 344         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 346                 .len = NL80211_VHT_CAPABILITY_LEN,
 347         },
 348         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 349         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 350                                   .len = IEEE80211_MAX_DATA_LEN },
 351         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 352         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 353         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 354         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 355         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
 356         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
 357         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 358         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 359         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 360 };
 361
 362 /* policy for the key attributes */
 363 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 364         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 365         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 366         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 367         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 368         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 369         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 370         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 371         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 372 };
 373
 374 /* policy for the key default flags */
 375 static const struct nla_policy
 376 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 377         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 378         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 379 };
 380
 381 /* policy for WoWLAN attributes */
 382 static const struct nla_policy
 383 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 384         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 385         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 386         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 387         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 388         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 389         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 390         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 391         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 392         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 393 };
 394
 395 static const struct nla_policy
 396 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 397         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 398         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 399         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 400         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 401         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 402         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 403         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 404                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 405         },
 406         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 407                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 408         },
 409         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 410         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 411         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 412 };
 413
 414 /* policy for coalesce rule attributes */
 415 static const struct nla_policy
 416 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 417         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 418         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 419         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 420 };
 421
 422 /* policy for GTK rekey offload attributes */
 423 static const struct nla_policy
 424 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 425         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 426         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 427         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 428 };
 429
 430 static const struct nla_policy
 431 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 432         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 433                                                  .len = IEEE80211_MAX_SSID_LEN },
 434         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 435 };
 436
 437 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 438                                      struct netlink_callback *cb,
 439                                      struct cfg80211_registered_device **rdev,
 440                                      struct wireless_dev **wdev)
 441 {
 442         int err;
 443
 444         rtnl_lock();
 445
 446         if (!cb->args[0]) {
 447                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 448                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 449                                   nl80211_policy);
 450                 if (err)
 451                         goto out_unlock;
 452
 453                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 454                                                    nl80211_fam.attrbuf);
 455                 if (IS_ERR(*wdev)) {
 456                         err = PTR_ERR(*wdev);
 457                         goto out_unlock;
 458                 }
 459                 *rdev = wiphy_to_dev((*wdev)->wiphy);
 460                 /* 0 is the first index - add 1 to parse only once */
 461                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 462                 cb->args[1] = (*wdev)->identifier;
 463         } else {
 464                 /* subtract the 1 again here */
 465                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 466                 struct wireless_dev *tmp;
 467
 468                 if (!wiphy) {
 469                         err = -ENODEV;
 470                         goto out_unlock;
 471                 }
 472                 *rdev = wiphy_to_dev(wiphy);
 473                 *wdev = NULL;
 474
 475                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 476                         if (tmp->identifier == cb->args[1]) {
 477                                 *wdev = tmp;
 478                                 break;
 479                         }
 480                 }
 481
 482                 if (!*wdev) {
 483                         err = -ENODEV;
 484                         goto out_unlock;
 485                 }
 486         }
 487
 488         return 0;
 489  out_unlock:
 490         rtnl_unlock();
 491         return err;
 492 }
 493
 494 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 495 {
 496         rtnl_unlock();
 497 }
 498
 499 /* IE validation */
 500 static bool is_valid_ie_attr(const struct nlattr *attr)
 501 {
 502         const u8 *pos;
 503         int len;
 504
 505         if (!attr)
 506                 return true;
 507
 508         pos = nla_data(attr);
 509         len = nla_len(attr);
 510
 511         while (len) {
 512                 u8 elemlen;
 513
 514                 if (len < 2)
 515                         return false;
 516                 len -= 2;
 517
 518                 elemlen = pos[1];
 519                 if (elemlen > len)
 520                         return false;
 521
 522                 len -= elemlen;
 523                 pos += 2 + elemlen;
 524         }
 525
 526         return true;
 527 }
 528
 529 /* message building helper */
 530 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 531                                    int flags, u8 cmd)
 532 {
 533         /* since there is no private header just add the generic one */
 534         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 535 }
 536
 537 static int nl80211_msg_put_channel(struct sk_buff *msg,
 538                                    struct ieee80211_channel *chan,
 539                                    bool large)
 540 {
 541         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 542                         chan->center_freq))
 543                 goto nla_put_failure;
 544
 545         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 546             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 547                 goto nla_put_failure;
 548         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 549                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 550                         goto nla_put_failure;
 551                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 552                         goto nla_put_failure;
 553         }
 554         if (chan->flags & IEEE80211_CHAN_RADAR) {
 555                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 556                         goto nla_put_failure;
 557                 if (large) {
 558                         u32 time;
 559
 560                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 561
 562                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 563                                         chan->dfs_state))
 564                                 goto nla_put_failure;
 565                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 566                                         time))
 567                                 goto nla_put_failure;
 568                 }
 569         }
 570
 571         if (large) {
 572                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 573                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 574                         goto nla_put_failure;
 575                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 576                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 577                         goto nla_put_failure;
 578                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 579                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 580                         goto nla_put_failure;
 581                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 582                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 583                         goto nla_put_failure;
 584         }
 585
 586         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 587                         DBM_TO_MBM(chan->max_power)))
 588                 goto nla_put_failure;
 589
 590         return 0;
 591
 592  nla_put_failure:
 593         return -ENOBUFS;
 594 }
 595
 596 /* netlink command implementations */
 597
 598 struct key_parse {
 599         struct key_params p;
 600         int idx;
 601         int type;
 602         bool def, defmgmt;
 603         bool def_uni, def_multi;
 604 };
 605
 606 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 607 {
 608         struct nlattr *tb[NL80211_KEY_MAX + 1];
 609         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 610                                    nl80211_key_policy);
 611         if (err)
 612                 return err;
 613
 614         k->def = !!tb[NL80211_KEY_DEFAULT];
 615         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 616
 617         if (k->def) {
 618                 k->def_uni = true;
 619                 k->def_multi = true;
 620         }
 621         if (k->defmgmt)
 622                 k->def_multi = true;
 623
 624         if (tb[NL80211_KEY_IDX])
 625                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 626
 627         if (tb[NL80211_KEY_DATA]) {
 628                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 629                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 630         }
 631
 632         if (tb[NL80211_KEY_SEQ]) {
 633                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 634                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 635         }
 636
 637         if (tb[NL80211_KEY_CIPHER])
 638                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 639
 640         if (tb[NL80211_KEY_TYPE]) {
 641                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 642                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 643                         return -EINVAL;
 644         }
 645
 646         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 647                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 648                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 649                                        tb[NL80211_KEY_DEFAULT_TYPES],
 650                                        nl80211_key_default_policy);
 651                 if (err)
 652                         return err;
 653
 654                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 655                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 656         }
 657
 658         return 0;
 659 }
 660
 661 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 662 {
 663         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 664                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 665                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 666         }
 667
 668         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 669                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 670                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 671         }
 672
 673         if (info->attrs[NL80211_ATTR_KEY_IDX])
 674                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 675
 676         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 677                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 678
 679         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 680         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 681
 682         if (k->def) {
 683                 k->def_uni = true;
 684                 k->def_multi = true;
 685         }
 686         if (k->defmgmt)
 687                 k->def_multi = true;
 688
 689         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 690                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 691                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 692                         return -EINVAL;
 693         }
 694
 695         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 696                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 697                 int err = nla_parse_nested(
 698                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 699                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 700                                 nl80211_key_default_policy);
 701                 if (err)
 702                         return err;
 703
 704                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 705                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 706         }
 707
 708         return 0;
 709 }
 710
 711 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 712 {
 713         int err;
 714
 715         memset(k, 0, sizeof(*k));
 716         k->idx = -1;
 717         k->type = -1;
 718
 719         if (info->attrs[NL80211_ATTR_KEY])
 720                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 721         else
 722                 err = nl80211_parse_key_old(info, k);
 723
 724         if (err)
 725                 return err;
 726
 727         if (k->def && k->defmgmt)
 728                 return -EINVAL;
 729
 730         if (k->defmgmt) {
 731                 if (k->def_uni || !k->def_multi)
 732                         return -EINVAL;
 733         }
 734
 735         if (k->idx != -1) {
 736                 if (k->defmgmt) {
 737                         if (k->idx < 4 || k->idx > 5)
 738                                 return -EINVAL;
 739                 } else if (k->def) {
 740                         if (k->idx < 0 || k->idx > 3)
 741                                 return -EINVAL;
 742                 } else {
 743                         if (k->idx < 0 || k->idx > 5)
 744                                 return -EINVAL;
 745                 }
 746         }
 747
 748         return 0;
 749 }
 750
 751 static struct cfg80211_cached_keys *
 752 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 753                        struct nlattr *keys, bool *no_ht)
 754 {
 755         struct key_parse parse;
 756         struct nlattr *key;
 757         struct cfg80211_cached_keys *result;
 758         int rem, err, def = 0;
 759
 760         result = kzalloc(sizeof(*result), GFP_KERNEL);
 761         if (!result)
 762                 return ERR_PTR(-ENOMEM);
 763
 764         result->def = -1;
 765         result->defmgmt = -1;
 766
 767         nla_for_each_nested(key, keys, rem) {
 768                 memset(&parse, 0, sizeof(parse));
 769                 parse.idx = -1;
 770
 771                 err = nl80211_parse_key_new(key, &parse);
 772                 if (err)
 773                         goto error;
 774                 err = -EINVAL;
 775                 if (!parse.p.key)
 776                         goto error;
 777                 if (parse.idx < 0 || parse.idx > 4)
 778                         goto error;
 779                 if (parse.def) {
 780                         if (def)
 781                                 goto error;
 782                         def = 1;
 783                         result->def = parse.idx;
 784                         if (!parse.def_uni || !parse.def_multi)
 785                                 goto error;
 786                 } else if (parse.defmgmt)
 787                         goto error;
 788                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 789                                                      parse.idx, false, NULL);
 790                 if (err)
 791                         goto error;
 792                 result->params[parse.idx].cipher = parse.p.cipher;
 793                 result->params[parse.idx].key_len = parse.p.key_len;
 794                 result->params[parse.idx].key = result->data[parse.idx];
 795                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 796
 797                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 798                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 799                         if (no_ht)
 800                                 *no_ht = true;
 801                 }
 802         }
 803
 804         return result;
 805  error:
 806         kfree(result);
 807         return ERR_PTR(err);
 808 }
 809
 810 static int nl80211_key_allowed(struct wireless_dev *wdev)
 811 {
 812         ASSERT_WDEV_LOCK(wdev);
 813
 814         switch (wdev->iftype) {
 815         case NL80211_IFTYPE_AP:
 816         case NL80211_IFTYPE_AP_VLAN:
 817         case NL80211_IFTYPE_P2P_GO:
 818         case NL80211_IFTYPE_MESH_POINT:
 819                 break;
 820         case NL80211_IFTYPE_ADHOC:
 821         case NL80211_IFTYPE_STATION:
 822         case NL80211_IFTYPE_P2P_CLIENT:
 823                 if (!wdev->current_bss)
 824                         return -ENOLINK;
 825                 break;
 826         default:
 827                 return -EINVAL;
 828         }
 829
 830         return 0;
 831 }
 832
 833 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 834 {
 835         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 836         int i;
 837
 838         if (!nl_modes)
 839                 goto nla_put_failure;
 840
 841         i = 0;
 842         while (ifmodes) {
 843                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 844                         goto nla_put_failure;
 845                 ifmodes >>= 1;
 846                 i++;
 847         }
 848
 849         nla_nest_end(msg, nl_modes);
 850         return 0;
 851
 852 nla_put_failure:
 853         return -ENOBUFS;
 854 }
 855
 856 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 857                                           struct sk_buff *msg,
 858                                           bool large)
 859 {
 860         struct nlattr *nl_combis;
 861         int i, j;
 862
 863         nl_combis = nla_nest_start(msg,
 864                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 865         if (!nl_combis)
 866                 goto nla_put_failure;
 867
 868         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 869                 const struct ieee80211_iface_combination *c;
 870                 struct nlattr *nl_combi, *nl_limits;
 871
 872                 c = &wiphy->iface_combinations[i];
 873
 874                 nl_combi = nla_nest_start(msg, i + 1);
 875                 if (!nl_combi)
 876                         goto nla_put_failure;
 877
 878                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 879                 if (!nl_limits)
 880                         goto nla_put_failure;
 881
 882                 for (j = 0; j < c->n_limits; j++) {
 883                         struct nlattr *nl_limit;
 884
 885                         nl_limit = nla_nest_start(msg, j + 1);
 886                         if (!nl_limit)
 887                                 goto nla_put_failure;
 888                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 889                                         c->limits[j].max))
 890                                 goto nla_put_failure;
 891                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 892                                                 c->limits[j].types))
 893                                 goto nla_put_failure;
 894                         nla_nest_end(msg, nl_limit);
 895                 }
 896
 897                 nla_nest_end(msg, nl_limits);
 898
 899                 if (c->beacon_int_infra_match &&
 900                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 901                         goto nla_put_failure;
 902                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 903                                 c->num_different_channels) ||
 904                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 905                                 c->max_interfaces))
 906                         goto nla_put_failure;
 907                 if (large &&
 908                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 909                                 c->radar_detect_widths))
 910                         goto nla_put_failure;
 911
 912                 nla_nest_end(msg, nl_combi);
 913         }
 914
 915         nla_nest_end(msg, nl_combis);
 916
 917         return 0;
 918 nla_put_failure:
 919         return -ENOBUFS;
 920 }
 921
 922 #ifdef CONFIG_PM
 923 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 924                                         struct sk_buff *msg)
 925 {
 926         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 927         struct nlattr *nl_tcp;
 928
 929         if (!tcp)
 930                 return 0;
 931
 932         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 933         if (!nl_tcp)
 934                 return -ENOBUFS;
 935
 936         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 937                         tcp->data_payload_max))
 938                 return -ENOBUFS;
 939
 940         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 941                         tcp->data_payload_max))
 942                 return -ENOBUFS;
 943
 944         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 945                 return -ENOBUFS;
 946
 947         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 948                                 sizeof(*tcp->tok), tcp->tok))
 949                 return -ENOBUFS;
 950
 951         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 952                         tcp->data_interval_max))
 953                 return -ENOBUFS;
 954
 955         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 956                         tcp->wake_payload_max))
 957                 return -ENOBUFS;
 958
 959         nla_nest_end(msg, nl_tcp);
 960         return 0;
 961 }
 962
 963 static int nl80211_send_wowlan(struct sk_buff *msg,
 964                                struct cfg80211_registered_device *dev,
 965                                bool large)
 966 {
 967         struct nlattr *nl_wowlan;
 968
 969         if (!dev->wiphy.wowlan)
 970                 return 0;
 971
 972         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 973         if (!nl_wowlan)
 974                 return -ENOBUFS;
 975
 976         if (((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
 977              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
 978             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
 979              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
 980             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
 981              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
 982             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
 983              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
 984             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
 985              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
 986             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
 987              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
 988             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
 989              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
 990             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
 991              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
 992                 return -ENOBUFS;
 993
 994         if (dev->wiphy.wowlan->n_patterns) {
 995                 struct nl80211_pattern_support pat = {
 996                         .max_patterns = dev->wiphy.wowlan->n_patterns,
 997                         .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
 998                         .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
 999                         .max_pkt_offset = dev->wiphy.wowlan->max_pkt_offset,
1000                 };
1001
1002                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1003                             sizeof(pat), &pat))
1004                         return -ENOBUFS;
1005         }
1006
1007         if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
1008                 return -ENOBUFS;
1009
1010         nla_nest_end(msg, nl_wowlan);
1011
1012         return 0;
1013 }
1014 #endif
1015
1016 static int nl80211_send_coalesce(struct sk_buff *msg,
1017                                  struct cfg80211_registered_device *dev)
1018 {
1019         struct nl80211_coalesce_rule_support rule;
1020
1021         if (!dev->wiphy.coalesce)
1022                 return 0;
1023
1024         rule.max_rules = dev->wiphy.coalesce->n_rules;
1025         rule.max_delay = dev->wiphy.coalesce->max_delay;
1026         rule.pat.max_patterns = dev->wiphy.coalesce->n_patterns;
1027         rule.pat.min_pattern_len = dev->wiphy.coalesce->pattern_min_len;
1028         rule.pat.max_pattern_len = dev->wiphy.coalesce->pattern_max_len;
1029         rule.pat.max_pkt_offset = dev->wiphy.coalesce->max_pkt_offset;
1030
1031         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1032                 return -ENOBUFS;
1033
1034         return 0;
1035 }
1036
1037 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1038                                       struct ieee80211_supported_band *sband)
1039 {
1040         struct nlattr *nl_rates, *nl_rate;
1041         struct ieee80211_rate *rate;
1042         int i;
1043
1044         /* add HT info */
1045         if (sband->ht_cap.ht_supported &&
1046             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1047                      sizeof(sband->ht_cap.mcs),
1048                      &sband->ht_cap.mcs) ||
1049              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1050                          sband->ht_cap.cap) ||
1051              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1052                         sband->ht_cap.ampdu_factor) ||
1053              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1054                         sband->ht_cap.ampdu_density)))
1055                 return -ENOBUFS;
1056
1057         /* add VHT info */
1058         if (sband->vht_cap.vht_supported &&
1059             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1060                      sizeof(sband->vht_cap.vht_mcs),
1061                      &sband->vht_cap.vht_mcs) ||
1062              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1063                          sband->vht_cap.cap)))
1064                 return -ENOBUFS;
1065
1066         /* add bitrates */
1067         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1068         if (!nl_rates)
1069                 return -ENOBUFS;
1070
1071         for (i = 0; i < sband->n_bitrates; i++) {
1072                 nl_rate = nla_nest_start(msg, i);
1073                 if (!nl_rate)
1074                         return -ENOBUFS;
1075
1076                 rate = &sband->bitrates[i];
1077                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1078                                 rate->bitrate))
1079                         return -ENOBUFS;
1080                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1081                     nla_put_flag(msg,
1082                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1083                         return -ENOBUFS;
1084
1085                 nla_nest_end(msg, nl_rate);
1086         }
1087
1088         nla_nest_end(msg, nl_rates);
1089
1090         return 0;
1091 }
1092
1093 static int
1094 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1095                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1096 {
1097         u16 stypes;
1098         struct nlattr *nl_ftypes, *nl_ifs;
1099         enum nl80211_iftype ift;
1100         int i;
1101
1102         if (!mgmt_stypes)
1103                 return 0;
1104
1105         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1106         if (!nl_ifs)
1107                 return -ENOBUFS;
1108
1109         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1110                 nl_ftypes = nla_nest_start(msg, ift);
1111                 if (!nl_ftypes)
1112                         return -ENOBUFS;
1113                 i = 0;
1114                 stypes = mgmt_stypes[ift].tx;
1115                 while (stypes) {
1116                         if ((stypes & 1) &&
1117                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1118                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1119                                 return -ENOBUFS;
1120                         stypes >>= 1;
1121                         i++;
1122                 }
1123                 nla_nest_end(msg, nl_ftypes);
1124         }
1125
1126         nla_nest_end(msg, nl_ifs);
1127
1128         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1129         if (!nl_ifs)
1130                 return -ENOBUFS;
1131
1132         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1133                 nl_ftypes = nla_nest_start(msg, ift);
1134                 if (!nl_ftypes)
1135                         return -ENOBUFS;
1136                 i = 0;
1137                 stypes = mgmt_stypes[ift].rx;
1138                 while (stypes) {
1139                         if ((stypes & 1) &&
1140                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1141                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1142                                 return -ENOBUFS;
1143                         stypes >>= 1;
1144                         i++;
1145                 }
1146                 nla_nest_end(msg, nl_ftypes);
1147         }
1148         nla_nest_end(msg, nl_ifs);
1149
1150         return 0;
1151 }
1152
1153 struct nl80211_dump_wiphy_state {
1154         s64 filter_wiphy;
1155         long start;
1156         long split_start, band_start, chan_start;
1157         bool split;
1158 };
1159
1160 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1161                               struct sk_buff *msg, u32 portid, u32 seq,
1162                               int flags, struct nl80211_dump_wiphy_state *state)
1163 {
1164         void *hdr;
1165         struct nlattr *nl_bands, *nl_band;
1166         struct nlattr *nl_freqs, *nl_freq;
1167         struct nlattr *nl_cmds;
1168         enum ieee80211_band band;
1169         struct ieee80211_channel *chan;
1170         int i;
1171         const struct ieee80211_txrx_stypes *mgmt_stypes =
1172                                 dev->wiphy.mgmt_stypes;
1173         u32 features;
1174
1175         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1176         if (!hdr)
1177                 return -ENOBUFS;
1178
1179         if (WARN_ON(!state))
1180                 return -EINVAL;
1181
1182         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1183             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1184                            wiphy_name(&dev->wiphy)) ||
1185             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1186                         cfg80211_rdev_list_generation))
1187                 goto nla_put_failure;
1188
1189         switch (state->split_start) {
1190         case 0:
1191                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1192                                dev->wiphy.retry_short) ||
1193                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1194                                dev->wiphy.retry_long) ||
1195                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1196                                 dev->wiphy.frag_threshold) ||
1197                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1198                                 dev->wiphy.rts_threshold) ||
1199                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1200                                dev->wiphy.coverage_class) ||
1201                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1202                                dev->wiphy.max_scan_ssids) ||
1203                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1204                                dev->wiphy.max_sched_scan_ssids) ||
1205                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1206                                 dev->wiphy.max_scan_ie_len) ||
1207                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1208                                 dev->wiphy.max_sched_scan_ie_len) ||
1209                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1210                                dev->wiphy.max_match_sets))
1211                         goto nla_put_failure;
1212
1213                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1214                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1215                         goto nla_put_failure;
1216                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1217                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1218                         goto nla_put_failure;
1219                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1220                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1221                         goto nla_put_failure;
1222                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1223                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1224                         goto nla_put_failure;
1225                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1226                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1227                         goto nla_put_failure;
1228                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1229                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1230                         goto nla_put_failure;
1231                 state->split_start++;
1232                 if (state->split)
1233                         break;
1234         case 1:
1235                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1236                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1237                             dev->wiphy.cipher_suites))
1238                         goto nla_put_failure;
1239
1240                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1241                                dev->wiphy.max_num_pmkids))
1242                         goto nla_put_failure;
1243
1244                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1245                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1246                         goto nla_put_failure;
1247
1248                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1249                                 dev->wiphy.available_antennas_tx) ||
1250                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1251                                 dev->wiphy.available_antennas_rx))
1252                         goto nla_put_failure;
1253
1254                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1255                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1256                                 dev->wiphy.probe_resp_offload))
1257                         goto nla_put_failure;
1258
1259                 if ((dev->wiphy.available_antennas_tx ||
1260                      dev->wiphy.available_antennas_rx) &&
1261                     dev->ops->get_antenna) {
1262                         u32 tx_ant = 0, rx_ant = 0;
1263                         int res;
1264                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1265                         if (!res) {
1266                                 if (nla_put_u32(msg,
1267                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1268                                                 tx_ant) ||
1269                                     nla_put_u32(msg,
1270                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1271                                                 rx_ant))
1272                                         goto nla_put_failure;
1273                         }
1274                 }
1275
1276                 state->split_start++;
1277                 if (state->split)
1278                         break;
1279         case 2:
1280                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1281                                         dev->wiphy.interface_modes))
1282                                 goto nla_put_failure;
1283                 state->split_start++;
1284                 if (state->split)
1285                         break;
1286         case 3:
1287                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1288                 if (!nl_bands)
1289                         goto nla_put_failure;
1290
1291                 for (band = state->band_start;
1292                      band < IEEE80211_NUM_BANDS; band++) {
1293                         struct ieee80211_supported_band *sband;
1294
1295                         sband = dev->wiphy.bands[band];
1296
1297                         if (!sband)
1298                                 continue;
1299
1300                         nl_band = nla_nest_start(msg, band);
1301                         if (!nl_band)
1302                                 goto nla_put_failure;
1303
1304                         switch (state->chan_start) {
1305                         case 0:
1306                                 if (nl80211_send_band_rateinfo(msg, sband))
1307                                         goto nla_put_failure;
1308                                 state->chan_start++;
1309                                 if (state->split)
1310                                         break;
1311                         default:
1312                                 /* add frequencies */
1313                                 nl_freqs = nla_nest_start(
1314                                         msg, NL80211_BAND_ATTR_FREQS);
1315                                 if (!nl_freqs)
1316                                         goto nla_put_failure;
1317
1318                                 for (i = state->chan_start - 1;
1319                                      i < sband->n_channels;
1320                                      i++) {
1321                                         nl_freq = nla_nest_start(msg, i);
1322                                         if (!nl_freq)
1323                                                 goto nla_put_failure;
1324
1325                                         chan = &sband->channels[i];
1326
1327                                         if (nl80211_msg_put_channel(
1328                                                         msg, chan,
1329                                                         state->split))
1330                                                 goto nla_put_failure;
1331
1332                                         nla_nest_end(msg, nl_freq);
1333                                         if (state->split)
1334                                                 break;
1335                                 }
1336                                 if (i < sband->n_channels)
1337                                         state->chan_start = i + 2;
1338                                 else
1339                                         state->chan_start = 0;
1340                                 nla_nest_end(msg, nl_freqs);
1341                         }
1342
1343                         nla_nest_end(msg, nl_band);
1344
1345                         if (state->split) {
1346                                 /* start again here */
1347                                 if (state->chan_start)
1348                                         band--;
1349                                 break;
1350                         }
1351                 }
1352                 nla_nest_end(msg, nl_bands);
1353
1354                 if (band < IEEE80211_NUM_BANDS)
1355                         state->band_start = band + 1;
1356                 else
1357                         state->band_start = 0;
1358
1359                 /* if bands & channels are done, continue outside */
1360                 if (state->band_start == 0 && state->chan_start == 0)
1361                         state->split_start++;
1362                 if (state->split)
1363                         break;
1364         case 4:
1365                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1366                 if (!nl_cmds)
1367                         goto nla_put_failure;
1368
1369                 i = 0;
1370 #define CMD(op, n)                                                      \
1371                  do {                                                   \
1372                         if (dev->ops->op) {                             \
1373                                 i++;                                    \
1374                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1375                                         goto nla_put_failure;           \
1376                         }                                               \
1377                 } while (0)
1378
1379                 CMD(add_virtual_intf, NEW_INTERFACE);
1380                 CMD(change_virtual_intf, SET_INTERFACE);
1381                 CMD(add_key, NEW_KEY);
1382                 CMD(start_ap, START_AP);
1383                 CMD(add_station, NEW_STATION);
1384                 CMD(add_mpath, NEW_MPATH);
1385                 CMD(update_mesh_config, SET_MESH_CONFIG);
1386                 CMD(change_bss, SET_BSS);
1387                 CMD(auth, AUTHENTICATE);
1388                 CMD(assoc, ASSOCIATE);
1389                 CMD(deauth, DEAUTHENTICATE);
1390                 CMD(disassoc, DISASSOCIATE);
1391                 CMD(join_ibss, JOIN_IBSS);
1392                 CMD(join_mesh, JOIN_MESH);
1393                 CMD(set_pmksa, SET_PMKSA);
1394                 CMD(del_pmksa, DEL_PMKSA);
1395                 CMD(flush_pmksa, FLUSH_PMKSA);
1396                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1397                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1398                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1399                 CMD(mgmt_tx, FRAME);
1400                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1401                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1402                         i++;
1403                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1404                                 goto nla_put_failure;
1405                 }
1406                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1407                     dev->ops->join_mesh) {
1408                         i++;
1409                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1410                                 goto nla_put_failure;
1411                 }
1412                 CMD(set_wds_peer, SET_WDS_PEER);
1413                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1414                         CMD(tdls_mgmt, TDLS_MGMT);
1415                         CMD(tdls_oper, TDLS_OPER);
1416                 }
1417                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1418                         CMD(sched_scan_start, START_SCHED_SCAN);
1419                 CMD(probe_client, PROBE_CLIENT);
1420                 CMD(set_noack_map, SET_NOACK_MAP);
1421                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1422                         i++;
1423                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1424                                 goto nla_put_failure;
1425                 }
1426                 CMD(start_p2p_device, START_P2P_DEVICE);
1427                 CMD(set_mcast_rate, SET_MCAST_RATE);
1428                 if (state->split) {
1429                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1430                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1431                         if (dev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1432                                 CMD(channel_switch, CHANNEL_SWITCH);
1433                 }
1434
1435 #ifdef CONFIG_NL80211_TESTMODE
1436                 CMD(testmode_cmd, TESTMODE);
1437 #endif
1438
1439 #undef CMD
1440
1441                 if (dev->ops->connect || dev->ops->auth) {
1442                         i++;
1443                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1444                                 goto nla_put_failure;
1445                 }
1446
1447                 if (dev->ops->disconnect || dev->ops->deauth) {
1448                         i++;
1449                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1450                                 goto nla_put_failure;
1451                 }
1452
1453                 nla_nest_end(msg, nl_cmds);
1454                 state->split_start++;
1455                 if (state->split)
1456                         break;
1457         case 5:
1458                 if (dev->ops->remain_on_channel &&
1459                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1460                     nla_put_u32(msg,
1461                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1462                                 dev->wiphy.max_remain_on_channel_duration))
1463                         goto nla_put_failure;
1464
1465                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1466                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1467                         goto nla_put_failure;
1468
1469                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1470                         goto nla_put_failure;
1471                 state->split_start++;
1472                 if (state->split)
1473                         break;
1474         case 6:
1475 #ifdef CONFIG_PM
1476                 if (nl80211_send_wowlan(msg, dev, state->split))
1477                         goto nla_put_failure;
1478                 state->split_start++;
1479                 if (state->split)
1480                         break;
1481 #else
1482                 state->split_start++;
1483 #endif
1484         case 7:
1485                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1486                                         dev->wiphy.software_iftypes))
1487                         goto nla_put_failure;
1488
1489                 if (nl80211_put_iface_combinations(&dev->wiphy, msg,
1490                                                    state->split))
1491                         goto nla_put_failure;
1492
1493                 state->split_start++;
1494                 if (state->split)
1495                         break;
1496         case 8:
1497                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1498                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1499                                 dev->wiphy.ap_sme_capa))
1500                         goto nla_put_failure;
1501
1502                 features = dev->wiphy.features;
1503                 /*
1504                  * We can only add the per-channel limit information if the
1505                  * dump is split, otherwise it makes it too big. Therefore
1506                  * only advertise it in that case.
1507                  */
1508                 if (state->split)
1509                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1510                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1511                         goto nla_put_failure;
1512
1513                 if (dev->wiphy.ht_capa_mod_mask &&
1514                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1515                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1516                             dev->wiphy.ht_capa_mod_mask))
1517                         goto nla_put_failure;
1518
1519                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1520                     dev->wiphy.max_acl_mac_addrs &&
1521                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1522                                 dev->wiphy.max_acl_mac_addrs))
1523                         goto nla_put_failure;
1524
1525                 /*
1526                  * Any information below this point is only available to
1527                  * applications that can deal with it being split. This
1528                  * helps ensure that newly added capabilities don't break
1529                  * older tools by overrunning their buffers.
1530                  *
1531                  * We still increment split_start so that in the split
1532                  * case we'll continue with more data in the next round,
1533                  * but break unconditionally so unsplit data stops here.
1534                  */
1535                 state->split_start++;
1536                 break;
1537         case 9:
1538                 if (dev->wiphy.extended_capabilities &&
1539                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1540                              dev->wiphy.extended_capabilities_len,
1541                              dev->wiphy.extended_capabilities) ||
1542                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1543                              dev->wiphy.extended_capabilities_len,
1544                              dev->wiphy.extended_capabilities_mask)))
1545                         goto nla_put_failure;
1546
1547                 if (dev->wiphy.vht_capa_mod_mask &&
1548                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1549                             sizeof(*dev->wiphy.vht_capa_mod_mask),
1550                             dev->wiphy.vht_capa_mod_mask))
1551                         goto nla_put_failure;
1552
1553                 state->split_start++;
1554                 break;
1555         case 10:
1556                 if (nl80211_send_coalesce(msg, dev))
1557                         goto nla_put_failure;
1558
1559                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1560                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1561                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1562                         goto nla_put_failure;
1563
1564                 /* done */
1565                 state->split_start = 0;
1566                 break;
1567         }
1568         return genlmsg_end(msg, hdr);
1569
1570  nla_put_failure:
1571         genlmsg_cancel(msg, hdr);
1572         return -EMSGSIZE;
1573 }
1574
1575 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1576                                     struct netlink_callback *cb,
1577                                     struct nl80211_dump_wiphy_state *state)
1578 {
1579         struct nlattr **tb = nl80211_fam.attrbuf;
1580         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1581                               tb, nl80211_fam.maxattr, nl80211_policy);
1582         /* ignore parse errors for backward compatibility */
1583         if (ret)
1584                 return 0;
1585
1586         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1587         if (tb[NL80211_ATTR_WIPHY])
1588                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1589         if (tb[NL80211_ATTR_WDEV])
1590                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1591         if (tb[NL80211_ATTR_IFINDEX]) {
1592                 struct net_device *netdev;
1593                 struct cfg80211_registered_device *rdev;
1594                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1595
1596                 netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1597                 if (!netdev)
1598                         return -ENODEV;
1599                 if (netdev->ieee80211_ptr) {
1600                         rdev = wiphy_to_dev(
1601                                 netdev->ieee80211_ptr->wiphy);
1602                         state->filter_wiphy = rdev->wiphy_idx;
1603                 }
1604                 dev_put(netdev);
1605         }
1606
1607         return 0;
1608 }
1609
1610 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1611 {
1612         int idx = 0, ret;
1613         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1614         struct cfg80211_registered_device *dev;
1615
1616         rtnl_lock();
1617         if (!state) {
1618                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1619                 if (!state) {
1620                         rtnl_unlock();
1621                         return -ENOMEM;
1622                 }
1623                 state->filter_wiphy = -1;
1624                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1625                 if (ret) {
1626                         kfree(state);
1627                         rtnl_unlock();
1628                         return ret;
1629                 }
1630                 cb->args[0] = (long)state;
1631         }
1632
1633         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1634                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1635                         continue;
1636                 if (++idx <= state->start)
1637                         continue;
1638                 if (state->filter_wiphy != -1 &&
1639                     state->filter_wiphy != dev->wiphy_idx)
1640                         continue;
1641                 /* attempt to fit multiple wiphy data chunks into the skb */
1642                 do {
1643                         ret = nl80211_send_wiphy(dev, skb,
1644                                                  NETLINK_CB(cb->skb).portid,
1645                                                  cb->nlh->nlmsg_seq,
1646                                                  NLM_F_MULTI, state);
1647                         if (ret < 0) {
1648                                 /*
1649                                  * If sending the wiphy data didn't fit (ENOBUFS
1650                                  * or EMSGSIZE returned), this SKB is still
1651                                  * empty (so it's not too big because another
1652                                  * wiphy dataset is already in the skb) and
1653                                  * we've not tried to adjust the dump allocation
1654                                  * yet ... then adjust the alloc size to be
1655                                  * bigger, and return 1 but with the empty skb.
1656                                  * This results in an empty message being RX'ed
1657                                  * in userspace, but that is ignored.
1658                                  *
1659                                  * We can then retry with the larger buffer.
1660                                  */
1661                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1662                                     !skb->len &&
1663                                     cb->min_dump_alloc < 4096) {
1664                                         cb->min_dump_alloc = 4096;
1665                                         rtnl_unlock();
1666                                         return 1;
1667                                 }
1668                                 idx--;
1669                                 break;
1670                         }
1671                 } while (state->split_start > 0);
1672                 break;
1673         }
1674         rtnl_unlock();
1675
1676         state->start = idx;
1677
1678         return skb->len;
1679 }
1680
1681 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1682 {
1683         kfree((void *)cb->args[0]);
1684         return 0;
1685 }
1686
1687 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1688 {
1689         struct sk_buff *msg;
1690         struct cfg80211_registered_device *dev = info->user_ptr[0];
1691         struct nl80211_dump_wiphy_state state = {};
1692
1693         msg = nlmsg_new(4096, GFP_KERNEL);
1694         if (!msg)
1695                 return -ENOMEM;
1696
1697         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1698                                &state) < 0) {
1699                 nlmsg_free(msg);
1700                 return -ENOBUFS;
1701         }
1702
1703         return genlmsg_reply(msg, info);
1704 }
1705
1706 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1707         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1708         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1709         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1710         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1711         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1712 };
1713
1714 static int parse_txq_params(struct nlattr *tb[],
1715                             struct ieee80211_txq_params *txq_params)
1716 {
1717         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1718             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1719             !tb[NL80211_TXQ_ATTR_AIFS])
1720                 return -EINVAL;
1721
1722         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1723         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1724         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1725         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1726         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1727
1728         if (txq_params->ac >= NL80211_NUM_ACS)
1729                 return -EINVAL;
1730
1731         return 0;
1732 }
1733
1734 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1735 {
1736         /*
1737          * You can only set the channel explicitly for WDS interfaces,
1738          * all others have their channel managed via their respective
1739          * "establish a connection" command (connect, join, ...)
1740          *
1741          * For AP/GO and mesh mode, the channel can be set with the
1742          * channel userspace API, but is only stored and passed to the
1743          * low-level driver when the AP starts or the mesh is joined.
1744          * This is for backward compatibility, userspace can also give
1745          * the channel in the start-ap or join-mesh commands instead.
1746          *
1747          * Monitors are special as they are normally slaved to
1748          * whatever else is going on, so they have their own special
1749          * operation to set the monitor channel if possible.
1750          */
1751         return !wdev ||
1752                 wdev->iftype == NL80211_IFTYPE_AP ||
1753                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1754                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1755                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1756 }
1757
1758 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1759                                  struct genl_info *info,
1760                                  struct cfg80211_chan_def *chandef)
1761 {
1762         u32 control_freq;
1763
1764         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1765                 return -EINVAL;
1766
1767         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1768
1769         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1770         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1771         chandef->center_freq1 = control_freq;
1772         chandef->center_freq2 = 0;
1773
1774         /* Primary channel not allowed */
1775         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1776                 return -EINVAL;
1777
1778         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1779                 enum nl80211_channel_type chantype;
1780
1781                 chantype = nla_get_u32(
1782                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1783
1784                 switch (chantype) {
1785                 case NL80211_CHAN_NO_HT:
1786                 case NL80211_CHAN_HT20:
1787                 case NL80211_CHAN_HT40PLUS:
1788                 case NL80211_CHAN_HT40MINUS:
1789                         cfg80211_chandef_create(chandef, chandef->chan,
1790                                                 chantype);
1791                         break;
1792                 default:
1793                         return -EINVAL;
1794                 }
1795         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1796                 chandef->width =
1797                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1798                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1799                         chandef->center_freq1 =
1800                                 nla_get_u32(
1801                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1802                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1803                         chandef->center_freq2 =
1804                                 nla_get_u32(
1805                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1806         }
1807
1808         if (!cfg80211_chandef_valid(chandef))
1809                 return -EINVAL;
1810
1811         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1812                                      IEEE80211_CHAN_DISABLED))
1813                 return -EINVAL;
1814
1815         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1816              chandef->width == NL80211_CHAN_WIDTH_10) &&
1817             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1818                 return -EINVAL;
1819
1820         return 0;
1821 }
1822
1823 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1824                                  struct wireless_dev *wdev,
1825                                  struct genl_info *info)
1826 {
1827         struct cfg80211_chan_def chandef;
1828         int result;
1829         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1830
1831         if (wdev)
1832                 iftype = wdev->iftype;
1833
1834         if (!nl80211_can_set_dev_channel(wdev))
1835                 return -EOPNOTSUPP;
1836
1837         result = nl80211_parse_chandef(rdev, info, &chandef);
1838         if (result)
1839                 return result;
1840
1841         switch (iftype) {
1842         case NL80211_IFTYPE_AP:
1843         case NL80211_IFTYPE_P2P_GO:
1844                 if (wdev->beacon_interval) {
1845                         result = -EBUSY;
1846                         break;
1847                 }
1848                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1849                         result = -EINVAL;
1850                         break;
1851                 }
1852                 wdev->preset_chandef = chandef;
1853                 result = 0;
1854                 break;
1855         case NL80211_IFTYPE_MESH_POINT:
1856                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1857                 break;
1858         case NL80211_IFTYPE_MONITOR:
1859                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1860                 break;
1861         default:
1862                 result = -EINVAL;
1863         }
1864
1865         return result;
1866 }
1867
1868 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1869 {
1870         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1871         struct net_device *netdev = info->user_ptr[1];
1872
1873         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1874 }
1875
1876 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1877 {
1878         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1879         struct net_device *dev = info->user_ptr[1];
1880         struct wireless_dev *wdev = dev->ieee80211_ptr;
1881         const u8 *bssid;
1882
1883         if (!info->attrs[NL80211_ATTR_MAC])
1884                 return -EINVAL;
1885
1886         if (netif_running(dev))
1887                 return -EBUSY;
1888
1889         if (!rdev->ops->set_wds_peer)
1890                 return -EOPNOTSUPP;
1891
1892         if (wdev->iftype != NL80211_IFTYPE_WDS)
1893                 return -EOPNOTSUPP;
1894
1895         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1896         return rdev_set_wds_peer(rdev, dev, bssid);
1897 }
1898
1899
1900 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1901 {
1902         struct cfg80211_registered_device *rdev;
1903         struct net_device *netdev = NULL;
1904         struct wireless_dev *wdev;
1905         int result = 0, rem_txq_params = 0;
1906         struct nlattr *nl_txq_params;
1907         u32 changed;
1908         u8 retry_short = 0, retry_long = 0;
1909         u32 frag_threshold = 0, rts_threshold = 0;
1910         u8 coverage_class = 0;
1911
1912         ASSERT_RTNL();
1913
1914         /*
1915          * Try to find the wiphy and netdev. Normally this
1916          * function shouldn't need the netdev, but this is
1917          * done for backward compatibility -- previously
1918          * setting the channel was done per wiphy, but now
1919          * it is per netdev. Previous userland like hostapd
1920          * also passed a netdev to set_wiphy, so that it is
1921          * possible to let that go to the right netdev!
1922          */
1923
1924         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1925                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1926
1927                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1928                 if (netdev && netdev->ieee80211_ptr)
1929                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1930                 else
1931                         netdev = NULL;
1932         }
1933
1934         if (!netdev) {
1935                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1936                                                   info->attrs);
1937                 if (IS_ERR(rdev))
1938                         return PTR_ERR(rdev);
1939                 wdev = NULL;
1940                 netdev = NULL;
1941                 result = 0;
1942         } else
1943                 wdev = netdev->ieee80211_ptr;
1944
1945         /*
1946          * end workaround code, by now the rdev is available
1947          * and locked, and wdev may or may not be NULL.
1948          */
1949
1950         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1951                 result = cfg80211_dev_rename(
1952                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1953
1954         if (result)
1955                 goto bad_res;
1956
1957         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1958                 struct ieee80211_txq_params txq_params;
1959                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1960
1961                 if (!rdev->ops->set_txq_params) {
1962                         result = -EOPNOTSUPP;
1963                         goto bad_res;
1964                 }
1965
1966                 if (!netdev) {
1967                         result = -EINVAL;
1968                         goto bad_res;
1969                 }
1970
1971                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1972                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1973                         result = -EINVAL;
1974                         goto bad_res;
1975                 }
1976
1977                 if (!netif_running(netdev)) {
1978                         result = -ENETDOWN;
1979                         goto bad_res;
1980                 }
1981
1982                 nla_for_each_nested(nl_txq_params,
1983                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1984                                     rem_txq_params) {
1985                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1986                                   nla_data(nl_txq_params),
1987                                   nla_len(nl_txq_params),
1988                                   txq_params_policy);
1989                         result = parse_txq_params(tb, &txq_params);
1990                         if (result)
1991                                 goto bad_res;
1992
1993                         result = rdev_set_txq_params(rdev, netdev,
1994                                                      &txq_params);
1995                         if (result)
1996                                 goto bad_res;
1997                 }
1998         }
1999
2000         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2001                 result = __nl80211_set_channel(rdev,
2002                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
2003                                 info);
2004                 if (result)
2005                         goto bad_res;
2006         }
2007
2008         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2009                 struct wireless_dev *txp_wdev = wdev;
2010                 enum nl80211_tx_power_setting type;
2011                 int idx, mbm = 0;
2012
2013                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2014                         txp_wdev = NULL;
2015
2016                 if (!rdev->ops->set_tx_power) {
2017                         result = -EOPNOTSUPP;
2018                         goto bad_res;
2019                 }
2020
2021                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2022                 type = nla_get_u32(info->attrs[idx]);
2023
2024                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2025                     (type != NL80211_TX_POWER_AUTOMATIC)) {
2026                         result = -EINVAL;
2027                         goto bad_res;
2028                 }
2029
2030                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2031                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2032                         mbm = nla_get_u32(info->attrs[idx]);
2033                 }
2034
2035                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2036                 if (result)
2037                         goto bad_res;
2038         }
2039
2040         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2041             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2042                 u32 tx_ant, rx_ant;
2043                 if ((!rdev->wiphy.available_antennas_tx &&
2044                      !rdev->wiphy.available_antennas_rx) ||
2045                     !rdev->ops->set_antenna) {
2046                         result = -EOPNOTSUPP;
2047                         goto bad_res;
2048                 }
2049
2050                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2051                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2052
2053                 /* reject antenna configurations which don't match the
2054                  * available antenna masks, except for the "all" mask */
2055                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2056                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
2057                         result = -EINVAL;
2058                         goto bad_res;
2059                 }
2060
2061                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2062                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2063
2064                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2065                 if (result)
2066                         goto bad_res;
2067         }
2068
2069         changed = 0;
2070
2071         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2072                 retry_short = nla_get_u8(
2073                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2074                 if (retry_short == 0) {
2075                         result = -EINVAL;
2076                         goto bad_res;
2077                 }
2078                 changed |= WIPHY_PARAM_RETRY_SHORT;
2079         }
2080
2081         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2082                 retry_long = nla_get_u8(
2083                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2084                 if (retry_long == 0) {
2085                         result = -EINVAL;
2086                         goto bad_res;
2087                 }
2088                 changed |= WIPHY_PARAM_RETRY_LONG;
2089         }
2090
2091         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2092                 frag_threshold = nla_get_u32(
2093                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2094                 if (frag_threshold < 256) {
2095                         result = -EINVAL;
2096                         goto bad_res;
2097                 }
2098                 if (frag_threshold != (u32) -1) {
2099                         /*
2100                          * Fragments (apart from the last one) are required to
2101                          * have even length. Make the fragmentation code
2102                          * simpler by stripping LSB should someone try to use
2103                          * odd threshold value.
2104                          */
2105                         frag_threshold &= ~0x1;
2106                 }
2107                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2108         }
2109
2110         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2111                 rts_threshold = nla_get_u32(
2112                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2113                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2114         }
2115
2116         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2117                 coverage_class = nla_get_u8(
2118                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2119                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2120         }
2121
2122         if (changed) {
2123                 u8 old_retry_short, old_retry_long;
2124                 u32 old_frag_threshold, old_rts_threshold;
2125                 u8 old_coverage_class;
2126
2127                 if (!rdev->ops->set_wiphy_params) {
2128                         result = -EOPNOTSUPP;
2129                         goto bad_res;
2130                 }
2131
2132                 old_retry_short = rdev->wiphy.retry_short;
2133                 old_retry_long = rdev->wiphy.retry_long;
2134                 old_frag_threshold = rdev->wiphy.frag_threshold;
2135                 old_rts_threshold = rdev->wiphy.rts_threshold;
2136                 old_coverage_class = rdev->wiphy.coverage_class;
2137
2138                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2139                         rdev->wiphy.retry_short = retry_short;
2140                 if (changed & WIPHY_PARAM_RETRY_LONG)
2141                         rdev->wiphy.retry_long = retry_long;
2142                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2143                         rdev->wiphy.frag_threshold = frag_threshold;
2144                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2145                         rdev->wiphy.rts_threshold = rts_threshold;
2146                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2147                         rdev->wiphy.coverage_class = coverage_class;
2148
2149                 result = rdev_set_wiphy_params(rdev, changed);
2150                 if (result) {
2151                         rdev->wiphy.retry_short = old_retry_short;
2152                         rdev->wiphy.retry_long = old_retry_long;
2153                         rdev->wiphy.frag_threshold = old_frag_threshold;
2154                         rdev->wiphy.rts_threshold = old_rts_threshold;
2155                         rdev->wiphy.coverage_class = old_coverage_class;
2156                 }
2157         }
2158
2159  bad_res:
2160         if (netdev)
2161                 dev_put(netdev);
2162         return result;
2163 }
2164
2165 static inline u64 wdev_id(struct wireless_dev *wdev)
2166 {
2167         return (u64)wdev->identifier |
2168                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2169 }
2170
2171 static int nl80211_send_chandef(struct sk_buff *msg,
2172                                 const struct cfg80211_chan_def *chandef)
2173 {
2174         WARN_ON(!cfg80211_chandef_valid(chandef));
2175
2176         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2177                         chandef->chan->center_freq))
2178                 return -ENOBUFS;
2179         switch (chandef->width) {
2180         case NL80211_CHAN_WIDTH_20_NOHT:
2181         case NL80211_CHAN_WIDTH_20:
2182         case NL80211_CHAN_WIDTH_40:
2183                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2184                                 cfg80211_get_chandef_type(chandef)))
2185                         return -ENOBUFS;
2186                 break;
2187         default:
2188                 break;
2189         }
2190         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2191                 return -ENOBUFS;
2192         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2193                 return -ENOBUFS;
2194         if (chandef->center_freq2 &&
2195             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2196                 return -ENOBUFS;
2197         return 0;
2198 }
2199
2200 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2201                               struct cfg80211_registered_device *rdev,
2202                               struct wireless_dev *wdev)
2203 {
2204         struct net_device *dev = wdev->netdev;
2205         void *hdr;
2206
2207         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2208         if (!hdr)
2209                 return -1;
2210
2211         if (dev &&
2212             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2213              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2214                 goto nla_put_failure;
2215
2216         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2217             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2218             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2219             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2220             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2221                         rdev->devlist_generation ^
2222                         (cfg80211_rdev_list_generation << 2)))
2223                 goto nla_put_failure;
2224
2225         if (rdev->ops->get_channel) {
2226                 int ret;
2227                 struct cfg80211_chan_def chandef;
2228
2229                 ret = rdev_get_channel(rdev, wdev, &chandef);
2230                 if (ret == 0) {
2231                         if (nl80211_send_chandef(msg, &chandef))
2232                                 goto nla_put_failure;
2233                 }
2234         }
2235
2236         if (wdev->ssid_len) {
2237                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2238                         goto nla_put_failure;
2239         }
2240
2241         return genlmsg_end(msg, hdr);
2242
2243  nla_put_failure:
2244         genlmsg_cancel(msg, hdr);
2245         return -EMSGSIZE;
2246 }
2247
2248 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2249 {
2250         int wp_idx = 0;
2251         int if_idx = 0;
2252         int wp_start = cb->args[0];
2253         int if_start = cb->args[1];
2254         struct cfg80211_registered_device *rdev;
2255         struct wireless_dev *wdev;
2256
2257         rtnl_lock();
2258         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2259                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2260                         continue;
2261                 if (wp_idx < wp_start) {
2262                         wp_idx++;
2263                         continue;
2264                 }
2265                 if_idx = 0;
2266
2267                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2268                         if (if_idx < if_start) {
2269                                 if_idx++;
2270                                 continue;
2271                         }
2272                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2273                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2274                                                rdev, wdev) < 0) {
2275                                 goto out;
2276                         }
2277                         if_idx++;
2278                 }
2279
2280                 wp_idx++;
2281         }
2282  out:
2283         rtnl_unlock();
2284
2285         cb->args[0] = wp_idx;
2286         cb->args[1] = if_idx;
2287
2288         return skb->len;
2289 }
2290
2291 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2292 {
2293         struct sk_buff *msg;
2294         struct cfg80211_registered_device *dev = info->user_ptr[0];
2295         struct wireless_dev *wdev = info->user_ptr[1];
2296
2297         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2298         if (!msg)
2299                 return -ENOMEM;
2300
2301         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2302                                dev, wdev) < 0) {
2303                 nlmsg_free(msg);
2304                 return -ENOBUFS;
2305         }
2306
2307         return genlmsg_reply(msg, info);
2308 }
2309
2310 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2311         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2312         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2313         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2314         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2315         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2316         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2317 };
2318
2319 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2320 {
2321         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2322         int flag;
2323
2324         *mntrflags = 0;
2325
2326         if (!nla)
2327                 return -EINVAL;
2328
2329         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2330                              nla, mntr_flags_policy))
2331                 return -EINVAL;
2332
2333         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2334                 if (flags[flag])
2335                         *mntrflags |= (1<<flag);
2336
2337         return 0;
2338 }
2339
2340 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2341                                struct net_device *netdev, u8 use_4addr,
2342                                enum nl80211_iftype iftype)
2343 {
2344         if (!use_4addr) {
2345                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2346                         return -EBUSY;
2347                 return 0;
2348         }
2349
2350         switch (iftype) {
2351         case NL80211_IFTYPE_AP_VLAN:
2352                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2353                         return 0;
2354                 break;
2355         case NL80211_IFTYPE_STATION:
2356                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2357                         return 0;
2358                 break;
2359         default:
2360                 break;
2361         }
2362
2363         return -EOPNOTSUPP;
2364 }
2365
2366 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2367 {
2368         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2369         struct vif_params params;
2370         int err;
2371         enum nl80211_iftype otype, ntype;
2372         struct net_device *dev = info->user_ptr[1];
2373         u32 _flags, *flags = NULL;
2374         bool change = false;
2375
2376         memset(&params, 0, sizeof(params));
2377
2378         otype = ntype = dev->ieee80211_ptr->iftype;
2379
2380         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2381                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2382                 if (otype != ntype)
2383                         change = true;
2384                 if (ntype > NL80211_IFTYPE_MAX)
2385                         return -EINVAL;
2386         }
2387
2388         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2389                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2390
2391                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2392                         return -EINVAL;
2393                 if (netif_running(dev))
2394                         return -EBUSY;
2395
2396                 wdev_lock(wdev);
2397                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2398                              IEEE80211_MAX_MESH_ID_LEN);
2399                 wdev->mesh_id_up_len =
2400                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2401                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2402                        wdev->mesh_id_up_len);
2403                 wdev_unlock(wdev);
2404         }
2405
2406         if (info->attrs[NL80211_ATTR_4ADDR]) {
2407                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2408                 change = true;
2409                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2410                 if (err)
2411                         return err;
2412         } else {
2413                 params.use_4addr = -1;
2414         }
2415
2416         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2417                 if (ntype != NL80211_IFTYPE_MONITOR)
2418                         return -EINVAL;
2419                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2420                                           &_flags);
2421                 if (err)
2422                         return err;
2423
2424                 flags = &_flags;
2425                 change = true;
2426         }
2427
2428         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2429             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2430                 return -EOPNOTSUPP;
2431
2432         if (change)
2433                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2434         else
2435                 err = 0;
2436
2437         if (!err && params.use_4addr != -1)
2438                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2439
2440         return err;
2441 }
2442
2443 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2444 {
2445         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2446         struct vif_params params;
2447         struct wireless_dev *wdev;
2448         struct sk_buff *msg;
2449         int err;
2450         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2451         u32 flags;
2452
2453         memset(&params, 0, sizeof(params));
2454
2455         if (!info->attrs[NL80211_ATTR_IFNAME])
2456                 return -EINVAL;
2457
2458         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2459                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2460                 if (type > NL80211_IFTYPE_MAX)
2461                         return -EINVAL;
2462         }
2463
2464         if (!rdev->ops->add_virtual_intf ||
2465             !(rdev->wiphy.interface_modes & (1 << type)))
2466                 return -EOPNOTSUPP;
2467
2468         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2469                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2470                            ETH_ALEN);
2471                 if (!is_valid_ether_addr(params.macaddr))
2472                         return -EADDRNOTAVAIL;
2473         }
2474
2475         if (info->attrs[NL80211_ATTR_4ADDR]) {
2476                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2477                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2478                 if (err)
2479                         return err;
2480         }
2481
2482         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2483         if (!msg)
2484                 return -ENOMEM;
2485
2486         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2487                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2488                                   &flags);
2489
2490         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2491             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2492                 return -EOPNOTSUPP;
2493
2494         wdev = rdev_add_virtual_intf(rdev,
2495                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2496                                 type, err ? NULL : &flags, &params);
2497         if (IS_ERR(wdev)) {
2498                 nlmsg_free(msg);
2499                 return PTR_ERR(wdev);
2500         }
2501
2502         switch (type) {
2503         case NL80211_IFTYPE_MESH_POINT:
2504                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2505                         break;
2506                 wdev_lock(wdev);
2507                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2508                              IEEE80211_MAX_MESH_ID_LEN);
2509                 wdev->mesh_id_up_len =
2510                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2511                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2512                        wdev->mesh_id_up_len);
2513                 wdev_unlock(wdev);
2514                 break;
2515         case NL80211_IFTYPE_P2P_DEVICE:
2516                 /*
2517                  * P2P Device doesn't have a netdev, so doesn't go
2518                  * through the netdev notifier and must be added here
2519                  */
2520                 mutex_init(&wdev->mtx);
2521                 INIT_LIST_HEAD(&wdev->event_list);
2522                 spin_lock_init(&wdev->event_lock);
2523                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2524                 spin_lock_init(&wdev->mgmt_registrations_lock);
2525
2526                 wdev->identifier = ++rdev->wdev_id;
2527                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2528                 rdev->devlist_generation++;
2529                 break;
2530         default:
2531                 break;
2532         }
2533
2534         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2535                                rdev, wdev) < 0) {
2536                 nlmsg_free(msg);
2537                 return -ENOBUFS;
2538         }
2539
2540         return genlmsg_reply(msg, info);
2541 }
2542
2543 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2544 {
2545         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2546         struct wireless_dev *wdev = info->user_ptr[1];
2547
2548         if (!rdev->ops->del_virtual_intf)
2549                 return -EOPNOTSUPP;
2550
2551         /*
2552          * If we remove a wireless device without a netdev then clear
2553          * user_ptr[1] so that nl80211_post_doit won't dereference it
2554          * to check if it needs to do dev_put(). Otherwise it crashes
2555          * since the wdev has been freed, unlike with a netdev where
2556          * we need the dev_put() for the netdev to really be freed.
2557          */
2558         if (!wdev->netdev)
2559                 info->user_ptr[1] = NULL;
2560
2561         return rdev_del_virtual_intf(rdev, wdev);
2562 }
2563
2564 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2565 {
2566         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2567         struct net_device *dev = info->user_ptr[1];
2568         u16 noack_map;
2569
2570         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2571                 return -EINVAL;
2572
2573         if (!rdev->ops->set_noack_map)
2574                 return -EOPNOTSUPP;
2575
2576         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2577
2578         return rdev_set_noack_map(rdev, dev, noack_map);
2579 }
2580
2581 struct get_key_cookie {
2582         struct sk_buff *msg;
2583         int error;
2584         int idx;
2585 };
2586
2587 static void get_key_callback(void *c, struct key_params *params)
2588 {
2589         struct nlattr *key;
2590         struct get_key_cookie *cookie = c;
2591
2592         if ((params->key &&
2593              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2594                      params->key_len, params->key)) ||
2595             (params->seq &&
2596              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2597                      params->seq_len, params->seq)) ||
2598             (params->cipher &&
2599              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2600                          params->cipher)))
2601                 goto nla_put_failure;
2602
2603         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2604         if (!key)
2605                 goto nla_put_failure;
2606
2607         if ((params->key &&
2608              nla_put(cookie->msg, NL80211_KEY_DATA,
2609                      params->key_len, params->key)) ||
2610             (params->seq &&
2611              nla_put(cookie->msg, NL80211_KEY_SEQ,
2612                      params->seq_len, params->seq)) ||
2613             (params->cipher &&
2614              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2615                          params->cipher)))
2616                 goto nla_put_failure;
2617
2618         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2619                 goto nla_put_failure;
2620
2621         nla_nest_end(cookie->msg, key);
2622
2623         return;
2624  nla_put_failure:
2625         cookie->error = 1;
2626 }
2627
2628 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2629 {
2630         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2631         int err;
2632         struct net_device *dev = info->user_ptr[1];
2633         u8 key_idx = 0;
2634         const u8 *mac_addr = NULL;
2635         bool pairwise;
2636         struct get_key_cookie cookie = {
2637                 .error = 0,
2638         };
2639         void *hdr;
2640         struct sk_buff *msg;
2641
2642         if (info->attrs[NL80211_ATTR_KEY_IDX])
2643                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2644
2645         if (key_idx > 5)
2646                 return -EINVAL;
2647
2648         if (info->attrs[NL80211_ATTR_MAC])
2649                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2650
2651         pairwise = !!mac_addr;
2652         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2653                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2654                 if (kt >= NUM_NL80211_KEYTYPES)
2655                         return -EINVAL;
2656                 if (kt != NL80211_KEYTYPE_GROUP &&
2657                     kt != NL80211_KEYTYPE_PAIRWISE)
2658                         return -EINVAL;
2659                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2660         }
2661
2662         if (!rdev->ops->get_key)
2663                 return -EOPNOTSUPP;
2664
2665         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2666         if (!msg)
2667                 return -ENOMEM;
2668
2669         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2670                              NL80211_CMD_NEW_KEY);
2671         if (!hdr)
2672                 return -ENOBUFS;
2673
2674         cookie.msg = msg;
2675         cookie.idx = key_idx;
2676
2677         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2678             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2679                 goto nla_put_failure;
2680         if (mac_addr &&
2681             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2682                 goto nla_put_failure;
2683
2684         if (pairwise && mac_addr &&
2685             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2686                 return -ENOENT;
2687
2688         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2689                            get_key_callback);
2690
2691         if (err)
2692                 goto free_msg;
2693
2694         if (cookie.error)
2695                 goto nla_put_failure;
2696
2697         genlmsg_end(msg, hdr);
2698         return genlmsg_reply(msg, info);
2699
2700  nla_put_failure:
2701         err = -ENOBUFS;
2702  free_msg:
2703         nlmsg_free(msg);
2704         return err;
2705 }
2706
2707 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2708 {
2709         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2710         struct key_parse key;
2711         int err;
2712         struct net_device *dev = info->user_ptr[1];
2713
2714         err = nl80211_parse_key(info, &key);
2715         if (err)
2716                 return err;
2717
2718         if (key.idx < 0)
2719                 return -EINVAL;
2720
2721         /* only support setting default key */
2722         if (!key.def && !key.defmgmt)
2723                 return -EINVAL;
2724
2725         wdev_lock(dev->ieee80211_ptr);
2726
2727         if (key.def) {
2728                 if (!rdev->ops->set_default_key) {
2729                         err = -EOPNOTSUPP;
2730                         goto out;
2731                 }
2732
2733                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2734                 if (err)
2735                         goto out;
2736
2737                 err = rdev_set_default_key(rdev, dev, key.idx,
2738                                                  key.def_uni, key.def_multi);
2739
2740                 if (err)
2741                         goto out;
2742
2743 #ifdef CONFIG_CFG80211_WEXT
2744                 dev->ieee80211_ptr->wext.default_key = key.idx;
2745 #endif
2746         } else {
2747                 if (key.def_uni || !key.def_multi) {
2748                         err = -EINVAL;
2749                         goto out;
2750                 }
2751
2752                 if (!rdev->ops->set_default_mgmt_key) {
2753                         err = -EOPNOTSUPP;
2754                         goto out;
2755                 }
2756
2757                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2758                 if (err)
2759                         goto out;
2760
2761                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2762                 if (err)
2763                         goto out;
2764
2765 #ifdef CONFIG_CFG80211_WEXT
2766                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2767 #endif
2768         }
2769
2770  out:
2771         wdev_unlock(dev->ieee80211_ptr);
2772
2773         return err;
2774 }
2775
2776 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2777 {
2778         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2779         int err;
2780         struct net_device *dev = info->user_ptr[1];
2781         struct key_parse key;
2782         const u8 *mac_addr = NULL;
2783
2784         err = nl80211_parse_key(info, &key);
2785         if (err)
2786                 return err;
2787
2788         if (!key.p.key)
2789                 return -EINVAL;
2790
2791         if (info->attrs[NL80211_ATTR_MAC])
2792                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2793
2794         if (key.type == -1) {
2795                 if (mac_addr)
2796                         key.type = NL80211_KEYTYPE_PAIRWISE;
2797                 else
2798                         key.type = NL80211_KEYTYPE_GROUP;
2799         }
2800
2801         /* for now */
2802         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2803             key.type != NL80211_KEYTYPE_GROUP)
2804                 return -EINVAL;
2805
2806         if (!rdev->ops->add_key)
2807                 return -EOPNOTSUPP;
2808
2809         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2810                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2811                                            mac_addr))
2812                 return -EINVAL;
2813
2814         wdev_lock(dev->ieee80211_ptr);
2815         err = nl80211_key_allowed(dev->ieee80211_ptr);
2816         if (!err)
2817                 err = rdev_add_key(rdev, dev, key.idx,
2818                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2819                                     mac_addr, &key.p);
2820         wdev_unlock(dev->ieee80211_ptr);
2821
2822         return err;
2823 }
2824
2825 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2826 {
2827         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2828         int err;
2829         struct net_device *dev = info->user_ptr[1];
2830         u8 *mac_addr = NULL;
2831         struct key_parse key;
2832
2833         err = nl80211_parse_key(info, &key);
2834         if (err)
2835                 return err;
2836
2837         if (info->attrs[NL80211_ATTR_MAC])
2838                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2839
2840         if (key.type == -1) {
2841                 if (mac_addr)
2842                         key.type = NL80211_KEYTYPE_PAIRWISE;
2843                 else
2844                         key.type = NL80211_KEYTYPE_GROUP;
2845         }
2846
2847         /* for now */
2848         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2849             key.type != NL80211_KEYTYPE_GROUP)
2850                 return -EINVAL;
2851
2852         if (!rdev->ops->del_key)
2853                 return -EOPNOTSUPP;
2854
2855         wdev_lock(dev->ieee80211_ptr);
2856         err = nl80211_key_allowed(dev->ieee80211_ptr);
2857
2858         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2859             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2860                 err = -ENOENT;
2861
2862         if (!err)
2863                 err = rdev_del_key(rdev, dev, key.idx,
2864                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2865                                    mac_addr);
2866
2867 #ifdef CONFIG_CFG80211_WEXT
2868         if (!err) {
2869                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2870                         dev->ieee80211_ptr->wext.default_key = -1;
2871                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2872                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2873         }
2874 #endif
2875         wdev_unlock(dev->ieee80211_ptr);
2876
2877         return err;
2878 }
2879
2880 /* This function returns an error or the number of nested attributes */
2881 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2882 {
2883         struct nlattr *attr;
2884         int n_entries = 0, tmp;
2885
2886         nla_for_each_nested(attr, nl_attr, tmp) {
2887                 if (nla_len(attr) != ETH_ALEN)
2888                         return -EINVAL;
2889
2890                 n_entries++;
2891         }
2892
2893         return n_entries;
2894 }
2895
2896 /*
2897  * This function parses ACL information and allocates memory for ACL data.
2898  * On successful return, the calling function is responsible to free the
2899  * ACL buffer returned by this function.
2900  */
2901 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2902                                                 struct genl_info *info)
2903 {
2904         enum nl80211_acl_policy acl_policy;
2905         struct nlattr *attr;
2906         struct cfg80211_acl_data *acl;
2907         int i = 0, n_entries, tmp;
2908
2909         if (!wiphy->max_acl_mac_addrs)
2910                 return ERR_PTR(-EOPNOTSUPP);
2911
2912         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2913                 return ERR_PTR(-EINVAL);
2914
2915         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2916         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2917             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2918                 return ERR_PTR(-EINVAL);
2919
2920         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2921                 return ERR_PTR(-EINVAL);
2922
2923         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2924         if (n_entries < 0)
2925                 return ERR_PTR(n_entries);
2926
2927         if (n_entries > wiphy->max_acl_mac_addrs)
2928                 return ERR_PTR(-ENOTSUPP);
2929
2930         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2931                       GFP_KERNEL);
2932         if (!acl)
2933                 return ERR_PTR(-ENOMEM);
2934
2935         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2936                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2937                 i++;
2938         }
2939
2940         acl->n_acl_entries = n_entries;
2941         acl->acl_policy = acl_policy;
2942
2943         return acl;
2944 }
2945
2946 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2947 {
2948         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2949         struct net_device *dev = info->user_ptr[1];
2950         struct cfg80211_acl_data *acl;
2951         int err;
2952
2953         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2954             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2955                 return -EOPNOTSUPP;
2956
2957         if (!dev->ieee80211_ptr->beacon_interval)
2958                 return -EINVAL;
2959
2960         acl = parse_acl_data(&rdev->wiphy, info);
2961         if (IS_ERR(acl))
2962                 return PTR_ERR(acl);
2963
2964         err = rdev_set_mac_acl(rdev, dev, acl);
2965
2966         kfree(acl);
2967
2968         return err;
2969 }
2970
2971 static int nl80211_parse_beacon(struct nlattr *attrs[],
2972                                 struct cfg80211_beacon_data *bcn)
2973 {
2974         bool haveinfo = false;
2975
2976         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
2977             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
2978             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2979             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2980                 return -EINVAL;
2981
2982         memset(bcn, 0, sizeof(*bcn));
2983
2984         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
2985                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
2986                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
2987                 if (!bcn->head_len)
2988                         return -EINVAL;
2989                 haveinfo = true;
2990         }
2991
2992         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
2993                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
2994                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
2995                 haveinfo = true;
2996         }
2997
2998         if (!haveinfo)
2999                 return -EINVAL;
3000
3001         if (attrs[NL80211_ATTR_IE]) {
3002                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3003                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3004         }
3005
3006         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3007                 bcn->proberesp_ies =
3008                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3009                 bcn->proberesp_ies_len =
3010                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3011         }
3012
3013         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3014                 bcn->assocresp_ies =
3015                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3016                 bcn->assocresp_ies_len =
3017                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3018         }
3019
3020         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3021                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3022                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3023         }
3024
3025         return 0;
3026 }
3027
3028 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3029                                    struct cfg80211_ap_settings *params)
3030 {
3031         struct wireless_dev *wdev;
3032         bool ret = false;
3033
3034         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3035                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3036                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3037                         continue;
3038
3039                 if (!wdev->preset_chandef.chan)
3040                         continue;
3041
3042                 params->chandef = wdev->preset_chandef;
3043                 ret = true;
3044                 break;
3045         }
3046
3047         return ret;
3048 }
3049
3050 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3051                                     enum nl80211_auth_type auth_type,
3052                                     enum nl80211_commands cmd)
3053 {
3054         if (auth_type > NL80211_AUTHTYPE_MAX)
3055                 return false;
3056
3057         switch (cmd) {
3058         case NL80211_CMD_AUTHENTICATE:
3059                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3060                     auth_type == NL80211_AUTHTYPE_SAE)
3061                         return false;
3062                 return true;
3063         case NL80211_CMD_CONNECT:
3064         case NL80211_CMD_START_AP:
3065                 /* SAE not supported yet */
3066                 if (auth_type == NL80211_AUTHTYPE_SAE)
3067                         return false;
3068                 return true;
3069         default:
3070                 return false;
3071         }
3072 }
3073
3074 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3075 {
3076         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3077         struct net_device *dev = info->user_ptr[1];
3078         struct wireless_dev *wdev = dev->ieee80211_ptr;
3079         struct cfg80211_ap_settings params;
3080         int err;
3081         u8 radar_detect_width = 0;
3082
3083         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3084             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3085                 return -EOPNOTSUPP;
3086
3087         if (!rdev->ops->start_ap)
3088                 return -EOPNOTSUPP;
3089
3090         if (wdev->beacon_interval)
3091                 return -EALREADY;
3092
3093         memset(&params, 0, sizeof(params));
3094
3095         /* these are required for START_AP */
3096         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3097             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3098             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3099                 return -EINVAL;
3100
3101         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3102         if (err)
3103                 return err;
3104
3105         params.beacon_interval =
3106                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3107         params.dtim_period =
3108                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3109
3110         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3111         if (err)
3112                 return err;
3113
3114         /*
3115          * In theory, some of these attributes should be required here
3116          * but since they were not used when the command was originally
3117          * added, keep them optional for old user space programs to let
3118          * them continue to work with drivers that do not need the
3119          * additional information -- drivers must check!
3120          */
3121         if (info->attrs[NL80211_ATTR_SSID]) {
3122                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3123                 params.ssid_len =
3124                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3125                 if (params.ssid_len == 0 ||
3126                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3127                         return -EINVAL;
3128         }
3129
3130         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3131                 params.hidden_ssid = nla_get_u32(
3132                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3133                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3134                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3135                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3136                         return -EINVAL;
3137         }
3138
3139         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3140
3141         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3142                 params.auth_type = nla_get_u32(
3143                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3144                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3145                                              NL80211_CMD_START_AP))
3146                         return -EINVAL;
3147         } else
3148                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3149
3150         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3151                                       NL80211_MAX_NR_CIPHER_SUITES);
3152         if (err)
3153                 return err;
3154
3155         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3156                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3157                         return -EOPNOTSUPP;
3158                 params.inactivity_timeout = nla_get_u16(
3159                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3160         }
3161
3162         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3163                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3164                         return -EINVAL;
3165                 params.p2p_ctwindow =
3166                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3167                 if (params.p2p_ctwindow > 127)
3168                         return -EINVAL;
3169                 if (params.p2p_ctwindow != 0 &&
3170                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3171                         return -EINVAL;
3172         }
3173
3174         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3175                 u8 tmp;
3176
3177                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3178                         return -EINVAL;
3179                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3180                 if (tmp > 1)
3181                         return -EINVAL;
3182                 params.p2p_opp_ps = tmp;
3183                 if (params.p2p_opp_ps != 0 &&
3184                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3185                         return -EINVAL;
3186         }
3187
3188         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3189                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3190                 if (err)
3191                         return err;
3192         } else if (wdev->preset_chandef.chan) {
3193                 params.chandef = wdev->preset_chandef;
3194         } else if (!nl80211_get_ap_channel(rdev, &params))
3195                 return -EINVAL;
3196
3197         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3198                 return -EINVAL;
3199
3200         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3201         if (err < 0)
3202                 return err;
3203         if (err) {
3204                 radar_detect_width = BIT(params.chandef.width);
3205                 params.radar_required = true;
3206         }
3207
3208         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3209                                            params.chandef.chan,
3210                                            CHAN_MODE_SHARED,
3211                                            radar_detect_width);
3212         if (err)
3213                 return err;
3214
3215         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3216                 params.acl = parse_acl_data(&rdev->wiphy, info);
3217                 if (IS_ERR(params.acl))
3218                         return PTR_ERR(params.acl);
3219         }
3220
3221         wdev_lock(wdev);
3222         err = rdev_start_ap(rdev, dev, &params);
3223         if (!err) {
3224                 wdev->preset_chandef = params.chandef;
3225                 wdev->beacon_interval = params.beacon_interval;
3226                 wdev->channel = params.chandef.chan;
3227                 wdev->ssid_len = params.ssid_len;
3228                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3229         }
3230         wdev_unlock(wdev);
3231
3232         kfree(params.acl);
3233
3234         return err;
3235 }
3236
3237 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3238 {
3239         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3240         struct net_device *dev = info->user_ptr[1];
3241         struct wireless_dev *wdev = dev->ieee80211_ptr;
3242         struct cfg80211_beacon_data params;
3243         int err;
3244
3245         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3246             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3247                 return -EOPNOTSUPP;
3248
3249         if (!rdev->ops->change_beacon)
3250                 return -EOPNOTSUPP;
3251
3252         if (!wdev->beacon_interval)
3253                 return -EINVAL;
3254
3255         err = nl80211_parse_beacon(info->attrs, &params);
3256         if (err)
3257                 return err;
3258
3259         wdev_lock(wdev);
3260         err = rdev_change_beacon(rdev, dev, &params);
3261         wdev_unlock(wdev);
3262
3263         return err;
3264 }
3265
3266 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3267 {
3268         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3269         struct net_device *dev = info->user_ptr[1];
3270
3271         return cfg80211_stop_ap(rdev, dev);
3272 }
3273
3274 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3275         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3276         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3277         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3278         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3279         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3280         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3281 };
3282
3283 static int parse_station_flags(struct genl_info *info,
3284                                enum nl80211_iftype iftype,
3285                                struct station_parameters *params)
3286 {
3287         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3288         struct nlattr *nla;
3289         int flag;
3290
3291         /*
3292          * Try parsing the new attribute first so userspace
3293          * can specify both for older kernels.
3294          */
3295         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3296         if (nla) {
3297                 struct nl80211_sta_flag_update *sta_flags;
3298
3299                 sta_flags = nla_data(nla);
3300                 params->sta_flags_mask = sta_flags->mask;
3301                 params->sta_flags_set = sta_flags->set;
3302                 params->sta_flags_set &= params->sta_flags_mask;
3303                 if ((params->sta_flags_mask |
3304                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3305                         return -EINVAL;
3306                 return 0;
3307         }
3308
3309         /* if present, parse the old attribute */
3310
3311         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3312         if (!nla)
3313                 return 0;
3314
3315         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3316                              nla, sta_flags_policy))
3317                 return -EINVAL;
3318
3319         /*
3320          * Only allow certain flags for interface types so that
3321          * other attributes are silently ignored. Remember that
3322          * this is backward compatibility code with old userspace
3323          * and shouldn't be hit in other cases anyway.
3324          */
3325         switch (iftype) {
3326         case NL80211_IFTYPE_AP:
3327         case NL80211_IFTYPE_AP_VLAN:
3328         case NL80211_IFTYPE_P2P_GO:
3329                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3330                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3331                                          BIT(NL80211_STA_FLAG_WME) |
3332                                          BIT(NL80211_STA_FLAG_MFP);
3333                 break;
3334         case NL80211_IFTYPE_P2P_CLIENT:
3335         case NL80211_IFTYPE_STATION:
3336                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3337                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3338                 break;
3339         case NL80211_IFTYPE_MESH_POINT:
3340                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3341                                          BIT(NL80211_STA_FLAG_MFP) |
3342                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3343         default:
3344                 return -EINVAL;
3345         }
3346
3347         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3348                 if (flags[flag]) {
3349                         params->sta_flags_set |= (1<<flag);
3350
3351                         /* no longer support new API additions in old API */
3352                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3353                                 return -EINVAL;
3354                 }
3355         }
3356
3357         return 0;
3358 }
3359
3360 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3361                                  int attr)
3362 {
3363         struct nlattr *rate;
3364         u32 bitrate;
3365         u16 bitrate_compat;
3366
3367         rate = nla_nest_start(msg, attr);
3368         if (!rate)
3369                 return false;
3370
3371         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3372         bitrate = cfg80211_calculate_bitrate(info);
3373         /* report 16-bit bitrate only if we can */
3374         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3375         if (bitrate > 0 &&
3376             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3377                 return false;
3378         if (bitrate_compat > 0 &&
3379             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3380                 return false;
3381
3382         if (info->flags & RATE_INFO_FLAGS_MCS) {
3383                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3384                         return false;
3385                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3386                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3387                         return false;
3388                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3389                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3390                         return false;
3391         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3392                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3393                         return false;
3394                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3395                         return false;
3396                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3397                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3398                         return false;
3399                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3400                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3401                         return false;
3402                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3403                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3404                         return false;
3405                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3406                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3407                         return false;
3408                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3409                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3410                         return false;
3411         }
3412
3413         nla_nest_end(msg, rate);
3414         return true;
3415 }
3416
3417 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3418                                int id)
3419 {
3420         void *attr;
3421         int i = 0;
3422
3423         if (!mask)
3424                 return true;
3425
3426         attr = nla_nest_start(msg, id);
3427         if (!attr)
3428                 return false;
3429
3430         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3431                 if (!(mask & BIT(i)))
3432                         continue;
3433
3434                 if (nla_put_u8(msg, i, signal[i]))
3435                         return false;
3436         }
3437
3438         nla_nest_end(msg, attr);
3439
3440         return true;
3441 }
3442
3443 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3444                                 int flags,
3445                                 struct cfg80211_registered_device *rdev,
3446                                 struct net_device *dev,
3447                                 const u8 *mac_addr, struct station_info *sinfo)
3448 {
3449         void *hdr;
3450         struct nlattr *sinfoattr, *bss_param;
3451
3452         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3453         if (!hdr)
3454                 return -1;
3455
3456         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3457             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3458             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3459                 goto nla_put_failure;
3460
3461         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3462         if (!sinfoattr)
3463                 goto nla_put_failure;
3464         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3465             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3466                         sinfo->connected_time))
3467                 goto nla_put_failure;
3468         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3469             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3470                         sinfo->inactive_time))
3471                 goto nla_put_failure;
3472         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3473                               STATION_INFO_RX_BYTES64)) &&
3474             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3475                         (u32)sinfo->rx_bytes))
3476                 goto nla_put_failure;
3477         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3478                               STATION_INFO_TX_BYTES64)) &&
3479             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3480                         (u32)sinfo->tx_bytes))
3481                 goto nla_put_failure;
3482         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3483             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3484                         sinfo->rx_bytes))
3485                 goto nla_put_failure;
3486         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3487             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3488                         sinfo->tx_bytes))
3489                 goto nla_put_failure;
3490         if ((sinfo->filled & STATION_INFO_LLID) &&
3491             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3492                 goto nla_put_failure;
3493         if ((sinfo->filled & STATION_INFO_PLID) &&
3494             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3495                 goto nla_put_failure;
3496         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3497             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3498                        sinfo->plink_state))
3499                 goto nla_put_failure;
3500         switch (rdev->wiphy.signal_type) {
3501         case CFG80211_SIGNAL_TYPE_MBM:
3502                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3503                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3504                                sinfo->signal))
3505                         goto nla_put_failure;
3506                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3507                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3508                                sinfo->signal_avg))
3509                         goto nla_put_failure;
3510                 break;
3511         default:
3512                 break;
3513         }
3514         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3515                 if (!nl80211_put_signal(msg, sinfo->chains,
3516                                         sinfo->chain_signal,
3517                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3518                         goto nla_put_failure;
3519         }
3520         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3521                 if (!nl80211_put_signal(msg, sinfo->chains,
3522                                         sinfo->chain_signal_avg,
3523                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3524                         goto nla_put_failure;
3525         }
3526         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3527                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3528                                           NL80211_STA_INFO_TX_BITRATE))
3529                         goto nla_put_failure;
3530         }
3531         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3532                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3533                                           NL80211_STA_INFO_RX_BITRATE))
3534                         goto nla_put_failure;
3535         }
3536         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3537             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3538                         sinfo->rx_packets))
3539                 goto nla_put_failure;
3540         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3541             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3542                         sinfo->tx_packets))
3543                 goto nla_put_failure;
3544         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3545             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3546                         sinfo->tx_retries))
3547                 goto nla_put_failure;
3548         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3549             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3550                         sinfo->tx_failed))
3551                 goto nla_put_failure;
3552         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3553             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3554                         sinfo->beacon_loss_count))
3555                 goto nla_put_failure;
3556         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3557             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3558                         sinfo->local_pm))
3559                 goto nla_put_failure;
3560         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3561             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3562                         sinfo->peer_pm))
3563                 goto nla_put_failure;
3564         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3565             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3566                         sinfo->nonpeer_pm))
3567                 goto nla_put_failure;
3568         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3569                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3570                 if (!bss_param)
3571                         goto nla_put_failure;
3572
3573                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3574                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3575                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3576                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3577                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3578                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3579                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3580                                sinfo->bss_param.dtim_period) ||
3581                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3582                                 sinfo->bss_param.beacon_interval))
3583                         goto nla_put_failure;
3584
3585                 nla_nest_end(msg, bss_param);
3586         }
3587         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3588             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3589                     sizeof(struct nl80211_sta_flag_update),
3590                     &sinfo->sta_flags))
3591                 goto nla_put_failure;
3592         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3593                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3594                             sinfo->t_offset))
3595                 goto nla_put_failure;
3596         nla_nest_end(msg, sinfoattr);
3597
3598         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3599             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3600                     sinfo->assoc_req_ies))
3601                 goto nla_put_failure;
3602
3603         return genlmsg_end(msg, hdr);
3604
3605  nla_put_failure:
3606         genlmsg_cancel(msg, hdr);
3607         return -EMSGSIZE;
3608 }
3609
3610 static int nl80211_dump_station(struct sk_buff *skb,
3611                                 struct netlink_callback *cb)
3612 {
3613         struct station_info sinfo;
3614         struct cfg80211_registered_device *dev;
3615         struct wireless_dev *wdev;
3616         u8 mac_addr[ETH_ALEN];
3617         int sta_idx = cb->args[2];
3618         int err;
3619
3620         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3621         if (err)
3622                 return err;
3623
3624         if (!wdev->netdev) {
3625                 err = -EINVAL;
3626                 goto out_err;
3627         }
3628
3629         if (!dev->ops->dump_station) {
3630                 err = -EOPNOTSUPP;
3631                 goto out_err;
3632         }
3633
3634         while (1) {
3635                 memset(&sinfo, 0, sizeof(sinfo));
3636                 err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3637                                         mac_addr, &sinfo);
3638                 if (err == -ENOENT)
3639                         break;
3640                 if (err)
3641                         goto out_err;
3642
3643                 if (nl80211_send_station(skb,
3644                                 NETLINK_CB(cb->skb).portid,
3645                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3646                                 dev, wdev->netdev, mac_addr,
3647                                 &sinfo) < 0)
3648                         goto out;
3649
3650                 sta_idx++;
3651         }
3652
3653
3654  out:
3655         cb->args[2] = sta_idx;
3656         err = skb->len;
3657  out_err:
3658         nl80211_finish_wdev_dump(dev);
3659
3660         return err;
3661 }
3662
3663 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3664 {
3665         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3666         struct net_device *dev = info->user_ptr[1];
3667         struct station_info sinfo;
3668         struct sk_buff *msg;
3669         u8 *mac_addr = NULL;
3670         int err;
3671
3672         memset(&sinfo, 0, sizeof(sinfo));
3673
3674         if (!info->attrs[NL80211_ATTR_MAC])
3675                 return -EINVAL;
3676
3677         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3678
3679         if (!rdev->ops->get_station)
3680                 return -EOPNOTSUPP;
3681
3682         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3683         if (err)
3684                 return err;
3685
3686         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3687         if (!msg)
3688                 return -ENOMEM;
3689
3690         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3691                                  rdev, dev, mac_addr, &sinfo) < 0) {
3692                 nlmsg_free(msg);
3693                 return -ENOBUFS;
3694         }
3695
3696         return genlmsg_reply(msg, info);
3697 }
3698
3699 int cfg80211_check_station_change(struct wiphy *wiphy,
3700                                   struct station_parameters *params,
3701                                   enum cfg80211_station_type statype)
3702 {
3703         if (params->listen_interval != -1)
3704                 return -EINVAL;
3705         if (params->aid)
3706                 return -EINVAL;
3707
3708         /* When you run into this, adjust the code below for the new flag */
3709         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3710
3711         switch (statype) {
3712         case CFG80211_STA_MESH_PEER_KERNEL:
3713         case CFG80211_STA_MESH_PEER_USER:
3714                 /*
3715                  * No ignoring the TDLS flag here -- the userspace mesh
3716                  * code doesn't have the bug of including TDLS in the
3717                  * mask everywhere.
3718                  */
3719                 if (params->sta_flags_mask &
3720                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3721                                   BIT(NL80211_STA_FLAG_MFP) |
3722                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3723                         return -EINVAL;
3724                 break;
3725         case CFG80211_STA_TDLS_PEER_SETUP:
3726         case CFG80211_STA_TDLS_PEER_ACTIVE:
3727                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3728                         return -EINVAL;
3729                 /* ignore since it can't change */
3730                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3731                 break;
3732         default:
3733                 /* disallow mesh-specific things */
3734                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3735                         return -EINVAL;
3736                 if (params->local_pm)
3737                         return -EINVAL;
3738                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3739                         return -EINVAL;
3740         }
3741
3742         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3743             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3744                 /* TDLS can't be set, ... */
3745                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3746                         return -EINVAL;
3747                 /*
3748                  * ... but don't bother the driver with it. This works around
3749                  * a hostapd/wpa_supplicant issue -- it always includes the
3750                  * TLDS_PEER flag in the mask even for AP mode.
3751                  */
3752                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3753         }
3754
3755         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3756                 /* reject other things that can't change */
3757                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3758                         return -EINVAL;
3759                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3760                         return -EINVAL;
3761                 if (params->supported_rates)
3762                         return -EINVAL;
3763                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3764                         return -EINVAL;
3765         }
3766
3767         if (statype != CFG80211_STA_AP_CLIENT) {
3768                 if (params->vlan)
3769                         return -EINVAL;
3770         }
3771
3772         switch (statype) {
3773         case CFG80211_STA_AP_MLME_CLIENT:
3774                 /* Use this only for authorizing/unauthorizing a station */
3775                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3776                         return -EOPNOTSUPP;
3777                 break;
3778         case CFG80211_STA_AP_CLIENT:
3779                 /* accept only the listed bits */
3780                 if (params->sta_flags_mask &
3781                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3782                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3783                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3784                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3785                                   BIT(NL80211_STA_FLAG_WME) |
3786                                   BIT(NL80211_STA_FLAG_MFP)))
3787                         return -EINVAL;
3788
3789                 /* but authenticated/associated only if driver handles it */
3790                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3791                     params->sta_flags_mask &
3792                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3793                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3794                         return -EINVAL;
3795                 break;
3796         case CFG80211_STA_IBSS:
3797         case CFG80211_STA_AP_STA:
3798                 /* reject any changes other than AUTHORIZED */
3799                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3800                         return -EINVAL;
3801                 break;
3802         case CFG80211_STA_TDLS_PEER_SETUP:
3803                 /* reject any changes other than AUTHORIZED or WME */
3804                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3805                                                BIT(NL80211_STA_FLAG_WME)))
3806                         return -EINVAL;
3807                 /* force (at least) rates when authorizing */
3808                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3809                     !params->supported_rates)
3810                         return -EINVAL;
3811                 break;
3812         case CFG80211_STA_TDLS_PEER_ACTIVE:
3813                 /* reject any changes */
3814                 return -EINVAL;
3815         case CFG80211_STA_MESH_PEER_KERNEL:
3816                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3817                         return -EINVAL;
3818                 break;
3819         case CFG80211_STA_MESH_PEER_USER:
3820                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3821                         return -EINVAL;
3822                 break;
3823         }
3824
3825         return 0;
3826 }
3827 EXPORT_SYMBOL(cfg80211_check_station_change);
3828
3829 /*
3830  * Get vlan interface making sure it is running and on the right wiphy.
3831  */
3832 static struct net_device *get_vlan(struct genl_info *info,
3833                                    struct cfg80211_registered_device *rdev)
3834 {
3835         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3836         struct net_device *v;
3837         int ret;
3838
3839         if (!vlanattr)
3840                 return NULL;
3841
3842         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3843         if (!v)
3844                 return ERR_PTR(-ENODEV);
3845
3846         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3847                 ret = -EINVAL;
3848                 goto error;
3849         }
3850
3851         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3852             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3853             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3854                 ret = -EINVAL;
3855                 goto error;
3856         }
3857
3858         if (!netif_running(v)) {
3859                 ret = -ENETDOWN;
3860                 goto error;
3861         }
3862
3863         return v;
3864  error:
3865         dev_put(v);
3866         return ERR_PTR(ret);
3867 }
3868
3869 static struct nla_policy
3870 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3871         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3872         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3873 };
3874
3875 static int nl80211_parse_sta_wme(struct genl_info *info,
3876                                  struct station_parameters *params)
3877 {
3878         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3879         struct nlattr *nla;
3880         int err;
3881
3882         /* parse WME attributes if present */
3883         if (!info->attrs[NL80211_ATTR_STA_WME])
3884                 return 0;
3885
3886         nla = info->attrs[NL80211_ATTR_STA_WME];
3887         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3888                                nl80211_sta_wme_policy);
3889         if (err)
3890                 return err;
3891
3892         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3893                 params->uapsd_queues = nla_get_u8(
3894                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3895         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3896                 return -EINVAL;
3897
3898         if (tb[NL80211_STA_WME_MAX_SP])
3899                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3900
3901         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3902                 return -EINVAL;
3903
3904         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3905
3906         return 0;
3907 }
3908
3909 static int nl80211_parse_sta_channel_info(struct genl_info *info,
3910                                       struct station_parameters *params)
3911 {
3912         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
3913                 params->supported_channels =
3914                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
3915                 params->supported_channels_len =
3916                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
3917                 /*
3918                  * Need to include at least one (first channel, number of
3919                  * channels) tuple for each subband, and must have proper
3920                  * tuples for the rest of the data as well.
3921                  */
3922                 if (params->supported_channels_len < 2)
3923                         return -EINVAL;
3924                 if (params->supported_channels_len % 2)
3925                         return -EINVAL;
3926         }
3927
3928         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
3929                 params->supported_oper_classes =
3930                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
3931                 params->supported_oper_classes_len =
3932                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
3933                 /*
3934                  * The value of the Length field of the Supported Operating
3935                  * Classes element is between 2 and 253.
3936                  */
3937                 if (params->supported_oper_classes_len < 2 ||
3938                     params->supported_oper_classes_len > 253)
3939                         return -EINVAL;
3940         }
3941         return 0;
3942 }
3943
3944 static int nl80211_set_station_tdls(struct genl_info *info,
3945                                     struct station_parameters *params)
3946 {
3947         int err;
3948         /* Dummy STA entry gets updated once the peer capabilities are known */
3949         if (info->attrs[NL80211_ATTR_PEER_AID])
3950                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
3951         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3952                 params->ht_capa =
3953                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3954         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3955                 params->vht_capa =
3956                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3957
3958         err = nl80211_parse_sta_channel_info(info, params);
3959         if (err)
3960                 return err;
3961
3962         return nl80211_parse_sta_wme(info, params);
3963 }
3964
3965 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3966 {
3967         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3968         struct net_device *dev = info->user_ptr[1];
3969         struct station_parameters params;
3970         u8 *mac_addr;
3971         int err;
3972
3973         memset(&params, 0, sizeof(params));
3974
3975         params.listen_interval = -1;
3976
3977         if (!rdev->ops->change_station)
3978                 return -EOPNOTSUPP;
3979
3980         if (info->attrs[NL80211_ATTR_STA_AID])
3981                 return -EINVAL;
3982
3983         if (!info->attrs[NL80211_ATTR_MAC])
3984                 return -EINVAL;
3985
3986         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3987
3988         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3989                 params.supported_rates =
3990                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3991                 params.supported_rates_len =
3992                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3993         }
3994
3995         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3996                 params.capability =
3997                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3998                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3999         }
4000
4001         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4002                 params.ext_capab =
4003                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4004                 params.ext_capab_len =
4005                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4006         }
4007
4008         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4009                 return -EINVAL;
4010
4011         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4012                 return -EINVAL;
4013
4014         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4015                 params.plink_action =
4016                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4017                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4018                         return -EINVAL;
4019         }
4020
4021         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4022                 params.plink_state =
4023                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4024                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4025                         return -EINVAL;
4026                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4027         }
4028
4029         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4030                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4031                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4032
4033                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4034                     pm > NL80211_MESH_POWER_MAX)
4035                         return -EINVAL;
4036
4037                 params.local_pm = pm;
4038         }
4039
4040         /* Include parameters for TDLS peer (will check later) */
4041         err = nl80211_set_station_tdls(info, &params);
4042         if (err)
4043                 return err;
4044
4045         params.vlan = get_vlan(info, rdev);
4046         if (IS_ERR(params.vlan))
4047                 return PTR_ERR(params.vlan);
4048
4049         switch (dev->ieee80211_ptr->iftype) {
4050         case NL80211_IFTYPE_AP:
4051         case NL80211_IFTYPE_AP_VLAN:
4052         case NL80211_IFTYPE_P2P_GO:
4053         case NL80211_IFTYPE_P2P_CLIENT:
4054         case NL80211_IFTYPE_STATION:
4055         case NL80211_IFTYPE_ADHOC:
4056         case NL80211_IFTYPE_MESH_POINT:
4057                 break;
4058         default:
4059                 err = -EOPNOTSUPP;
4060                 goto out_put_vlan;
4061         }
4062
4063         /* driver will call cfg80211_check_station_change() */
4064         err = rdev_change_station(rdev, dev, mac_addr, &params);
4065
4066  out_put_vlan:
4067         if (params.vlan)
4068                 dev_put(params.vlan);
4069
4070         return err;
4071 }
4072
4073 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4074 {
4075         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4076         int err;
4077         struct net_device *dev = info->user_ptr[1];
4078         struct station_parameters params;
4079         u8 *mac_addr = NULL;
4080
4081         memset(&params, 0, sizeof(params));
4082
4083         if (!rdev->ops->add_station)
4084                 return -EOPNOTSUPP;
4085
4086         if (!info->attrs[NL80211_ATTR_MAC])
4087                 return -EINVAL;
4088
4089         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4090                 return -EINVAL;
4091
4092         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4093                 return -EINVAL;
4094
4095         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4096             !info->attrs[NL80211_ATTR_PEER_AID])
4097                 return -EINVAL;
4098
4099         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4100         params.supported_rates =
4101                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4102         params.supported_rates_len =
4103                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4104         params.listen_interval =
4105                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4106
4107         if (info->attrs[NL80211_ATTR_PEER_AID])
4108                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4109         else
4110                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4111         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4112                 return -EINVAL;
4113
4114         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4115                 params.capability =
4116                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4117                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4118         }
4119
4120         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4121                 params.ext_capab =
4122                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4123                 params.ext_capab_len =
4124                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4125         }
4126
4127         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4128                 params.ht_capa =
4129                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4130
4131         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4132                 params.vht_capa =
4133                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4134
4135         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4136                 params.plink_action =
4137                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4138                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4139                         return -EINVAL;
4140         }
4141
4142         err = nl80211_parse_sta_channel_info(info, &params);
4143         if (err)
4144                 return err;
4145
4146         err = nl80211_parse_sta_wme(info, &params);
4147         if (err)
4148                 return err;
4149
4150         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4151                 return -EINVAL;
4152
4153         /* When you run into this, adjust the code below for the new flag */
4154         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4155
4156         switch (dev->ieee80211_ptr->iftype) {
4157         case NL80211_IFTYPE_AP:
4158         case NL80211_IFTYPE_AP_VLAN:
4159         case NL80211_IFTYPE_P2P_GO:
4160                 /* ignore WME attributes if iface/sta is not capable */
4161                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4162                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4163                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4164
4165                 /* TDLS peers cannot be added */
4166                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4167                     info->attrs[NL80211_ATTR_PEER_AID])
4168                         return -EINVAL;
4169                 /* but don't bother the driver with it */
4170                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4171
4172                 /* allow authenticated/associated only if driver handles it */
4173                 if (!(rdev->wiphy.features &
4174                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4175                     params.sta_flags_mask &
4176                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4177                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4178                         return -EINVAL;
4179
4180                 /* must be last in here for error handling */
4181                 params.vlan = get_vlan(info, rdev);
4182                 if (IS_ERR(params.vlan))
4183                         return PTR_ERR(params.vlan);
4184                 break;
4185         case NL80211_IFTYPE_MESH_POINT:
4186                 /* ignore uAPSD data */
4187                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4188
4189                 /* associated is disallowed */
4190                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4191                         return -EINVAL;
4192                 /* TDLS peers cannot be added */
4193                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4194                     info->attrs[NL80211_ATTR_PEER_AID])
4195                         return -EINVAL;
4196                 break;
4197         case NL80211_IFTYPE_STATION:
4198         case NL80211_IFTYPE_P2P_CLIENT:
4199                 /* ignore uAPSD data */
4200                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4201
4202                 /* these are disallowed */
4203                 if (params.sta_flags_mask &
4204                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4205                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4206                         return -EINVAL;
4207                 /* Only TDLS peers can be added */
4208                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4209                         return -EINVAL;
4210                 /* Can only add if TDLS ... */
4211                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4212                         return -EOPNOTSUPP;
4213                 /* ... with external setup is supported */
4214                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4215                         return -EOPNOTSUPP;
4216                 /*
4217                  * Older wpa_supplicant versions always mark the TDLS peer
4218                  * as authorized, but it shouldn't yet be.
4219                  */
4220                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4221                 break;
4222         default:
4223                 return -EOPNOTSUPP;
4224         }
4225
4226         /* be aware of params.vlan when changing code here */
4227
4228         err = rdev_add_station(rdev, dev, mac_addr, &params);
4229
4230         if (params.vlan)
4231                 dev_put(params.vlan);
4232         return err;
4233 }
4234
4235 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4236 {
4237         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4238         struct net_device *dev = info->user_ptr[1];
4239         u8 *mac_addr = NULL;
4240
4241         if (info->attrs[NL80211_ATTR_MAC])
4242                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4243
4244         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4245             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4246             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4247             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4248                 return -EINVAL;
4249
4250         if (!rdev->ops->del_station)
4251                 return -EOPNOTSUPP;
4252
4253         return rdev_del_station(rdev, dev, mac_addr);
4254 }
4255
4256 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4257                                 int flags, struct net_device *dev,
4258                                 u8 *dst, u8 *next_hop,
4259                                 struct mpath_info *pinfo)
4260 {
4261         void *hdr;
4262         struct nlattr *pinfoattr;
4263
4264         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4265         if (!hdr)
4266                 return -1;
4267
4268         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4269             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4270             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4271             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4272                 goto nla_put_failure;
4273
4274         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4275         if (!pinfoattr)
4276                 goto nla_put_failure;
4277         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4278             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4279                         pinfo->frame_qlen))
4280                 goto nla_put_failure;
4281         if (((pinfo->filled & MPATH_INFO_SN) &&
4282              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4283             ((pinfo->filled & MPATH_INFO_METRIC) &&
4284              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4285                          pinfo->metric)) ||
4286             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4287              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4288                          pinfo->exptime)) ||
4289             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4290              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4291                         pinfo->flags)) ||
4292             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4293              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4294                          pinfo->discovery_timeout)) ||
4295             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4296              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4297                         pinfo->discovery_retries)))
4298                 goto nla_put_failure;
4299
4300         nla_nest_end(msg, pinfoattr);
4301
4302         return genlmsg_end(msg, hdr);
4303
4304  nla_put_failure:
4305         genlmsg_cancel(msg, hdr);
4306         return -EMSGSIZE;
4307 }
4308
4309 static int nl80211_dump_mpath(struct sk_buff *skb,
4310                               struct netlink_callback *cb)
4311 {
4312         struct mpath_info pinfo;
4313         struct cfg80211_registered_device *dev;
4314         struct wireless_dev *wdev;
4315         u8 dst[ETH_ALEN];
4316         u8 next_hop[ETH_ALEN];
4317         int path_idx = cb->args[2];
4318         int err;
4319
4320         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4321         if (err)
4322                 return err;
4323
4324         if (!dev->ops->dump_mpath) {
4325                 err = -EOPNOTSUPP;
4326                 goto out_err;
4327         }
4328
4329         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4330                 err = -EOPNOTSUPP;
4331                 goto out_err;
4332         }
4333
4334         while (1) {
4335                 err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
4336                                       next_hop, &pinfo);
4337                 if (err == -ENOENT)
4338                         break;
4339                 if (err)
4340                         goto out_err;
4341
4342                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4343                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4344                                        wdev->netdev, dst, next_hop,
4345                                        &pinfo) < 0)
4346                         goto out;
4347
4348                 path_idx++;
4349         }
4350
4351
4352  out:
4353         cb->args[2] = path_idx;
4354         err = skb->len;
4355  out_err:
4356         nl80211_finish_wdev_dump(dev);
4357         return err;
4358 }
4359
4360 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4361 {
4362         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4363         int err;
4364         struct net_device *dev = info->user_ptr[1];
4365         struct mpath_info pinfo;
4366         struct sk_buff *msg;
4367         u8 *dst = NULL;
4368         u8 next_hop[ETH_ALEN];
4369
4370         memset(&pinfo, 0, sizeof(pinfo));
4371
4372         if (!info->attrs[NL80211_ATTR_MAC])
4373                 return -EINVAL;
4374
4375         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4376
4377         if (!rdev->ops->get_mpath)
4378                 return -EOPNOTSUPP;
4379
4380         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4381                 return -EOPNOTSUPP;
4382
4383         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4384         if (err)
4385                 return err;
4386
4387         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4388         if (!msg)
4389                 return -ENOMEM;
4390
4391         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4392                                  dev, dst, next_hop, &pinfo) < 0) {
4393                 nlmsg_free(msg);
4394                 return -ENOBUFS;
4395         }
4396
4397         return genlmsg_reply(msg, info);
4398 }
4399
4400 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4401 {
4402         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4403         struct net_device *dev = info->user_ptr[1];
4404         u8 *dst = NULL;
4405         u8 *next_hop = NULL;
4406
4407         if (!info->attrs[NL80211_ATTR_MAC])
4408                 return -EINVAL;
4409
4410         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4411                 return -EINVAL;
4412
4413         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4414         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4415
4416         if (!rdev->ops->change_mpath)
4417                 return -EOPNOTSUPP;
4418
4419         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4420                 return -EOPNOTSUPP;
4421
4422         return rdev_change_mpath(rdev, dev, dst, next_hop);
4423 }
4424
4425 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4426 {
4427         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4428         struct net_device *dev = info->user_ptr[1];
4429         u8 *dst = NULL;
4430         u8 *next_hop = NULL;
4431
4432         if (!info->attrs[NL80211_ATTR_MAC])
4433                 return -EINVAL;
4434
4435         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4436                 return -EINVAL;
4437
4438         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4439         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4440
4441         if (!rdev->ops->add_mpath)
4442                 return -EOPNOTSUPP;
4443
4444         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4445                 return -EOPNOTSUPP;
4446
4447         return rdev_add_mpath(rdev, dev, dst, next_hop);
4448 }
4449
4450 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4451 {
4452         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4453         struct net_device *dev = info->user_ptr[1];
4454         u8 *dst = NULL;
4455
4456         if (info->attrs[NL80211_ATTR_MAC])
4457                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4458
4459         if (!rdev->ops->del_mpath)
4460                 return -EOPNOTSUPP;
4461
4462         return rdev_del_mpath(rdev, dev, dst);
4463 }
4464
4465 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4466 {
4467         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4468         struct net_device *dev = info->user_ptr[1];
4469         struct wireless_dev *wdev = dev->ieee80211_ptr;
4470         struct bss_parameters params;
4471         int err;
4472
4473         memset(&params, 0, sizeof(params));
4474         /* default to not changing parameters */
4475         params.use_cts_prot = -1;
4476         params.use_short_preamble = -1;
4477         params.use_short_slot_time = -1;
4478         params.ap_isolate = -1;
4479         params.ht_opmode = -1;
4480         params.p2p_ctwindow = -1;
4481         params.p2p_opp_ps = -1;
4482
4483         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4484                 params.use_cts_prot =
4485                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4486         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4487                 params.use_short_preamble =
4488                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4489         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4490                 params.use_short_slot_time =
4491                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4492         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4493                 params.basic_rates =
4494                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4495                 params.basic_rates_len =
4496                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4497         }
4498         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4499                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4500         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4501                 params.ht_opmode =
4502                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4503
4504         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4505                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4506                         return -EINVAL;
4507                 params.p2p_ctwindow =
4508                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4509                 if (params.p2p_ctwindow < 0)
4510                         return -EINVAL;
4511                 if (params.p2p_ctwindow != 0 &&
4512                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4513                         return -EINVAL;
4514         }
4515
4516         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4517                 u8 tmp;
4518
4519                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4520                         return -EINVAL;
4521                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4522                 if (tmp > 1)
4523                         return -EINVAL;
4524                 params.p2p_opp_ps = tmp;
4525                 if (params.p2p_opp_ps &&
4526                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4527                         return -EINVAL;
4528         }
4529
4530         if (!rdev->ops->change_bss)
4531                 return -EOPNOTSUPP;
4532
4533         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4534             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4535                 return -EOPNOTSUPP;
4536
4537         wdev_lock(wdev);
4538         err = rdev_change_bss(rdev, dev, &params);
4539         wdev_unlock(wdev);
4540
4541         return err;
4542 }
4543
4544 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4545         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4546         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4547         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4548         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4549         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4550         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4551 };
4552
4553 static int parse_reg_rule(struct nlattr *tb[],
4554         struct ieee80211_reg_rule *reg_rule)
4555 {
4556         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4557         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4558
4559         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4560                 return -EINVAL;
4561         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4562                 return -EINVAL;
4563         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4564                 return -EINVAL;
4565         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4566                 return -EINVAL;
4567         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4568                 return -EINVAL;
4569
4570         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4571
4572         freq_range->start_freq_khz =
4573                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4574         freq_range->end_freq_khz =
4575                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4576         freq_range->max_bandwidth_khz =
4577                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4578
4579         power_rule->max_eirp =
4580                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4581
4582         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4583                 power_rule->max_antenna_gain =
4584                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4585
4586         return 0;
4587 }
4588
4589 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4590 {
4591         int r;
4592         char *data = NULL;
4593         enum nl80211_user_reg_hint_type user_reg_hint_type;
4594
4595         /*
4596          * You should only get this when cfg80211 hasn't yet initialized
4597          * completely when built-in to the kernel right between the time
4598          * window between nl80211_init() and regulatory_init(), if that is
4599          * even possible.
4600          */
4601         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4602                 return -EINPROGRESS;
4603
4604         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4605                 return -EINVAL;
4606
4607         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4608
4609         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4610                 user_reg_hint_type =
4611                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4612         else
4613                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4614
4615         switch (user_reg_hint_type) {
4616         case NL80211_USER_REG_HINT_USER:
4617         case NL80211_USER_REG_HINT_CELL_BASE:
4618                 break;
4619         default:
4620                 return -EINVAL;
4621         }
4622
4623         r = regulatory_hint_user(data, user_reg_hint_type);
4624
4625         return r;
4626 }
4627
4628 static int nl80211_get_mesh_config(struct sk_buff *skb,
4629                                    struct genl_info *info)
4630 {
4631         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4632         struct net_device *dev = info->user_ptr[1];
4633         struct wireless_dev *wdev = dev->ieee80211_ptr;
4634         struct mesh_config cur_params;
4635         int err = 0;
4636         void *hdr;
4637         struct nlattr *pinfoattr;
4638         struct sk_buff *msg;
4639
4640         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4641                 return -EOPNOTSUPP;
4642
4643         if (!rdev->ops->get_mesh_config)
4644                 return -EOPNOTSUPP;
4645
4646         wdev_lock(wdev);
4647         /* If not connected, get default parameters */
4648         if (!wdev->mesh_id_len)
4649                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4650         else
4651                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4652         wdev_unlock(wdev);
4653
4654         if (err)
4655                 return err;
4656
4657         /* Draw up a netlink message to send back */
4658         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4659         if (!msg)
4660                 return -ENOMEM;
4661         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4662                              NL80211_CMD_GET_MESH_CONFIG);
4663         if (!hdr)
4664                 goto out;
4665         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4666         if (!pinfoattr)
4667                 goto nla_put_failure;
4668         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4669             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4670                         cur_params.dot11MeshRetryTimeout) ||
4671             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4672                         cur_params.dot11MeshConfirmTimeout) ||
4673             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4674                         cur_params.dot11MeshHoldingTimeout) ||
4675             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4676                         cur_params.dot11MeshMaxPeerLinks) ||
4677             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4678                        cur_params.dot11MeshMaxRetries) ||
4679             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4680                        cur_params.dot11MeshTTL) ||
4681             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4682                        cur_params.element_ttl) ||
4683             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4684                        cur_params.auto_open_plinks) ||
4685             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4686                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4687             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4688                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4689             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4690                         cur_params.path_refresh_time) ||
4691             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4692                         cur_params.min_discovery_timeout) ||
4693             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4694                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4695             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4696                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4697             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4698                         cur_params.dot11MeshHWMPperrMinInterval) ||
4699             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4700                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4701             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4702                        cur_params.dot11MeshHWMPRootMode) ||
4703             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4704                         cur_params.dot11MeshHWMPRannInterval) ||
4705             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4706                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4707             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4708                        cur_params.dot11MeshForwarding) ||
4709             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4710                         cur_params.rssi_threshold) ||
4711             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4712                         cur_params.ht_opmode) ||
4713             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4714                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4715             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4716                         cur_params.dot11MeshHWMProotInterval) ||
4717             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4718                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4719             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4720                         cur_params.power_mode) ||
4721             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4722                         cur_params.dot11MeshAwakeWindowDuration) ||
4723             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4724                         cur_params.plink_timeout))
4725                 goto nla_put_failure;
4726         nla_nest_end(msg, pinfoattr);
4727         genlmsg_end(msg, hdr);
4728         return genlmsg_reply(msg, info);
4729
4730  nla_put_failure:
4731         genlmsg_cancel(msg, hdr);
4732  out:
4733         nlmsg_free(msg);
4734         return -ENOBUFS;
4735 }
4736
4737 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4738         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4739         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4740         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4741         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4742         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4743         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4744         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4745         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4746         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4747         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4748         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4749         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4750         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4751         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4752         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4753         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4754         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4755         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4756         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4757         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4758         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4759         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4760         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4761         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4762         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4763         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4764         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4765         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4766 };
4767
4768 static const struct nla_policy
4769         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4770         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4771         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4772         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4773         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4774         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4775         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4776         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4777                                     .len = IEEE80211_MAX_DATA_LEN },
4778         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4779 };
4780
4781 static int nl80211_parse_mesh_config(struct genl_info *info,
4782                                      struct mesh_config *cfg,
4783                                      u32 *mask_out)
4784 {
4785         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4786         u32 mask = 0;
4787
4788 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4789 do {                                                                        \
4790         if (tb[attr]) {                                                     \
4791                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4792                         return -EINVAL;                                     \
4793                 cfg->param = fn(tb[attr]);                                  \
4794                 mask |= (1 << (attr - 1));                                  \
4795         }                                                                   \
4796 } while (0)
4797
4798
4799         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4800                 return -EINVAL;
4801         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4802                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4803                              nl80211_meshconf_params_policy))
4804                 return -EINVAL;
4805
4806         /* This makes sure that there aren't more than 32 mesh config
4807          * parameters (otherwise our bitfield scheme would not work.) */
4808         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4809
4810         /* Fill in the params struct */
4811         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4812                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4813                                   nla_get_u16);
4814         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4815                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4816                                   nla_get_u16);
4817         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4818                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4819                                   nla_get_u16);
4820         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4821                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4822                                   nla_get_u16);
4823         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4824                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4825                                   nla_get_u8);
4826         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4827                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4828         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4829                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4830                                   nla_get_u8);
4831         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4832                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4833                                   nla_get_u8);
4834         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4835                                   1, 255, mask,
4836                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4837                                   nla_get_u32);
4838         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4839                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4840                                   nla_get_u8);
4841         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4842                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4843                                   nla_get_u32);
4844         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4845                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4846                                   nla_get_u16);
4847         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4848                                   1, 65535, mask,
4849                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4850                                   nla_get_u32);
4851         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4852                                   1, 65535, mask,
4853                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4854                                   nla_get_u16);
4855         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4856                                   1, 65535, mask,
4857                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4858                                   nla_get_u16);
4859         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4860                                   dot11MeshHWMPnetDiameterTraversalTime,
4861                                   1, 65535, mask,
4862                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4863                                   nla_get_u16);
4864         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4865                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4866                                   nla_get_u8);
4867         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4868                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4869                                   nla_get_u16);
4870         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4871                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4872                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4873                                   nla_get_u8);
4874         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4875                                   mask, NL80211_MESHCONF_FORWARDING,
4876                                   nla_get_u8);
4877         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
4878                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4879                                   nla_get_s32);
4880         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4881                                   mask, NL80211_MESHCONF_HT_OPMODE,
4882                                   nla_get_u16);
4883         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4884                                   1, 65535, mask,
4885                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4886                                   nla_get_u32);
4887         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4888                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4889                                   nla_get_u16);
4890         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4891                                   dot11MeshHWMPconfirmationInterval,
4892                                   1, 65535, mask,
4893                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4894                                   nla_get_u16);
4895         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4896                                   NL80211_MESH_POWER_ACTIVE,
4897                                   NL80211_MESH_POWER_MAX,
4898                                   mask, NL80211_MESHCONF_POWER_MODE,
4899                                   nla_get_u32);
4900         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4901                                   0, 65535, mask,
4902                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4903         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
4904                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
4905                                   nla_get_u32);
4906         if (mask_out)
4907                 *mask_out = mask;
4908
4909         return 0;
4910
4911 #undef FILL_IN_MESH_PARAM_IF_SET
4912 }
4913
4914 static int nl80211_parse_mesh_setup(struct genl_info *info,
4915                                      struct mesh_setup *setup)
4916 {
4917         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4918         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4919
4920         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4921                 return -EINVAL;
4922         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4923                              info->attrs[NL80211_ATTR_MESH_SETUP],
4924                              nl80211_mesh_setup_params_policy))
4925                 return -EINVAL;
4926
4927         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4928                 setup->sync_method =
4929                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4930                  IEEE80211_SYNC_METHOD_VENDOR :
4931                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4932
4933         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4934                 setup->path_sel_proto =
4935                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4936                  IEEE80211_PATH_PROTOCOL_VENDOR :
4937                  IEEE80211_PATH_PROTOCOL_HWMP;
4938
4939         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4940                 setup->path_metric =
4941                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4942                  IEEE80211_PATH_METRIC_VENDOR :
4943                  IEEE80211_PATH_METRIC_AIRTIME;
4944
4945
4946         if (tb[NL80211_MESH_SETUP_IE]) {
4947                 struct nlattr *ieattr =
4948                         tb[NL80211_MESH_SETUP_IE];
4949                 if (!is_valid_ie_attr(ieattr))
4950                         return -EINVAL;
4951                 setup->ie = nla_data(ieattr);
4952                 setup->ie_len = nla_len(ieattr);
4953         }
4954         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
4955             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
4956                 return -EINVAL;
4957         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
4958         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4959         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4960         if (setup->is_secure)
4961                 setup->user_mpm = true;
4962
4963         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
4964                 if (!setup->user_mpm)
4965                         return -EINVAL;
4966                 setup->auth_id =
4967                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
4968         }
4969
4970         return 0;
4971 }
4972
4973 static int nl80211_update_mesh_config(struct sk_buff *skb,
4974                                       struct genl_info *info)
4975 {
4976         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4977         struct net_device *dev = info->user_ptr[1];
4978         struct wireless_dev *wdev = dev->ieee80211_ptr;
4979         struct mesh_config cfg;
4980         u32 mask;
4981         int err;
4982
4983         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4984                 return -EOPNOTSUPP;
4985
4986         if (!rdev->ops->update_mesh_config)
4987                 return -EOPNOTSUPP;
4988
4989         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4990         if (err)
4991                 return err;
4992
4993         wdev_lock(wdev);
4994         if (!wdev->mesh_id_len)
4995                 err = -ENOLINK;
4996
4997         if (!err)
4998                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4999
5000         wdev_unlock(wdev);
5001
5002         return err;
5003 }
5004
5005 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
5006 {
5007         const struct ieee80211_regdomain *regdom;
5008         struct sk_buff *msg;
5009         void *hdr = NULL;
5010         struct nlattr *nl_reg_rules;
5011         unsigned int i;
5012
5013         if (!cfg80211_regdomain)
5014                 return -EINVAL;
5015
5016         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5017         if (!msg)
5018                 return -ENOBUFS;
5019
5020         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5021                              NL80211_CMD_GET_REG);
5022         if (!hdr)
5023                 goto put_failure;
5024
5025         if (reg_last_request_cell_base() &&
5026             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5027                         NL80211_USER_REG_HINT_CELL_BASE))
5028                 goto nla_put_failure;
5029
5030         rcu_read_lock();
5031         regdom = rcu_dereference(cfg80211_regdomain);
5032
5033         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5034             (regdom->dfs_region &&
5035              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5036                 goto nla_put_failure_rcu;
5037
5038         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5039         if (!nl_reg_rules)
5040                 goto nla_put_failure_rcu;
5041
5042         for (i = 0; i < regdom->n_reg_rules; i++) {
5043                 struct nlattr *nl_reg_rule;
5044                 const struct ieee80211_reg_rule *reg_rule;
5045                 const struct ieee80211_freq_range *freq_range;
5046                 const struct ieee80211_power_rule *power_rule;
5047
5048                 reg_rule = &regdom->reg_rules[i];
5049                 freq_range = &reg_rule->freq_range;
5050                 power_rule = &reg_rule->power_rule;
5051
5052                 nl_reg_rule = nla_nest_start(msg, i);
5053                 if (!nl_reg_rule)
5054                         goto nla_put_failure_rcu;
5055
5056                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5057                                 reg_rule->flags) ||
5058                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5059                                 freq_range->start_freq_khz) ||
5060                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5061                                 freq_range->end_freq_khz) ||
5062                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5063                                 freq_range->max_bandwidth_khz) ||
5064                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5065                                 power_rule->max_antenna_gain) ||
5066                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5067                                 power_rule->max_eirp))
5068                         goto nla_put_failure_rcu;
5069
5070                 nla_nest_end(msg, nl_reg_rule);
5071         }
5072         rcu_read_unlock();
5073
5074         nla_nest_end(msg, nl_reg_rules);
5075
5076         genlmsg_end(msg, hdr);
5077         return genlmsg_reply(msg, info);
5078
5079 nla_put_failure_rcu:
5080         rcu_read_unlock();
5081 nla_put_failure:
5082         genlmsg_cancel(msg, hdr);
5083 put_failure:
5084         nlmsg_free(msg);
5085         return -EMSGSIZE;
5086 }
5087
5088 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5089 {
5090         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5091         struct nlattr *nl_reg_rule;
5092         char *alpha2 = NULL;
5093         int rem_reg_rules = 0, r = 0;
5094         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5095         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5096         struct ieee80211_regdomain *rd = NULL;
5097
5098         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5099                 return -EINVAL;
5100
5101         if (!info->attrs[NL80211_ATTR_REG_RULES])
5102                 return -EINVAL;
5103
5104         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5105
5106         if (info->attrs[NL80211_ATTR_DFS_REGION])
5107                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5108
5109         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5110                             rem_reg_rules) {
5111                 num_rules++;
5112                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5113                         return -EINVAL;
5114         }
5115
5116         if (!reg_is_valid_request(alpha2))
5117                 return -EINVAL;
5118
5119         size_of_regd = sizeof(struct ieee80211_regdomain) +
5120                        num_rules * sizeof(struct ieee80211_reg_rule);
5121
5122         rd = kzalloc(size_of_regd, GFP_KERNEL);
5123         if (!rd)
5124                 return -ENOMEM;
5125
5126         rd->n_reg_rules = num_rules;
5127         rd->alpha2[0] = alpha2[0];
5128         rd->alpha2[1] = alpha2[1];
5129
5130         /*
5131          * Disable DFS master mode if the DFS region was
5132          * not supported or known on this kernel.
5133          */
5134         if (reg_supported_dfs_region(dfs_region))
5135                 rd->dfs_region = dfs_region;
5136
5137         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5138                             rem_reg_rules) {
5139                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5140                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5141                           reg_rule_policy);
5142                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5143                 if (r)
5144                         goto bad_reg;
5145
5146                 rule_idx++;
5147
5148                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5149                         r = -EINVAL;
5150                         goto bad_reg;
5151                 }
5152         }
5153
5154         r = set_regdom(rd);
5155         /* set_regdom took ownership */
5156         rd = NULL;
5157
5158  bad_reg:
5159         kfree(rd);
5160         return r;
5161 }
5162
5163 static int validate_scan_freqs(struct nlattr *freqs)
5164 {
5165         struct nlattr *attr1, *attr2;
5166         int n_channels = 0, tmp1, tmp2;
5167
5168         nla_for_each_nested(attr1, freqs, tmp1) {
5169                 n_channels++;
5170                 /*
5171                  * Some hardware has a limited channel list for
5172                  * scanning, and it is pretty much nonsensical
5173                  * to scan for a channel twice, so disallow that
5174                  * and don't require drivers to check that the
5175                  * channel list they get isn't longer than what
5176                  * they can scan, as long as they can scan all
5177                  * the channels they registered at once.
5178                  */
5179                 nla_for_each_nested(attr2, freqs, tmp2)
5180                         if (attr1 != attr2 &&
5181                             nla_get_u32(attr1) == nla_get_u32(attr2))
5182                                 return 0;
5183         }
5184
5185         return n_channels;
5186 }
5187
5188 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5189 {
5190         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5191         struct wireless_dev *wdev = info->user_ptr[1];
5192         struct cfg80211_scan_request *request;
5193         struct nlattr *attr;
5194         struct wiphy *wiphy;
5195         int err, tmp, n_ssids = 0, n_channels, i;
5196         size_t ie_len;
5197
5198         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5199                 return -EINVAL;
5200
5201         wiphy = &rdev->wiphy;
5202
5203         if (!rdev->ops->scan)
5204                 return -EOPNOTSUPP;
5205
5206         if (rdev->scan_req) {
5207                 err = -EBUSY;
5208                 goto unlock;
5209         }
5210
5211         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5212                 n_channels = validate_scan_freqs(
5213                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5214                 if (!n_channels) {
5215                         err = -EINVAL;
5216                         goto unlock;
5217                 }
5218         } else {
5219                 enum ieee80211_band band;
5220                 n_channels = 0;
5221
5222                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5223                         if (wiphy->bands[band])
5224                                 n_channels += wiphy->bands[band]->n_channels;
5225         }
5226
5227         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5228                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5229                         n_ssids++;
5230
5231         if (n_ssids > wiphy->max_scan_ssids) {
5232                 err = -EINVAL;
5233                 goto unlock;
5234         }
5235
5236         if (info->attrs[NL80211_ATTR_IE])
5237                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5238         else
5239                 ie_len = 0;
5240
5241         if (ie_len > wiphy->max_scan_ie_len) {
5242                 err = -EINVAL;
5243                 goto unlock;
5244         }
5245
5246         request = kzalloc(sizeof(*request)
5247                         + sizeof(*request->ssids) * n_ssids
5248                         + sizeof(*request->channels) * n_channels
5249                         + ie_len, GFP_KERNEL);
5250         if (!request) {
5251                 err = -ENOMEM;
5252                 goto unlock;
5253         }
5254
5255         if (n_ssids)
5256                 request->ssids = (void *)&request->channels[n_channels];
5257         request->n_ssids = n_ssids;
5258         if (ie_len) {
5259                 if (request->ssids)
5260                         request->ie = (void *)(request->ssids + n_ssids);
5261                 else
5262                         request->ie = (void *)(request->channels + n_channels);
5263         }
5264
5265         i = 0;
5266         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5267                 /* user specified, bail out if channel not found */
5268                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5269                         struct ieee80211_channel *chan;
5270
5271                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5272
5273                         if (!chan) {
5274                                 err = -EINVAL;
5275                                 goto out_free;
5276                         }
5277
5278                         /* ignore disabled channels */
5279                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5280                                 continue;
5281
5282                         request->channels[i] = chan;
5283                         i++;
5284                 }
5285         } else {
5286                 enum ieee80211_band band;
5287
5288                 /* all channels */
5289                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5290                         int j;
5291                         if (!wiphy->bands[band])
5292                                 continue;
5293                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5294                                 struct ieee80211_channel *chan;
5295
5296                                 chan = &wiphy->bands[band]->channels[j];
5297
5298                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5299                                         continue;
5300
5301                                 request->channels[i] = chan;
5302                                 i++;
5303                         }
5304                 }
5305         }
5306
5307         if (!i) {
5308                 err = -EINVAL;
5309                 goto out_free;
5310         }
5311
5312         request->n_channels = i;
5313
5314         i = 0;
5315         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5316                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5317                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5318                                 err = -EINVAL;
5319                                 goto out_free;
5320                         }
5321                         request->ssids[i].ssid_len = nla_len(attr);
5322                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5323                         i++;
5324                 }
5325         }
5326
5327         if (info->attrs[NL80211_ATTR_IE]) {
5328                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5329                 memcpy((void *)request->ie,
5330                        nla_data(info->attrs[NL80211_ATTR_IE]),
5331                        request->ie_len);
5332         }
5333
5334         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5335                 if (wiphy->bands[i])
5336                         request->rates[i] =
5337                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5338
5339         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5340                 nla_for_each_nested(attr,
5341                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5342                                     tmp) {
5343                         enum ieee80211_band band = nla_type(attr);
5344
5345                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5346                                 err = -EINVAL;
5347                                 goto out_free;
5348                         }
5349                         err = ieee80211_get_ratemask(wiphy->bands[band],
5350                                                      nla_data(attr),
5351                                                      nla_len(attr),
5352                                                      &request->rates[band]);
5353                         if (err)
5354                                 goto out_free;
5355                 }
5356         }
5357
5358         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5359                 request->flags = nla_get_u32(
5360                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5361                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5362                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5363                         err = -EOPNOTSUPP;
5364                         goto out_free;
5365                 }
5366         }
5367
5368         request->no_cck =
5369                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5370
5371         request->wdev = wdev;
5372         request->wiphy = &rdev->wiphy;
5373         request->scan_start = jiffies;
5374
5375         rdev->scan_req = request;
5376         err = rdev_scan(rdev, request);
5377
5378         if (!err) {
5379                 nl80211_send_scan_start(rdev, wdev);
5380                 if (wdev->netdev)
5381                         dev_hold(wdev->netdev);
5382         } else {
5383  out_free:
5384                 rdev->scan_req = NULL;
5385                 kfree(request);
5386         }
5387
5388  unlock:
5389         return err;
5390 }
5391
5392 static int nl80211_start_sched_scan(struct sk_buff *skb,
5393                                     struct genl_info *info)
5394 {
5395         struct cfg80211_sched_scan_request *request;
5396         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5397         struct net_device *dev = info->user_ptr[1];
5398         struct nlattr *attr;
5399         struct wiphy *wiphy;
5400         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5401         u32 interval;
5402         enum ieee80211_band band;
5403         size_t ie_len;
5404         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5405
5406         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5407             !rdev->ops->sched_scan_start)
5408                 return -EOPNOTSUPP;
5409
5410         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5411                 return -EINVAL;
5412
5413         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5414                 return -EINVAL;
5415
5416         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5417         if (interval == 0)
5418                 return -EINVAL;
5419
5420         wiphy = &rdev->wiphy;
5421
5422         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5423                 n_channels = validate_scan_freqs(
5424                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5425                 if (!n_channels)
5426                         return -EINVAL;
5427         } else {
5428                 n_channels = 0;
5429
5430                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5431                         if (wiphy->bands[band])
5432                                 n_channels += wiphy->bands[band]->n_channels;
5433         }
5434
5435         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5436                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5437                                     tmp)
5438                         n_ssids++;
5439
5440         if (n_ssids > wiphy->max_sched_scan_ssids)
5441                 return -EINVAL;
5442
5443         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5444                 nla_for_each_nested(attr,
5445                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5446                                     tmp)
5447                         n_match_sets++;
5448
5449         if (n_match_sets > wiphy->max_match_sets)
5450                 return -EINVAL;
5451
5452         if (info->attrs[NL80211_ATTR_IE])
5453                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5454         else
5455                 ie_len = 0;
5456
5457         if (ie_len > wiphy->max_sched_scan_ie_len)
5458                 return -EINVAL;
5459
5460         if (rdev->sched_scan_req) {
5461                 err = -EINPROGRESS;
5462                 goto out;
5463         }
5464
5465         request = kzalloc(sizeof(*request)
5466                         + sizeof(*request->ssids) * n_ssids
5467                         + sizeof(*request->match_sets) * n_match_sets
5468                         + sizeof(*request->channels) * n_channels
5469                         + ie_len, GFP_KERNEL);
5470         if (!request) {
5471                 err = -ENOMEM;
5472                 goto out;
5473         }
5474
5475         if (n_ssids)
5476                 request->ssids = (void *)&request->channels[n_channels];
5477         request->n_ssids = n_ssids;
5478         if (ie_len) {
5479                 if (request->ssids)
5480                         request->ie = (void *)(request->ssids + n_ssids);
5481                 else
5482                         request->ie = (void *)(request->channels + n_channels);
5483         }
5484
5485         if (n_match_sets) {
5486                 if (request->ie)
5487                         request->match_sets = (void *)(request->ie + ie_len);
5488                 else if (request->ssids)
5489                         request->match_sets =
5490                                 (void *)(request->ssids + n_ssids);
5491                 else
5492                         request->match_sets =
5493                                 (void *)(request->channels + n_channels);
5494         }
5495         request->n_match_sets = n_match_sets;
5496
5497         i = 0;
5498         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5499                 /* user specified, bail out if channel not found */
5500                 nla_for_each_nested(attr,
5501                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5502                                     tmp) {
5503                         struct ieee80211_channel *chan;
5504
5505                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5506
5507                         if (!chan) {
5508                                 err = -EINVAL;
5509                                 goto out_free;
5510                         }
5511
5512                         /* ignore disabled channels */
5513                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5514                                 continue;
5515
5516                         request->channels[i] = chan;
5517                         i++;
5518                 }
5519         } else {
5520                 /* all channels */
5521                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5522                         int j;
5523                         if (!wiphy->bands[band])
5524                                 continue;
5525                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5526                                 struct ieee80211_channel *chan;
5527
5528                                 chan = &wiphy->bands[band]->channels[j];
5529
5530                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5531                                         continue;
5532
5533                                 request->channels[i] = chan;
5534                                 i++;
5535                         }
5536                 }
5537         }
5538
5539         if (!i) {
5540                 err = -EINVAL;
5541                 goto out_free;
5542         }
5543
5544         request->n_channels = i;
5545
5546         i = 0;
5547         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5548                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5549                                     tmp) {
5550                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5551                                 err = -EINVAL;
5552                                 goto out_free;
5553                         }
5554                         request->ssids[i].ssid_len = nla_len(attr);
5555                         memcpy(request->ssids[i].ssid, nla_data(attr),
5556                                nla_len(attr));
5557                         i++;
5558                 }
5559         }
5560
5561         i = 0;
5562         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5563                 nla_for_each_nested(attr,
5564                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5565                                     tmp) {
5566                         struct nlattr *ssid, *rssi;
5567
5568                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5569                                   nla_data(attr), nla_len(attr),
5570                                   nl80211_match_policy);
5571                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5572                         if (ssid) {
5573                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5574                                         err = -EINVAL;
5575                                         goto out_free;
5576                                 }
5577                                 memcpy(request->match_sets[i].ssid.ssid,
5578                                        nla_data(ssid), nla_len(ssid));
5579                                 request->match_sets[i].ssid.ssid_len =
5580                                         nla_len(ssid);
5581                         }
5582                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5583                         if (rssi)
5584                                 request->rssi_thold = nla_get_u32(rssi);
5585                         else
5586                                 request->rssi_thold =
5587                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5588                         i++;
5589                 }
5590         }
5591
5592         if (info->attrs[NL80211_ATTR_IE]) {
5593                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5594                 memcpy((void *)request->ie,
5595                        nla_data(info->attrs[NL80211_ATTR_IE]),
5596                        request->ie_len);
5597         }
5598
5599         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5600                 request->flags = nla_get_u32(
5601                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5602                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5603                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5604                         err = -EOPNOTSUPP;
5605                         goto out_free;
5606                 }
5607         }
5608
5609         request->dev = dev;
5610         request->wiphy = &rdev->wiphy;
5611         request->interval = interval;
5612         request->scan_start = jiffies;
5613
5614         err = rdev_sched_scan_start(rdev, dev, request);
5615         if (!err) {
5616                 rdev->sched_scan_req = request;
5617                 nl80211_send_sched_scan(rdev, dev,
5618                                         NL80211_CMD_START_SCHED_SCAN);
5619                 goto out;
5620         }
5621
5622 out_free:
5623         kfree(request);
5624 out:
5625         return err;
5626 }
5627
5628 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5629                                    struct genl_info *info)
5630 {
5631         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5632
5633         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5634             !rdev->ops->sched_scan_stop)
5635                 return -EOPNOTSUPP;
5636
5637         return __cfg80211_stop_sched_scan(rdev, false);
5638 }
5639
5640 static int nl80211_start_radar_detection(struct sk_buff *skb,
5641                                          struct genl_info *info)
5642 {
5643         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5644         struct net_device *dev = info->user_ptr[1];
5645         struct wireless_dev *wdev = dev->ieee80211_ptr;
5646         struct cfg80211_chan_def chandef;
5647         int err;
5648
5649         err = nl80211_parse_chandef(rdev, info, &chandef);
5650         if (err)
5651                 return err;
5652
5653         if (netif_carrier_ok(dev))
5654                 return -EBUSY;
5655
5656         if (wdev->cac_started)
5657                 return -EBUSY;
5658
5659         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5660         if (err < 0)
5661                 return err;
5662
5663         if (err == 0)
5664                 return -EINVAL;
5665
5666         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
5667                 return -EINVAL;
5668
5669         if (!rdev->ops->start_radar_detection)
5670                 return -EOPNOTSUPP;
5671
5672         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5673                                            chandef.chan, CHAN_MODE_SHARED,
5674                                            BIT(chandef.width));
5675         if (err)
5676                 return err;
5677
5678         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5679         if (!err) {
5680                 wdev->channel = chandef.chan;
5681                 wdev->cac_started = true;
5682                 wdev->cac_start_time = jiffies;
5683         }
5684         return err;
5685 }
5686
5687 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
5688 {
5689         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5690         struct net_device *dev = info->user_ptr[1];
5691         struct wireless_dev *wdev = dev->ieee80211_ptr;
5692         struct cfg80211_csa_settings params;
5693         /* csa_attrs is defined static to avoid waste of stack size - this
5694          * function is called under RTNL lock, so this should not be a problem.
5695          */
5696         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
5697         u8 radar_detect_width = 0;
5698         int err;
5699         bool need_new_beacon = false;
5700
5701         if (!rdev->ops->channel_switch ||
5702             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
5703                 return -EOPNOTSUPP;
5704
5705         switch (dev->ieee80211_ptr->iftype) {
5706         case NL80211_IFTYPE_AP:
5707         case NL80211_IFTYPE_P2P_GO:
5708                 need_new_beacon = true;
5709
5710                 /* useless if AP is not running */
5711                 if (!wdev->beacon_interval)
5712                         return -EINVAL;
5713                 break;
5714         case NL80211_IFTYPE_ADHOC:
5715         case NL80211_IFTYPE_MESH_POINT:
5716                 break;
5717         default:
5718                 return -EOPNOTSUPP;
5719         }
5720
5721         memset(&params, 0, sizeof(params));
5722
5723         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5724             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
5725                 return -EINVAL;
5726
5727         /* only important for AP, IBSS and mesh create IEs internally */
5728         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
5729                 return -EINVAL;
5730
5731         params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
5732
5733         if (!need_new_beacon)
5734                 goto skip_beacons;
5735
5736         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
5737         if (err)
5738                 return err;
5739
5740         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
5741                                info->attrs[NL80211_ATTR_CSA_IES],
5742                                nl80211_policy);
5743         if (err)
5744                 return err;
5745
5746         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
5747         if (err)
5748                 return err;
5749
5750         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
5751                 return -EINVAL;
5752
5753         params.counter_offset_beacon =
5754                 nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
5755         if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
5756                 return -EINVAL;
5757
5758         /* sanity check - counters should be the same */
5759         if (params.beacon_csa.tail[params.counter_offset_beacon] !=
5760             params.count)
5761                 return -EINVAL;
5762
5763         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
5764                 params.counter_offset_presp =
5765                         nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
5766                 if (params.counter_offset_presp >=
5767                     params.beacon_csa.probe_resp_len)
5768                         return -EINVAL;
5769
5770                 if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
5771                     params.count)
5772                         return -EINVAL;
5773         }
5774
5775 skip_beacons:
5776         err = nl80211_parse_chandef(rdev, info, &params.chandef);
5777         if (err)
5778                 return err;
5779
5780         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
5781                 return -EINVAL;
5782
5783         if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
5784             dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO ||
5785             dev->ieee80211_ptr->iftype == NL80211_IFTYPE_ADHOC) {
5786                 err = cfg80211_chandef_dfs_required(wdev->wiphy,
5787                                                     &params.chandef);
5788                 if (err < 0) {
5789                         return err;
5790                 } else if (err) {
5791                         radar_detect_width = BIT(params.chandef.width);
5792                         params.radar_required = true;
5793                 }
5794         }
5795
5796         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5797                                            params.chandef.chan,
5798                                            CHAN_MODE_SHARED,
5799                                            radar_detect_width);
5800         if (err)
5801                 return err;
5802
5803         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
5804                 params.block_tx = true;
5805
5806         wdev_lock(wdev);
5807         err = rdev_channel_switch(rdev, dev, &params);
5808         wdev_unlock(wdev);
5809
5810         return err;
5811 }
5812
5813 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5814                             u32 seq, int flags,
5815                             struct cfg80211_registered_device *rdev,
5816                             struct wireless_dev *wdev,
5817                             struct cfg80211_internal_bss *intbss)
5818 {
5819         struct cfg80211_bss *res = &intbss->pub;
5820         const struct cfg80211_bss_ies *ies;
5821         void *hdr;
5822         struct nlattr *bss;
5823         bool tsf = false;
5824
5825         ASSERT_WDEV_LOCK(wdev);
5826
5827         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5828                              NL80211_CMD_NEW_SCAN_RESULTS);
5829         if (!hdr)
5830                 return -1;
5831
5832         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5833
5834         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
5835                 goto nla_put_failure;
5836         if (wdev->netdev &&
5837             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5838                 goto nla_put_failure;
5839         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
5840                 goto nla_put_failure;
5841
5842         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5843         if (!bss)
5844                 goto nla_put_failure;
5845         if ((!is_zero_ether_addr(res->bssid) &&
5846              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5847                 goto nla_put_failure;
5848
5849         rcu_read_lock();
5850         ies = rcu_dereference(res->ies);
5851         if (ies) {
5852                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5853                         goto fail_unlock_rcu;
5854                 tsf = true;
5855                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5856                                         ies->len, ies->data))
5857                         goto fail_unlock_rcu;
5858         }
5859         ies = rcu_dereference(res->beacon_ies);
5860         if (ies) {
5861                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5862                         goto fail_unlock_rcu;
5863                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5864                                         ies->len, ies->data))
5865                         goto fail_unlock_rcu;
5866         }
5867         rcu_read_unlock();
5868
5869         if (res->beacon_interval &&
5870             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5871                 goto nla_put_failure;
5872         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5873             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5874             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
5875             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5876                         jiffies_to_msecs(jiffies - intbss->ts)))
5877                 goto nla_put_failure;
5878
5879         switch (rdev->wiphy.signal_type) {
5880         case CFG80211_SIGNAL_TYPE_MBM:
5881                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5882                         goto nla_put_failure;
5883                 break;
5884         case CFG80211_SIGNAL_TYPE_UNSPEC:
5885                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5886                         goto nla_put_failure;
5887                 break;
5888         default:
5889                 break;
5890         }
5891
5892         switch (wdev->iftype) {
5893         case NL80211_IFTYPE_P2P_CLIENT:
5894         case NL80211_IFTYPE_STATION:
5895                 if (intbss == wdev->current_bss &&
5896                     nla_put_u32(msg, NL80211_BSS_STATUS,
5897                                 NL80211_BSS_STATUS_ASSOCIATED))
5898                         goto nla_put_failure;
5899                 break;
5900         case NL80211_IFTYPE_ADHOC:
5901                 if (intbss == wdev->current_bss &&
5902                     nla_put_u32(msg, NL80211_BSS_STATUS,
5903                                 NL80211_BSS_STATUS_IBSS_JOINED))
5904                         goto nla_put_failure;
5905                 break;
5906         default:
5907                 break;
5908         }
5909
5910         nla_nest_end(msg, bss);
5911
5912         return genlmsg_end(msg, hdr);
5913
5914  fail_unlock_rcu:
5915         rcu_read_unlock();
5916  nla_put_failure:
5917         genlmsg_cancel(msg, hdr);
5918         return -EMSGSIZE;
5919 }
5920
5921 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
5922 {
5923         struct cfg80211_registered_device *rdev;
5924         struct cfg80211_internal_bss *scan;
5925         struct wireless_dev *wdev;
5926         int start = cb->args[2], idx = 0;
5927         int err;
5928
5929         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5930         if (err)
5931                 return err;
5932
5933         wdev_lock(wdev);
5934         spin_lock_bh(&rdev->bss_lock);
5935         cfg80211_bss_expire(rdev);
5936
5937         cb->seq = rdev->bss_generation;
5938
5939         list_for_each_entry(scan, &rdev->bss_list, list) {
5940                 if (++idx <= start)
5941                         continue;
5942                 if (nl80211_send_bss(skb, cb,
5943                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5944                                 rdev, wdev, scan) < 0) {
5945                         idx--;
5946                         break;
5947                 }
5948         }
5949
5950         spin_unlock_bh(&rdev->bss_lock);
5951         wdev_unlock(wdev);
5952
5953         cb->args[2] = idx;
5954         nl80211_finish_wdev_dump(rdev);
5955
5956         return skb->len;
5957 }
5958
5959 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5960                                 int flags, struct net_device *dev,
5961                                 struct survey_info *survey)
5962 {
5963         void *hdr;
5964         struct nlattr *infoattr;
5965
5966         hdr = nl80211hdr_put(msg, portid, seq, flags,
5967                              NL80211_CMD_NEW_SURVEY_RESULTS);
5968         if (!hdr)
5969                 return -ENOMEM;
5970
5971         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5972                 goto nla_put_failure;
5973
5974         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5975         if (!infoattr)
5976                 goto nla_put_failure;
5977
5978         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5979                         survey->channel->center_freq))
5980                 goto nla_put_failure;
5981
5982         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5983             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5984                 goto nla_put_failure;
5985         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5986             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5987                 goto nla_put_failure;
5988         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5989             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5990                         survey->channel_time))
5991                 goto nla_put_failure;
5992         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5993             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5994                         survey->channel_time_busy))
5995                 goto nla_put_failure;
5996         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5997             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5998                         survey->channel_time_ext_busy))
5999                 goto nla_put_failure;
6000         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
6001             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
6002                         survey->channel_time_rx))
6003                 goto nla_put_failure;
6004         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
6005             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
6006                         survey->channel_time_tx))
6007                 goto nla_put_failure;
6008
6009         nla_nest_end(msg, infoattr);
6010
6011         return genlmsg_end(msg, hdr);
6012
6013  nla_put_failure:
6014         genlmsg_cancel(msg, hdr);
6015         return -EMSGSIZE;
6016 }
6017
6018 static int nl80211_dump_survey(struct sk_buff *skb,
6019                         struct netlink_callback *cb)
6020 {
6021         struct survey_info survey;
6022         struct cfg80211_registered_device *dev;
6023         struct wireless_dev *wdev;
6024         int survey_idx = cb->args[2];
6025         int res;
6026
6027         res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
6028         if (res)
6029                 return res;
6030
6031         if (!wdev->netdev) {
6032                 res = -EINVAL;
6033                 goto out_err;
6034         }
6035
6036         if (!dev->ops->dump_survey) {
6037                 res = -EOPNOTSUPP;
6038                 goto out_err;
6039         }
6040
6041         while (1) {
6042                 struct ieee80211_channel *chan;
6043
6044                 res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
6045                 if (res == -ENOENT)
6046                         break;
6047                 if (res)
6048                         goto out_err;
6049
6050                 /* Survey without a channel doesn't make sense */
6051                 if (!survey.channel) {
6052                         res = -EINVAL;
6053                         goto out;
6054                 }
6055
6056                 chan = ieee80211_get_channel(&dev->wiphy,
6057                                              survey.channel->center_freq);
6058                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
6059                         survey_idx++;
6060                         continue;
6061                 }
6062
6063                 if (nl80211_send_survey(skb,
6064                                 NETLINK_CB(cb->skb).portid,
6065                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6066                                 wdev->netdev, &survey) < 0)
6067                         goto out;
6068                 survey_idx++;
6069         }
6070
6071  out:
6072         cb->args[2] = survey_idx;
6073         res = skb->len;
6074  out_err:
6075         nl80211_finish_wdev_dump(dev);
6076         return res;
6077 }
6078
6079 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6080 {
6081         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6082                                   NL80211_WPA_VERSION_2));
6083 }
6084
6085 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6086 {
6087         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6088         struct net_device *dev = info->user_ptr[1];
6089         struct ieee80211_channel *chan;
6090         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6091         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6092         enum nl80211_auth_type auth_type;
6093         struct key_parse key;
6094         bool local_state_change;
6095
6096         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6097                 return -EINVAL;
6098
6099         if (!info->attrs[NL80211_ATTR_MAC])
6100                 return -EINVAL;
6101
6102         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6103                 return -EINVAL;
6104
6105         if (!info->attrs[NL80211_ATTR_SSID])
6106                 return -EINVAL;
6107
6108         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6109                 return -EINVAL;
6110
6111         err = nl80211_parse_key(info, &key);
6112         if (err)
6113                 return err;
6114
6115         if (key.idx >= 0) {
6116                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6117                         return -EINVAL;
6118                 if (!key.p.key || !key.p.key_len)
6119                         return -EINVAL;
6120                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6121                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6122                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6123                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6124                         return -EINVAL;
6125                 if (key.idx > 4)
6126                         return -EINVAL;
6127         } else {
6128                 key.p.key_len = 0;
6129                 key.p.key = NULL;
6130         }
6131
6132         if (key.idx >= 0) {
6133                 int i;
6134                 bool ok = false;
6135                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6136                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6137                                 ok = true;
6138                                 break;
6139                         }
6140                 }
6141                 if (!ok)
6142                         return -EINVAL;
6143         }
6144
6145         if (!rdev->ops->auth)
6146                 return -EOPNOTSUPP;
6147
6148         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6149             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6150                 return -EOPNOTSUPP;
6151
6152         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6153         chan = ieee80211_get_channel(&rdev->wiphy,
6154                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6155         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6156                 return -EINVAL;
6157
6158         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6159         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6160
6161         if (info->attrs[NL80211_ATTR_IE]) {
6162                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6163                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6164         }
6165
6166         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6167         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6168                 return -EINVAL;
6169
6170         if (auth_type == NL80211_AUTHTYPE_SAE &&
6171             !info->attrs[NL80211_ATTR_SAE_DATA])
6172                 return -EINVAL;
6173
6174         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6175                 if (auth_type != NL80211_AUTHTYPE_SAE)
6176                         return -EINVAL;
6177                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6178                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6179                 /* need to include at least Auth Transaction and Status Code */
6180                 if (sae_data_len < 4)
6181                         return -EINVAL;
6182         }
6183
6184         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6185
6186         /*
6187          * Since we no longer track auth state, ignore
6188          * requests to only change local state.
6189          */
6190         if (local_state_change)
6191                 return 0;
6192
6193         wdev_lock(dev->ieee80211_ptr);
6194         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6195                                  ssid, ssid_len, ie, ie_len,
6196                                  key.p.key, key.p.key_len, key.idx,
6197                                  sae_data, sae_data_len);
6198         wdev_unlock(dev->ieee80211_ptr);
6199         return err;
6200 }
6201
6202 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6203                                    struct genl_info *info,
6204                                    struct cfg80211_crypto_settings *settings,
6205                                    int cipher_limit)
6206 {
6207         memset(settings, 0, sizeof(*settings));
6208
6209         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6210
6211         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6212                 u16 proto;
6213                 proto = nla_get_u16(
6214                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6215                 settings->control_port_ethertype = cpu_to_be16(proto);
6216                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6217                     proto != ETH_P_PAE)
6218                         return -EINVAL;
6219                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6220                         settings->control_port_no_encrypt = true;
6221         } else
6222                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6223
6224         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6225                 void *data;
6226                 int len, i;
6227
6228                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6229                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6230                 settings->n_ciphers_pairwise = len / sizeof(u32);
6231
6232                 if (len % sizeof(u32))
6233                         return -EINVAL;
6234
6235                 if (settings->n_ciphers_pairwise > cipher_limit)
6236                         return -EINVAL;
6237
6238                 memcpy(settings->ciphers_pairwise, data, len);
6239
6240                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6241                         if (!cfg80211_supported_cipher_suite(
6242                                         &rdev->wiphy,
6243                                         settings->ciphers_pairwise[i]))
6244                                 return -EINVAL;
6245         }
6246
6247         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6248                 settings->cipher_group =
6249                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6250                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6251                                                      settings->cipher_group))
6252                         return -EINVAL;
6253         }
6254
6255         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6256                 settings->wpa_versions =
6257                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6258                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6259                         return -EINVAL;
6260         }
6261
6262         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6263                 void *data;
6264                 int len;
6265
6266                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6267                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6268                 settings->n_akm_suites = len / sizeof(u32);
6269
6270                 if (len % sizeof(u32))
6271                         return -EINVAL;
6272
6273                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6274                         return -EINVAL;
6275
6276                 memcpy(settings->akm_suites, data, len);
6277         }
6278
6279         return 0;
6280 }
6281
6282 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6283 {
6284         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6285         struct net_device *dev = info->user_ptr[1];
6286         struct ieee80211_channel *chan;
6287         struct cfg80211_assoc_request req = {};
6288         const u8 *bssid, *ssid;
6289         int err, ssid_len = 0;
6290
6291         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6292                 return -EINVAL;
6293
6294         if (!info->attrs[NL80211_ATTR_MAC] ||
6295             !info->attrs[NL80211_ATTR_SSID] ||
6296             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6297                 return -EINVAL;
6298
6299         if (!rdev->ops->assoc)
6300                 return -EOPNOTSUPP;
6301
6302         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6303             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6304                 return -EOPNOTSUPP;
6305
6306         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6307
6308         chan = ieee80211_get_channel(&rdev->wiphy,
6309                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6310         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6311                 return -EINVAL;
6312
6313         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6314         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6315
6316         if (info->attrs[NL80211_ATTR_IE]) {
6317                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6318                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6319         }
6320
6321         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6322                 enum nl80211_mfp mfp =
6323                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6324                 if (mfp == NL80211_MFP_REQUIRED)
6325                         req.use_mfp = true;
6326                 else if (mfp != NL80211_MFP_NO)
6327                         return -EINVAL;
6328         }
6329
6330         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6331                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6332
6333         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6334                 req.flags |= ASSOC_REQ_DISABLE_HT;
6335
6336         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6337                 memcpy(&req.ht_capa_mask,
6338                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6339                        sizeof(req.ht_capa_mask));
6340
6341         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6342                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6343                         return -EINVAL;
6344                 memcpy(&req.ht_capa,
6345                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6346                        sizeof(req.ht_capa));
6347         }
6348
6349         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6350                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6351
6352         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6353                 memcpy(&req.vht_capa_mask,
6354                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6355                        sizeof(req.vht_capa_mask));
6356
6357         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6358                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6359                         return -EINVAL;
6360                 memcpy(&req.vht_capa,
6361                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6362                        sizeof(req.vht_capa));
6363         }
6364
6365         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6366         if (!err) {
6367                 wdev_lock(dev->ieee80211_ptr);
6368                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6369                                           ssid, ssid_len, &req);
6370                 wdev_unlock(dev->ieee80211_ptr);
6371         }
6372
6373         return err;
6374 }
6375
6376 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6377 {
6378         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6379         struct net_device *dev = info->user_ptr[1];
6380         const u8 *ie = NULL, *bssid;
6381         int ie_len = 0, err;
6382         u16 reason_code;
6383         bool local_state_change;
6384
6385         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6386                 return -EINVAL;
6387
6388         if (!info->attrs[NL80211_ATTR_MAC])
6389                 return -EINVAL;
6390
6391         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6392                 return -EINVAL;
6393
6394         if (!rdev->ops->deauth)
6395                 return -EOPNOTSUPP;
6396
6397         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6398             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6399                 return -EOPNOTSUPP;
6400
6401         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6402
6403         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6404         if (reason_code == 0) {
6405                 /* Reason Code 0 is reserved */
6406                 return -EINVAL;
6407         }
6408
6409         if (info->attrs[NL80211_ATTR_IE]) {
6410                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6411                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6412         }
6413
6414         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6415
6416         wdev_lock(dev->ieee80211_ptr);
6417         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6418                                    local_state_change);
6419         wdev_unlock(dev->ieee80211_ptr);
6420         return err;
6421 }
6422
6423 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6424 {
6425         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6426         struct net_device *dev = info->user_ptr[1];
6427         const u8 *ie = NULL, *bssid;
6428         int ie_len = 0, err;
6429         u16 reason_code;
6430         bool local_state_change;
6431
6432         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6433                 return -EINVAL;
6434
6435         if (!info->attrs[NL80211_ATTR_MAC])
6436                 return -EINVAL;
6437
6438         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6439                 return -EINVAL;
6440
6441         if (!rdev->ops->disassoc)
6442                 return -EOPNOTSUPP;
6443
6444         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6445             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6446                 return -EOPNOTSUPP;
6447
6448         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6449
6450         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6451         if (reason_code == 0) {
6452                 /* Reason Code 0 is reserved */
6453                 return -EINVAL;
6454         }
6455
6456         if (info->attrs[NL80211_ATTR_IE]) {
6457                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6458                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6459         }
6460
6461         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6462
6463         wdev_lock(dev->ieee80211_ptr);
6464         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6465                                      local_state_change);
6466         wdev_unlock(dev->ieee80211_ptr);
6467         return err;
6468 }
6469
6470 static bool
6471 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6472                          int mcast_rate[IEEE80211_NUM_BANDS],
6473                          int rateval)
6474 {
6475         struct wiphy *wiphy = &rdev->wiphy;
6476         bool found = false;
6477         int band, i;
6478
6479         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6480                 struct ieee80211_supported_band *sband;
6481
6482                 sband = wiphy->bands[band];
6483                 if (!sband)
6484                         continue;
6485
6486                 for (i = 0; i < sband->n_bitrates; i++) {
6487                         if (sband->bitrates[i].bitrate == rateval) {
6488                                 mcast_rate[band] = i + 1;
6489                                 found = true;
6490                                 break;
6491                         }
6492                 }
6493         }
6494
6495         return found;
6496 }
6497
6498 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6499 {
6500         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6501         struct net_device *dev = info->user_ptr[1];
6502         struct cfg80211_ibss_params ibss;
6503         struct wiphy *wiphy;
6504         struct cfg80211_cached_keys *connkeys = NULL;
6505         int err;
6506
6507         memset(&ibss, 0, sizeof(ibss));
6508
6509         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6510                 return -EINVAL;
6511
6512         if (!info->attrs[NL80211_ATTR_SSID] ||
6513             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6514                 return -EINVAL;
6515
6516         ibss.beacon_interval = 100;
6517
6518         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6519                 ibss.beacon_interval =
6520                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6521                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6522                         return -EINVAL;
6523         }
6524
6525         if (!rdev->ops->join_ibss)
6526                 return -EOPNOTSUPP;
6527
6528         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6529                 return -EOPNOTSUPP;
6530
6531         wiphy = &rdev->wiphy;
6532
6533         if (info->attrs[NL80211_ATTR_MAC]) {
6534                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6535
6536                 if (!is_valid_ether_addr(ibss.bssid))
6537                         return -EINVAL;
6538         }
6539         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6540         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6541
6542         if (info->attrs[NL80211_ATTR_IE]) {
6543                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6544                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6545         }
6546
6547         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6548         if (err)
6549                 return err;
6550
6551         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6552                 return -EINVAL;
6553
6554         switch (ibss.chandef.width) {
6555         case NL80211_CHAN_WIDTH_5:
6556         case NL80211_CHAN_WIDTH_10:
6557         case NL80211_CHAN_WIDTH_20_NOHT:
6558                 break;
6559         case NL80211_CHAN_WIDTH_20:
6560         case NL80211_CHAN_WIDTH_40:
6561                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6562                         break;
6563         default:
6564                 return -EINVAL;
6565         }
6566
6567         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6568         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6569
6570         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6571                 u8 *rates =
6572                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6573                 int n_rates =
6574                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6575                 struct ieee80211_supported_band *sband =
6576                         wiphy->bands[ibss.chandef.chan->band];
6577
6578                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6579                                              &ibss.basic_rates);
6580                 if (err)
6581                         return err;
6582         }
6583
6584         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6585                 memcpy(&ibss.ht_capa_mask,
6586                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6587                        sizeof(ibss.ht_capa_mask));
6588
6589         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6590                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6591                         return -EINVAL;
6592                 memcpy(&ibss.ht_capa,
6593                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6594                        sizeof(ibss.ht_capa));
6595         }
6596
6597         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6598             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6599                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6600                 return -EINVAL;
6601
6602         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6603                 bool no_ht = false;
6604
6605                 connkeys = nl80211_parse_connkeys(rdev,
6606                                           info->attrs[NL80211_ATTR_KEYS],
6607                                           &no_ht);
6608                 if (IS_ERR(connkeys))
6609                         return PTR_ERR(connkeys);
6610
6611                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6612                     no_ht) {
6613                         kfree(connkeys);
6614                         return -EINVAL;
6615                 }
6616         }
6617
6618         ibss.control_port =
6619                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6620
6621         ibss.userspace_handles_dfs =
6622                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
6623
6624         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6625         if (err)
6626                 kfree(connkeys);
6627         return err;
6628 }
6629
6630 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6631 {
6632         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6633         struct net_device *dev = info->user_ptr[1];
6634
6635         if (!rdev->ops->leave_ibss)
6636                 return -EOPNOTSUPP;
6637
6638         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6639                 return -EOPNOTSUPP;
6640
6641         return cfg80211_leave_ibss(rdev, dev, false);
6642 }
6643
6644 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6645 {
6646         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6647         struct net_device *dev = info->user_ptr[1];
6648         int mcast_rate[IEEE80211_NUM_BANDS];
6649         u32 nla_rate;
6650         int err;
6651
6652         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6653             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6654                 return -EOPNOTSUPP;
6655
6656         if (!rdev->ops->set_mcast_rate)
6657                 return -EOPNOTSUPP;
6658
6659         memset(mcast_rate, 0, sizeof(mcast_rate));
6660
6661         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6662                 return -EINVAL;
6663
6664         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6665         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6666                 return -EINVAL;
6667
6668         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6669
6670         return err;
6671 }
6672
6673
6674 #ifdef CONFIG_NL80211_TESTMODE
6675 static struct genl_multicast_group nl80211_testmode_mcgrp = {
6676         .name = "testmode",
6677 };
6678
6679 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6680 {
6681         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6682         struct wireless_dev *wdev =
6683                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
6684         int err;
6685
6686         if (!rdev->ops->testmode_cmd)
6687                 return -EOPNOTSUPP;
6688
6689         if (IS_ERR(wdev)) {
6690                 err = PTR_ERR(wdev);
6691                 if (err != -EINVAL)
6692                         return err;
6693                 wdev = NULL;
6694         } else if (wdev->wiphy != &rdev->wiphy) {
6695                 return -EINVAL;
6696         }
6697
6698         if (!info->attrs[NL80211_ATTR_TESTDATA])
6699                 return -EINVAL;
6700
6701         rdev->testmode_info = info;
6702         err = rdev_testmode_cmd(rdev, wdev,
6703                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6704                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6705         rdev->testmode_info = NULL;
6706
6707         return err;
6708 }
6709
6710 static int nl80211_testmode_dump(struct sk_buff *skb,
6711                                  struct netlink_callback *cb)
6712 {
6713         struct cfg80211_registered_device *rdev;
6714         int err;
6715         long phy_idx;
6716         void *data = NULL;
6717         int data_len = 0;
6718
6719         rtnl_lock();
6720
6721         if (cb->args[0]) {
6722                 /*
6723                  * 0 is a valid index, but not valid for args[0],
6724                  * so we need to offset by 1.
6725                  */
6726                 phy_idx = cb->args[0] - 1;
6727         } else {
6728                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6729                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6730                                   nl80211_policy);
6731                 if (err)
6732                         goto out_err;
6733
6734                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6735                                                   nl80211_fam.attrbuf);
6736                 if (IS_ERR(rdev)) {
6737                         err = PTR_ERR(rdev);
6738                         goto out_err;
6739                 }
6740                 phy_idx = rdev->wiphy_idx;
6741                 rdev = NULL;
6742
6743                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6744                         cb->args[1] =
6745                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6746         }
6747
6748         if (cb->args[1]) {
6749                 data = nla_data((void *)cb->args[1]);
6750                 data_len = nla_len((void *)cb->args[1]);
6751         }
6752
6753         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6754         if (!rdev) {
6755                 err = -ENOENT;
6756                 goto out_err;
6757         }
6758
6759         if (!rdev->ops->testmode_dump) {
6760                 err = -EOPNOTSUPP;
6761                 goto out_err;
6762         }
6763
6764         while (1) {
6765                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6766                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6767                                            NL80211_CMD_TESTMODE);
6768                 struct nlattr *tmdata;
6769
6770                 if (!hdr)
6771                         break;
6772
6773                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6774                         genlmsg_cancel(skb, hdr);
6775                         break;
6776                 }
6777
6778                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6779                 if (!tmdata) {
6780                         genlmsg_cancel(skb, hdr);
6781                         break;
6782                 }
6783                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6784                 nla_nest_end(skb, tmdata);
6785
6786                 if (err == -ENOBUFS || err == -ENOENT) {
6787                         genlmsg_cancel(skb, hdr);
6788                         break;
6789                 } else if (err) {
6790                         genlmsg_cancel(skb, hdr);
6791                         goto out_err;
6792                 }
6793
6794                 genlmsg_end(skb, hdr);
6795         }
6796
6797         err = skb->len;
6798         /* see above */
6799         cb->args[0] = phy_idx + 1;
6800  out_err:
6801         rtnl_unlock();
6802         return err;
6803 }
6804
6805 static struct sk_buff *
6806 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6807                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6808 {
6809         struct sk_buff *skb;
6810         void *hdr;
6811         struct nlattr *data;
6812
6813         skb = nlmsg_new(approxlen + 100, gfp);
6814         if (!skb)
6815                 return NULL;
6816
6817         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6818         if (!hdr) {
6819                 kfree_skb(skb);
6820                 return NULL;
6821         }
6822
6823         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6824                 goto nla_put_failure;
6825         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6826
6827         ((void **)skb->cb)[0] = rdev;
6828         ((void **)skb->cb)[1] = hdr;
6829         ((void **)skb->cb)[2] = data;
6830
6831         return skb;
6832
6833  nla_put_failure:
6834         kfree_skb(skb);
6835         return NULL;
6836 }
6837
6838 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6839                                                   int approxlen)
6840 {
6841         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6842
6843         if (WARN_ON(!rdev->testmode_info))
6844                 return NULL;
6845
6846         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6847                                 rdev->testmode_info->snd_portid,
6848                                 rdev->testmode_info->snd_seq,
6849                                 GFP_KERNEL);
6850 }
6851 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6852
6853 int cfg80211_testmode_reply(struct sk_buff *skb)
6854 {
6855         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6856         void *hdr = ((void **)skb->cb)[1];
6857         struct nlattr *data = ((void **)skb->cb)[2];
6858
6859         if (WARN_ON(!rdev->testmode_info)) {
6860                 kfree_skb(skb);
6861                 return -EINVAL;
6862         }
6863
6864         nla_nest_end(skb, data);
6865         genlmsg_end(skb, hdr);
6866         return genlmsg_reply(skb, rdev->testmode_info);
6867 }
6868 EXPORT_SYMBOL(cfg80211_testmode_reply);
6869
6870 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6871                                                   int approxlen, gfp_t gfp)
6872 {
6873         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6874
6875         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6876 }
6877 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6878
6879 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6880 {
6881         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6882         void *hdr = ((void **)skb->cb)[1];
6883         struct nlattr *data = ((void **)skb->cb)[2];
6884
6885         nla_nest_end(skb, data);
6886         genlmsg_end(skb, hdr);
6887         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
6888                                 nl80211_testmode_mcgrp.id, gfp);
6889 }
6890 EXPORT_SYMBOL(cfg80211_testmode_event);
6891 #endif
6892
6893 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6894 {
6895         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6896         struct net_device *dev = info->user_ptr[1];
6897         struct cfg80211_connect_params connect;
6898         struct wiphy *wiphy;
6899         struct cfg80211_cached_keys *connkeys = NULL;
6900         int err;
6901
6902         memset(&connect, 0, sizeof(connect));
6903
6904         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6905                 return -EINVAL;
6906
6907         if (!info->attrs[NL80211_ATTR_SSID] ||
6908             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6909                 return -EINVAL;
6910
6911         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6912                 connect.auth_type =
6913                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6914                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6915                                              NL80211_CMD_CONNECT))
6916                         return -EINVAL;
6917         } else
6918                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6919
6920         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6921
6922         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6923                                       NL80211_MAX_NR_CIPHER_SUITES);
6924         if (err)
6925                 return err;
6926
6927         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6928             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6929                 return -EOPNOTSUPP;
6930
6931         wiphy = &rdev->wiphy;
6932
6933         connect.bg_scan_period = -1;
6934         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6935                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6936                 connect.bg_scan_period =
6937                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6938         }
6939
6940         if (info->attrs[NL80211_ATTR_MAC])
6941                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6942         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6943         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6944
6945         if (info->attrs[NL80211_ATTR_IE]) {
6946                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6947                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6948         }
6949
6950         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6951                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6952                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6953                     connect.mfp != NL80211_MFP_NO)
6954                         return -EINVAL;
6955         } else {
6956                 connect.mfp = NL80211_MFP_NO;
6957         }
6958
6959         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6960                 connect.channel =
6961                         ieee80211_get_channel(wiphy,
6962                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6963                 if (!connect.channel ||
6964                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6965                         return -EINVAL;
6966         }
6967
6968         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6969                 connkeys = nl80211_parse_connkeys(rdev,
6970                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6971                 if (IS_ERR(connkeys))
6972                         return PTR_ERR(connkeys);
6973         }
6974
6975         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6976                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6977
6978         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6979                 memcpy(&connect.ht_capa_mask,
6980                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6981                        sizeof(connect.ht_capa_mask));
6982
6983         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6984                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6985                         kfree(connkeys);
6986                         return -EINVAL;
6987                 }
6988                 memcpy(&connect.ht_capa,
6989                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6990                        sizeof(connect.ht_capa));
6991         }
6992
6993         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6994                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
6995
6996         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6997                 memcpy(&connect.vht_capa_mask,
6998                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6999                        sizeof(connect.vht_capa_mask));
7000
7001         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7002                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7003                         kfree(connkeys);
7004                         return -EINVAL;
7005                 }
7006                 memcpy(&connect.vht_capa,
7007                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7008                        sizeof(connect.vht_capa));
7009         }
7010
7011         wdev_lock(dev->ieee80211_ptr);
7012         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7013         wdev_unlock(dev->ieee80211_ptr);
7014         if (err)
7015                 kfree(connkeys);
7016         return err;
7017 }
7018
7019 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7020 {
7021         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7022         struct net_device *dev = info->user_ptr[1];
7023         u16 reason;
7024         int ret;
7025
7026         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7027                 reason = WLAN_REASON_DEAUTH_LEAVING;
7028         else
7029                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7030
7031         if (reason == 0)
7032                 return -EINVAL;
7033
7034         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7035             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7036                 return -EOPNOTSUPP;
7037
7038         wdev_lock(dev->ieee80211_ptr);
7039         ret = cfg80211_disconnect(rdev, dev, reason, true);
7040         wdev_unlock(dev->ieee80211_ptr);
7041         return ret;
7042 }
7043
7044 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7045 {
7046         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7047         struct net *net;
7048         int err;
7049         u32 pid;
7050
7051         if (!info->attrs[NL80211_ATTR_PID])
7052                 return -EINVAL;
7053
7054         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7055
7056         net = get_net_ns_by_pid(pid);
7057         if (IS_ERR(net))
7058                 return PTR_ERR(net);
7059
7060         err = 0;
7061
7062         /* check if anything to do */
7063         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7064                 err = cfg80211_switch_netns(rdev, net);
7065
7066         put_net(net);
7067         return err;
7068 }
7069
7070 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7071 {
7072         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7073         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7074                         struct cfg80211_pmksa *pmksa) = NULL;
7075         struct net_device *dev = info->user_ptr[1];
7076         struct cfg80211_pmksa pmksa;
7077
7078         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7079
7080         if (!info->attrs[NL80211_ATTR_MAC])
7081                 return -EINVAL;
7082
7083         if (!info->attrs[NL80211_ATTR_PMKID])
7084                 return -EINVAL;
7085
7086         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7087         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7088
7089         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7090             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7091                 return -EOPNOTSUPP;
7092
7093         switch (info->genlhdr->cmd) {
7094         case NL80211_CMD_SET_PMKSA:
7095                 rdev_ops = rdev->ops->set_pmksa;
7096                 break;
7097         case NL80211_CMD_DEL_PMKSA:
7098                 rdev_ops = rdev->ops->del_pmksa;
7099                 break;
7100         default:
7101                 WARN_ON(1);
7102                 break;
7103         }
7104
7105         if (!rdev_ops)
7106                 return -EOPNOTSUPP;
7107
7108         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7109 }
7110
7111 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7112 {
7113         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7114         struct net_device *dev = info->user_ptr[1];
7115
7116         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7117             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7118                 return -EOPNOTSUPP;
7119
7120         if (!rdev->ops->flush_pmksa)
7121                 return -EOPNOTSUPP;
7122
7123         return rdev_flush_pmksa(rdev, dev);
7124 }
7125
7126 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7127 {
7128         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7129         struct net_device *dev = info->user_ptr[1];
7130         u8 action_code, dialog_token;
7131         u16 status_code;
7132         u8 *peer;
7133
7134         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7135             !rdev->ops->tdls_mgmt)
7136                 return -EOPNOTSUPP;
7137
7138         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7139             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7140             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7141             !info->attrs[NL80211_ATTR_IE] ||
7142             !info->attrs[NL80211_ATTR_MAC])
7143                 return -EINVAL;
7144
7145         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7146         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7147         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7148         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7149
7150         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7151                               dialog_token, status_code,
7152                               nla_data(info->attrs[NL80211_ATTR_IE]),
7153                               nla_len(info->attrs[NL80211_ATTR_IE]));
7154 }
7155
7156 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7157 {
7158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7159         struct net_device *dev = info->user_ptr[1];
7160         enum nl80211_tdls_operation operation;
7161         u8 *peer;
7162
7163         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7164             !rdev->ops->tdls_oper)
7165                 return -EOPNOTSUPP;
7166
7167         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7168             !info->attrs[NL80211_ATTR_MAC])
7169                 return -EINVAL;
7170
7171         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7172         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7173
7174         return rdev_tdls_oper(rdev, dev, peer, operation);
7175 }
7176
7177 static int nl80211_remain_on_channel(struct sk_buff *skb,
7178                                      struct genl_info *info)
7179 {
7180         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7181         struct wireless_dev *wdev = info->user_ptr[1];
7182         struct cfg80211_chan_def chandef;
7183         struct sk_buff *msg;
7184         void *hdr;
7185         u64 cookie;
7186         u32 duration;
7187         int err;
7188
7189         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7190             !info->attrs[NL80211_ATTR_DURATION])
7191                 return -EINVAL;
7192
7193         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7194
7195         if (!rdev->ops->remain_on_channel ||
7196             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7197                 return -EOPNOTSUPP;
7198
7199         /*
7200          * We should be on that channel for at least a minimum amount of
7201          * time (10ms) but no longer than the driver supports.
7202          */
7203         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7204             duration > rdev->wiphy.max_remain_on_channel_duration)
7205                 return -EINVAL;
7206
7207         err = nl80211_parse_chandef(rdev, info, &chandef);
7208         if (err)
7209                 return err;
7210
7211         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7212         if (!msg)
7213                 return -ENOMEM;
7214
7215         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7216                              NL80211_CMD_REMAIN_ON_CHANNEL);
7217         if (!hdr) {
7218                 err = -ENOBUFS;
7219                 goto free_msg;
7220         }
7221
7222         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7223                                      duration, &cookie);
7224
7225         if (err)
7226                 goto free_msg;
7227
7228         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7229                 goto nla_put_failure;
7230
7231         genlmsg_end(msg, hdr);
7232
7233         return genlmsg_reply(msg, info);
7234
7235  nla_put_failure:
7236         err = -ENOBUFS;
7237  free_msg:
7238         nlmsg_free(msg);
7239         return err;
7240 }
7241
7242 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7243                                             struct genl_info *info)
7244 {
7245         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7246         struct wireless_dev *wdev = info->user_ptr[1];
7247         u64 cookie;
7248
7249         if (!info->attrs[NL80211_ATTR_COOKIE])
7250                 return -EINVAL;
7251
7252         if (!rdev->ops->cancel_remain_on_channel)
7253                 return -EOPNOTSUPP;
7254
7255         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7256
7257         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7258 }
7259
7260 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7261                            u8 *rates, u8 rates_len)
7262 {
7263         u8 i;
7264         u32 mask = 0;
7265
7266         for (i = 0; i < rates_len; i++) {
7267                 int rate = (rates[i] & 0x7f) * 5;
7268                 int ridx;
7269                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7270                         struct ieee80211_rate *srate =
7271                                 &sband->bitrates[ridx];
7272                         if (rate == srate->bitrate) {
7273                                 mask |= 1 << ridx;
7274                                 break;
7275                         }
7276                 }
7277                 if (ridx == sband->n_bitrates)
7278                         return 0; /* rate not found */
7279         }
7280
7281         return mask;
7282 }
7283
7284 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7285                                u8 *rates, u8 rates_len,
7286                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7287 {
7288         u8 i;
7289
7290         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7291
7292         for (i = 0; i < rates_len; i++) {
7293                 int ridx, rbit;
7294
7295                 ridx = rates[i] / 8;
7296                 rbit = BIT(rates[i] % 8);
7297
7298                 /* check validity */
7299                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7300                         return false;
7301
7302                 /* check availability */
7303                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7304                         mcs[ridx] |= rbit;
7305                 else
7306                         return false;
7307         }
7308
7309         return true;
7310 }
7311
7312 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7313         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7314                                     .len = NL80211_MAX_SUPP_RATES },
7315         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
7316                                  .len = NL80211_MAX_SUPP_HT_RATES },
7317 };
7318
7319 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7320                                        struct genl_info *info)
7321 {
7322         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7323         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7324         struct cfg80211_bitrate_mask mask;
7325         int rem, i;
7326         struct net_device *dev = info->user_ptr[1];
7327         struct nlattr *tx_rates;
7328         struct ieee80211_supported_band *sband;
7329
7330         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
7331                 return -EINVAL;
7332
7333         if (!rdev->ops->set_bitrate_mask)
7334                 return -EOPNOTSUPP;
7335
7336         memset(&mask, 0, sizeof(mask));
7337         /* Default to all rates enabled */
7338         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7339                 sband = rdev->wiphy.bands[i];
7340                 mask.control[i].legacy =
7341                         sband ? (1 << sband->n_bitrates) - 1 : 0;
7342                 if (sband)
7343                         memcpy(mask.control[i].mcs,
7344                                sband->ht_cap.mcs.rx_mask,
7345                                sizeof(mask.control[i].mcs));
7346                 else
7347                         memset(mask.control[i].mcs, 0,
7348                                sizeof(mask.control[i].mcs));
7349         }
7350
7351         /*
7352          * The nested attribute uses enum nl80211_band as the index. This maps
7353          * directly to the enum ieee80211_band values used in cfg80211.
7354          */
7355         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7356         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
7357         {
7358                 enum ieee80211_band band = nla_type(tx_rates);
7359                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7360                         return -EINVAL;
7361                 sband = rdev->wiphy.bands[band];
7362                 if (sband == NULL)
7363                         return -EINVAL;
7364                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7365                           nla_len(tx_rates), nl80211_txattr_policy);
7366                 if (tb[NL80211_TXRATE_LEGACY]) {
7367                         mask.control[band].legacy = rateset_to_mask(
7368                                 sband,
7369                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7370                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7371                         if ((mask.control[band].legacy == 0) &&
7372                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7373                                 return -EINVAL;
7374                 }
7375                 if (tb[NL80211_TXRATE_MCS]) {
7376                         if (!ht_rateset_to_mask(
7377                                         sband,
7378                                         nla_data(tb[NL80211_TXRATE_MCS]),
7379                                         nla_len(tb[NL80211_TXRATE_MCS]),
7380                                         mask.control[band].mcs))
7381                                 return -EINVAL;
7382                 }
7383
7384                 if (mask.control[band].legacy == 0) {
7385                         /* don't allow empty legacy rates if HT
7386                          * is not even supported. */
7387                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
7388                                 return -EINVAL;
7389
7390                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7391                                 if (mask.control[band].mcs[i])
7392                                         break;
7393
7394                         /* legacy and mcs rates may not be both empty */
7395                         if (i == IEEE80211_HT_MCS_MASK_LEN)
7396                                 return -EINVAL;
7397                 }
7398         }
7399
7400         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7401 }
7402
7403 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7404 {
7405         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7406         struct wireless_dev *wdev = info->user_ptr[1];
7407         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7408
7409         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7410                 return -EINVAL;
7411
7412         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7413                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7414
7415         switch (wdev->iftype) {
7416         case NL80211_IFTYPE_STATION:
7417         case NL80211_IFTYPE_ADHOC:
7418         case NL80211_IFTYPE_P2P_CLIENT:
7419         case NL80211_IFTYPE_AP:
7420         case NL80211_IFTYPE_AP_VLAN:
7421         case NL80211_IFTYPE_MESH_POINT:
7422         case NL80211_IFTYPE_P2P_GO:
7423         case NL80211_IFTYPE_P2P_DEVICE:
7424                 break;
7425         default:
7426                 return -EOPNOTSUPP;
7427         }
7428
7429         /* not much point in registering if we can't reply */
7430         if (!rdev->ops->mgmt_tx)
7431                 return -EOPNOTSUPP;
7432
7433         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7434                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7435                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7436 }
7437
7438 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7439 {
7440         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7441         struct wireless_dev *wdev = info->user_ptr[1];
7442         struct cfg80211_chan_def chandef;
7443         int err;
7444         void *hdr = NULL;
7445         u64 cookie;
7446         struct sk_buff *msg = NULL;
7447         struct cfg80211_mgmt_tx_params params = {
7448                 .dont_wait_for_ack =
7449                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
7450         };
7451
7452         if (!info->attrs[NL80211_ATTR_FRAME])
7453                 return -EINVAL;
7454
7455         if (!rdev->ops->mgmt_tx)
7456                 return -EOPNOTSUPP;
7457
7458         switch (wdev->iftype) {
7459         case NL80211_IFTYPE_P2P_DEVICE:
7460                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7461                         return -EINVAL;
7462         case NL80211_IFTYPE_STATION:
7463         case NL80211_IFTYPE_ADHOC:
7464         case NL80211_IFTYPE_P2P_CLIENT:
7465         case NL80211_IFTYPE_AP:
7466         case NL80211_IFTYPE_AP_VLAN:
7467         case NL80211_IFTYPE_MESH_POINT:
7468         case NL80211_IFTYPE_P2P_GO:
7469                 break;
7470         default:
7471                 return -EOPNOTSUPP;
7472         }
7473
7474         if (info->attrs[NL80211_ATTR_DURATION]) {
7475                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7476                         return -EINVAL;
7477                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7478
7479                 /*
7480                  * We should wait on the channel for at least a minimum amount
7481                  * of time (10ms) but no longer than the driver supports.
7482                  */
7483                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7484                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
7485                         return -EINVAL;
7486
7487         }
7488
7489         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7490
7491         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7492                 return -EINVAL;
7493
7494         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7495
7496         /* get the channel if any has been specified, otherwise pass NULL to
7497          * the driver. The latter will use the current one
7498          */
7499         chandef.chan = NULL;
7500         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7501                 err = nl80211_parse_chandef(rdev, info, &chandef);
7502                 if (err)
7503                         return err;
7504         }
7505
7506         if (!chandef.chan && params.offchan)
7507                 return -EINVAL;
7508
7509         if (!params.dont_wait_for_ack) {
7510                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7511                 if (!msg)
7512                         return -ENOMEM;
7513
7514                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7515                                      NL80211_CMD_FRAME);
7516                 if (!hdr) {
7517                         err = -ENOBUFS;
7518                         goto free_msg;
7519                 }
7520         }
7521
7522         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
7523         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
7524         params.chan = chandef.chan;
7525         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
7526         if (err)
7527                 goto free_msg;
7528
7529         if (msg) {
7530                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7531                         goto nla_put_failure;
7532
7533                 genlmsg_end(msg, hdr);
7534                 return genlmsg_reply(msg, info);
7535         }
7536
7537         return 0;
7538
7539  nla_put_failure:
7540         err = -ENOBUFS;
7541  free_msg:
7542         nlmsg_free(msg);
7543         return err;
7544 }
7545
7546 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7547 {
7548         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7549         struct wireless_dev *wdev = info->user_ptr[1];
7550         u64 cookie;
7551
7552         if (!info->attrs[NL80211_ATTR_COOKIE])
7553                 return -EINVAL;
7554
7555         if (!rdev->ops->mgmt_tx_cancel_wait)
7556                 return -EOPNOTSUPP;
7557
7558         switch (wdev->iftype) {
7559         case NL80211_IFTYPE_STATION:
7560         case NL80211_IFTYPE_ADHOC:
7561         case NL80211_IFTYPE_P2P_CLIENT:
7562         case NL80211_IFTYPE_AP:
7563         case NL80211_IFTYPE_AP_VLAN:
7564         case NL80211_IFTYPE_P2P_GO:
7565         case NL80211_IFTYPE_P2P_DEVICE:
7566                 break;
7567         default:
7568                 return -EOPNOTSUPP;
7569         }
7570
7571         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7572
7573         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7574 }
7575
7576 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7577 {
7578         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7579         struct wireless_dev *wdev;
7580         struct net_device *dev = info->user_ptr[1];
7581         u8 ps_state;
7582         bool state;
7583         int err;
7584
7585         if (!info->attrs[NL80211_ATTR_PS_STATE])
7586                 return -EINVAL;
7587
7588         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7589
7590         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7591                 return -EINVAL;
7592
7593         wdev = dev->ieee80211_ptr;
7594
7595         if (!rdev->ops->set_power_mgmt)
7596                 return -EOPNOTSUPP;
7597
7598         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7599
7600         if (state == wdev->ps)
7601                 return 0;
7602
7603         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7604         if (!err)
7605                 wdev->ps = state;
7606         return err;
7607 }
7608
7609 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7610 {
7611         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7612         enum nl80211_ps_state ps_state;
7613         struct wireless_dev *wdev;
7614         struct net_device *dev = info->user_ptr[1];
7615         struct sk_buff *msg;
7616         void *hdr;
7617         int err;
7618
7619         wdev = dev->ieee80211_ptr;
7620
7621         if (!rdev->ops->set_power_mgmt)
7622                 return -EOPNOTSUPP;
7623
7624         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7625         if (!msg)
7626                 return -ENOMEM;
7627
7628         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7629                              NL80211_CMD_GET_POWER_SAVE);
7630         if (!hdr) {
7631                 err = -ENOBUFS;
7632                 goto free_msg;
7633         }
7634
7635         if (wdev->ps)
7636                 ps_state = NL80211_PS_ENABLED;
7637         else
7638                 ps_state = NL80211_PS_DISABLED;
7639
7640         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7641                 goto nla_put_failure;
7642
7643         genlmsg_end(msg, hdr);
7644         return genlmsg_reply(msg, info);
7645
7646  nla_put_failure:
7647         err = -ENOBUFS;
7648  free_msg:
7649         nlmsg_free(msg);
7650         return err;
7651 }
7652
7653 static struct nla_policy
7654 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7655         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7656         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7657         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7658         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7659         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7660         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7661 };
7662
7663 static int nl80211_set_cqm_txe(struct genl_info *info,
7664                                u32 rate, u32 pkts, u32 intvl)
7665 {
7666         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7667         struct net_device *dev = info->user_ptr[1];
7668         struct wireless_dev *wdev = dev->ieee80211_ptr;
7669
7670         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7671                 return -EINVAL;
7672
7673         if (!rdev->ops->set_cqm_txe_config)
7674                 return -EOPNOTSUPP;
7675
7676         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7677             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7678                 return -EOPNOTSUPP;
7679
7680         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7681 }
7682
7683 static int nl80211_set_cqm_rssi(struct genl_info *info,
7684                                 s32 threshold, u32 hysteresis)
7685 {
7686         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7687         struct net_device *dev = info->user_ptr[1];
7688         struct wireless_dev *wdev = dev->ieee80211_ptr;
7689
7690         if (threshold > 0)
7691                 return -EINVAL;
7692
7693         /* disabling - hysteresis should also be zero then */
7694         if (threshold == 0)
7695                 hysteresis = 0;
7696
7697         if (!rdev->ops->set_cqm_rssi_config)
7698                 return -EOPNOTSUPP;
7699
7700         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7701             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7702                 return -EOPNOTSUPP;
7703
7704         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7705 }
7706
7707 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7708 {
7709         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7710         struct nlattr *cqm;
7711         int err;
7712
7713         cqm = info->attrs[NL80211_ATTR_CQM];
7714         if (!cqm)
7715                 return -EINVAL;
7716
7717         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7718                                nl80211_attr_cqm_policy);
7719         if (err)
7720                 return err;
7721
7722         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7723             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7724                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7725                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7726
7727                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
7728         }
7729
7730         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7731             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7732             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7733                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7734                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7735                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7736
7737                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
7738         }
7739
7740         return -EINVAL;
7741 }
7742
7743 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7744 {
7745         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7746         struct net_device *dev = info->user_ptr[1];
7747         struct mesh_config cfg;
7748         struct mesh_setup setup;
7749         int err;
7750
7751         /* start with default */
7752         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7753         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7754
7755         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7756                 /* and parse parameters if given */
7757                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7758                 if (err)
7759                         return err;
7760         }
7761
7762         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7763             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7764                 return -EINVAL;
7765
7766         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7767         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7768
7769         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7770             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7771                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7772                         return -EINVAL;
7773
7774         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7775                 setup.beacon_interval =
7776                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7777                 if (setup.beacon_interval < 10 ||
7778                     setup.beacon_interval > 10000)
7779                         return -EINVAL;
7780         }
7781
7782         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7783                 setup.dtim_period =
7784                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7785                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7786                         return -EINVAL;
7787         }
7788
7789         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7790                 /* parse additional setup parameters if given */
7791                 err = nl80211_parse_mesh_setup(info, &setup);
7792                 if (err)
7793                         return err;
7794         }
7795
7796         if (setup.user_mpm)
7797                 cfg.auto_open_plinks = false;
7798
7799         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7800                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7801                 if (err)
7802                         return err;
7803         } else {
7804                 /* cfg80211_join_mesh() will sort it out */
7805                 setup.chandef.chan = NULL;
7806         }
7807
7808         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7809                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7810                 int n_rates =
7811                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7812                 struct ieee80211_supported_band *sband;
7813
7814                 if (!setup.chandef.chan)
7815                         return -EINVAL;
7816
7817                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
7818
7819                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7820                                              &setup.basic_rates);
7821                 if (err)
7822                         return err;
7823         }
7824
7825         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7826 }
7827
7828 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7829 {
7830         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7831         struct net_device *dev = info->user_ptr[1];
7832
7833         return cfg80211_leave_mesh(rdev, dev);
7834 }
7835
7836 #ifdef CONFIG_PM
7837 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7838                                         struct cfg80211_registered_device *rdev)
7839 {
7840         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
7841         struct nlattr *nl_pats, *nl_pat;
7842         int i, pat_len;
7843
7844         if (!wowlan->n_patterns)
7845                 return 0;
7846
7847         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7848         if (!nl_pats)
7849                 return -ENOBUFS;
7850
7851         for (i = 0; i < wowlan->n_patterns; i++) {
7852                 nl_pat = nla_nest_start(msg, i + 1);
7853                 if (!nl_pat)
7854                         return -ENOBUFS;
7855                 pat_len = wowlan->patterns[i].pattern_len;
7856                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
7857                             wowlan->patterns[i].mask) ||
7858                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
7859                             wowlan->patterns[i].pattern) ||
7860                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
7861                                 wowlan->patterns[i].pkt_offset))
7862                         return -ENOBUFS;
7863                 nla_nest_end(msg, nl_pat);
7864         }
7865         nla_nest_end(msg, nl_pats);
7866
7867         return 0;
7868 }
7869
7870 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7871                                    struct cfg80211_wowlan_tcp *tcp)
7872 {
7873         struct nlattr *nl_tcp;
7874
7875         if (!tcp)
7876                 return 0;
7877
7878         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7879         if (!nl_tcp)
7880                 return -ENOBUFS;
7881
7882         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7883             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7884             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7885             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7886             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7887             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7888                     tcp->payload_len, tcp->payload) ||
7889             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7890                         tcp->data_interval) ||
7891             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7892                     tcp->wake_len, tcp->wake_data) ||
7893             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7894                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7895                 return -ENOBUFS;
7896
7897         if (tcp->payload_seq.len &&
7898             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7899                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7900                 return -ENOBUFS;
7901
7902         if (tcp->payload_tok.len &&
7903             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7904                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7905                     &tcp->payload_tok))
7906                 return -ENOBUFS;
7907
7908         nla_nest_end(msg, nl_tcp);
7909
7910         return 0;
7911 }
7912
7913 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7914 {
7915         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7916         struct sk_buff *msg;
7917         void *hdr;
7918         u32 size = NLMSG_DEFAULT_SIZE;
7919
7920         if (!rdev->wiphy.wowlan)
7921                 return -EOPNOTSUPP;
7922
7923         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
7924                 /* adjust size to have room for all the data */
7925                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
7926                         rdev->wiphy.wowlan_config->tcp->payload_len +
7927                         rdev->wiphy.wowlan_config->tcp->wake_len +
7928                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
7929         }
7930
7931         msg = nlmsg_new(size, GFP_KERNEL);
7932         if (!msg)
7933                 return -ENOMEM;
7934
7935         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7936                              NL80211_CMD_GET_WOWLAN);
7937         if (!hdr)
7938                 goto nla_put_failure;
7939
7940         if (rdev->wiphy.wowlan_config) {
7941                 struct nlattr *nl_wowlan;
7942
7943                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7944                 if (!nl_wowlan)
7945                         goto nla_put_failure;
7946
7947                 if ((rdev->wiphy.wowlan_config->any &&
7948                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7949                     (rdev->wiphy.wowlan_config->disconnect &&
7950                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7951                     (rdev->wiphy.wowlan_config->magic_pkt &&
7952                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7953                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
7954                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7955                     (rdev->wiphy.wowlan_config->eap_identity_req &&
7956                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7957                     (rdev->wiphy.wowlan_config->four_way_handshake &&
7958                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7959                     (rdev->wiphy.wowlan_config->rfkill_release &&
7960                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7961                         goto nla_put_failure;
7962
7963                 if (nl80211_send_wowlan_patterns(msg, rdev))
7964                         goto nla_put_failure;
7965
7966                 if (nl80211_send_wowlan_tcp(msg,
7967                                             rdev->wiphy.wowlan_config->tcp))
7968                         goto nla_put_failure;
7969
7970                 nla_nest_end(msg, nl_wowlan);
7971         }
7972
7973         genlmsg_end(msg, hdr);
7974         return genlmsg_reply(msg, info);
7975
7976 nla_put_failure:
7977         nlmsg_free(msg);
7978         return -ENOBUFS;
7979 }
7980
7981 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7982                                     struct nlattr *attr,
7983                                     struct cfg80211_wowlan *trig)
7984 {
7985         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7986         struct cfg80211_wowlan_tcp *cfg;
7987         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7988         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7989         u32 size;
7990         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7991         int err, port;
7992
7993         if (!rdev->wiphy.wowlan->tcp)
7994                 return -EINVAL;
7995
7996         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7997                         nla_data(attr), nla_len(attr),
7998                         nl80211_wowlan_tcp_policy);
7999         if (err)
8000                 return err;
8001
8002         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8003             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8004             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8005             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8006             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8007             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8008             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8009             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8010                 return -EINVAL;
8011
8012         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8013         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8014                 return -EINVAL;
8015
8016         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8017                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8018             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8019                 return -EINVAL;
8020
8021         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8022         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8023                 return -EINVAL;
8024
8025         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8026         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8027                 return -EINVAL;
8028
8029         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8030                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8031
8032                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8033                 tokens_size = tokln - sizeof(*tok);
8034
8035                 if (!tok->len || tokens_size % tok->len)
8036                         return -EINVAL;
8037                 if (!rdev->wiphy.wowlan->tcp->tok)
8038                         return -EINVAL;
8039                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8040                         return -EINVAL;
8041                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8042                         return -EINVAL;
8043                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8044                         return -EINVAL;
8045                 if (tok->offset + tok->len > data_size)
8046                         return -EINVAL;
8047         }
8048
8049         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8050                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8051                 if (!rdev->wiphy.wowlan->tcp->seq)
8052                         return -EINVAL;
8053                 if (seq->len == 0 || seq->len > 4)
8054                         return -EINVAL;
8055                 if (seq->len + seq->offset > data_size)
8056                         return -EINVAL;
8057         }
8058
8059         size = sizeof(*cfg);
8060         size += data_size;
8061         size += wake_size + wake_mask_size;
8062         size += tokens_size;
8063
8064         cfg = kzalloc(size, GFP_KERNEL);
8065         if (!cfg)
8066                 return -ENOMEM;
8067         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8068         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8069         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8070                ETH_ALEN);
8071         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8072                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8073         else
8074                 port = 0;
8075 #ifdef CONFIG_INET
8076         /* allocate a socket and port for it and use it */
8077         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8078                             IPPROTO_TCP, &cfg->sock, 1);
8079         if (err) {
8080                 kfree(cfg);
8081                 return err;
8082         }
8083         if (inet_csk_get_port(cfg->sock->sk, port)) {
8084                 sock_release(cfg->sock);
8085                 kfree(cfg);
8086                 return -EADDRINUSE;
8087         }
8088         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8089 #else
8090         if (!port) {
8091                 kfree(cfg);
8092                 return -EINVAL;
8093         }
8094         cfg->src_port = port;
8095 #endif
8096
8097         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
8098         cfg->payload_len = data_size;
8099         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
8100         memcpy((void *)cfg->payload,
8101                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
8102                data_size);
8103         if (seq)
8104                 cfg->payload_seq = *seq;
8105         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
8106         cfg->wake_len = wake_size;
8107         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
8108         memcpy((void *)cfg->wake_data,
8109                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
8110                wake_size);
8111         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
8112                          data_size + wake_size;
8113         memcpy((void *)cfg->wake_mask,
8114                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
8115                wake_mask_size);
8116         if (tok) {
8117                 cfg->tokens_size = tokens_size;
8118                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
8119         }
8120
8121         trig->tcp = cfg;
8122
8123         return 0;
8124 }
8125
8126 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
8127 {
8128         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8129         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
8130         struct cfg80211_wowlan new_triggers = {};
8131         struct cfg80211_wowlan *ntrig;
8132         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8133         int err, i;
8134         bool prev_enabled = rdev->wiphy.wowlan_config;
8135
8136         if (!wowlan)
8137                 return -EOPNOTSUPP;
8138
8139         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
8140                 cfg80211_rdev_free_wowlan(rdev);
8141                 rdev->wiphy.wowlan_config = NULL;
8142                 goto set_wakeup;
8143         }
8144
8145         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
8146                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8147                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8148                         nl80211_wowlan_policy);
8149         if (err)
8150                 return err;
8151
8152         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
8153                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
8154                         return -EINVAL;
8155                 new_triggers.any = true;
8156         }
8157
8158         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
8159                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
8160                         return -EINVAL;
8161                 new_triggers.disconnect = true;
8162         }
8163
8164         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
8165                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
8166                         return -EINVAL;
8167                 new_triggers.magic_pkt = true;
8168         }
8169
8170         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
8171                 return -EINVAL;
8172
8173         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
8174                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
8175                         return -EINVAL;
8176                 new_triggers.gtk_rekey_failure = true;
8177         }
8178
8179         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
8180                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
8181                         return -EINVAL;
8182                 new_triggers.eap_identity_req = true;
8183         }
8184
8185         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
8186                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
8187                         return -EINVAL;
8188                 new_triggers.four_way_handshake = true;
8189         }
8190
8191         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
8192                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
8193                         return -EINVAL;
8194                 new_triggers.rfkill_release = true;
8195         }
8196
8197         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
8198                 struct nlattr *pat;
8199                 int n_patterns = 0;
8200                 int rem, pat_len, mask_len, pkt_offset;
8201                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8202
8203                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8204                                     rem)
8205                         n_patterns++;
8206                 if (n_patterns > wowlan->n_patterns)
8207                         return -EINVAL;
8208
8209                 new_triggers.patterns = kcalloc(n_patterns,
8210                                                 sizeof(new_triggers.patterns[0]),
8211                                                 GFP_KERNEL);
8212                 if (!new_triggers.patterns)
8213                         return -ENOMEM;
8214
8215                 new_triggers.n_patterns = n_patterns;
8216                 i = 0;
8217
8218                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8219                                     rem) {
8220                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8221                                   nla_len(pat), NULL);
8222                         err = -EINVAL;
8223                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8224                             !pat_tb[NL80211_PKTPAT_PATTERN])
8225                                 goto error;
8226                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8227                         mask_len = DIV_ROUND_UP(pat_len, 8);
8228                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8229                                 goto error;
8230                         if (pat_len > wowlan->pattern_max_len ||
8231                             pat_len < wowlan->pattern_min_len)
8232                                 goto error;
8233
8234                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8235                                 pkt_offset = 0;
8236                         else
8237                                 pkt_offset = nla_get_u32(
8238                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8239                         if (pkt_offset > wowlan->max_pkt_offset)
8240                                 goto error;
8241                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8242
8243                         new_triggers.patterns[i].mask =
8244                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
8245                         if (!new_triggers.patterns[i].mask) {
8246                                 err = -ENOMEM;
8247                                 goto error;
8248                         }
8249                         new_triggers.patterns[i].pattern =
8250                                 new_triggers.patterns[i].mask + mask_len;
8251                         memcpy(new_triggers.patterns[i].mask,
8252                                nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8253                                mask_len);
8254                         new_triggers.patterns[i].pattern_len = pat_len;
8255                         memcpy(new_triggers.patterns[i].pattern,
8256                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8257                                pat_len);
8258                         i++;
8259                 }
8260         }
8261
8262         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8263                 err = nl80211_parse_wowlan_tcp(
8264                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8265                         &new_triggers);
8266                 if (err)
8267                         goto error;
8268         }
8269
8270         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8271         if (!ntrig) {
8272                 err = -ENOMEM;
8273                 goto error;
8274         }
8275         cfg80211_rdev_free_wowlan(rdev);
8276         rdev->wiphy.wowlan_config = ntrig;
8277
8278  set_wakeup:
8279         if (rdev->ops->set_wakeup &&
8280             prev_enabled != !!rdev->wiphy.wowlan_config)
8281                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8282
8283         return 0;
8284  error:
8285         for (i = 0; i < new_triggers.n_patterns; i++)
8286                 kfree(new_triggers.patterns[i].mask);
8287         kfree(new_triggers.patterns);
8288         if (new_triggers.tcp && new_triggers.tcp->sock)
8289                 sock_release(new_triggers.tcp->sock);
8290         kfree(new_triggers.tcp);
8291         return err;
8292 }
8293 #endif
8294
8295 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
8296                                        struct cfg80211_registered_device *rdev)
8297 {
8298         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
8299         int i, j, pat_len;
8300         struct cfg80211_coalesce_rules *rule;
8301
8302         if (!rdev->coalesce->n_rules)
8303                 return 0;
8304
8305         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
8306         if (!nl_rules)
8307                 return -ENOBUFS;
8308
8309         for (i = 0; i < rdev->coalesce->n_rules; i++) {
8310                 nl_rule = nla_nest_start(msg, i + 1);
8311                 if (!nl_rule)
8312                         return -ENOBUFS;
8313
8314                 rule = &rdev->coalesce->rules[i];
8315                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
8316                                 rule->delay))
8317                         return -ENOBUFS;
8318
8319                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
8320                                 rule->condition))
8321                         return -ENOBUFS;
8322
8323                 nl_pats = nla_nest_start(msg,
8324                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
8325                 if (!nl_pats)
8326                         return -ENOBUFS;
8327
8328                 for (j = 0; j < rule->n_patterns; j++) {
8329                         nl_pat = nla_nest_start(msg, j + 1);
8330                         if (!nl_pat)
8331                                 return -ENOBUFS;
8332                         pat_len = rule->patterns[j].pattern_len;
8333                         if (nla_put(msg, NL80211_PKTPAT_MASK,
8334                                     DIV_ROUND_UP(pat_len, 8),
8335                                     rule->patterns[j].mask) ||
8336                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8337                                     rule->patterns[j].pattern) ||
8338                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8339                                         rule->patterns[j].pkt_offset))
8340                                 return -ENOBUFS;
8341                         nla_nest_end(msg, nl_pat);
8342                 }
8343                 nla_nest_end(msg, nl_pats);
8344                 nla_nest_end(msg, nl_rule);
8345         }
8346         nla_nest_end(msg, nl_rules);
8347
8348         return 0;
8349 }
8350
8351 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
8352 {
8353         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8354         struct sk_buff *msg;
8355         void *hdr;
8356
8357         if (!rdev->wiphy.coalesce)
8358                 return -EOPNOTSUPP;
8359
8360         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8361         if (!msg)
8362                 return -ENOMEM;
8363
8364         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8365                              NL80211_CMD_GET_COALESCE);
8366         if (!hdr)
8367                 goto nla_put_failure;
8368
8369         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
8370                 goto nla_put_failure;
8371
8372         genlmsg_end(msg, hdr);
8373         return genlmsg_reply(msg, info);
8374
8375 nla_put_failure:
8376         nlmsg_free(msg);
8377         return -ENOBUFS;
8378 }
8379
8380 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
8381 {
8382         struct cfg80211_coalesce *coalesce = rdev->coalesce;
8383         int i, j;
8384         struct cfg80211_coalesce_rules *rule;
8385
8386         if (!coalesce)
8387                 return;
8388
8389         for (i = 0; i < coalesce->n_rules; i++) {
8390                 rule = &coalesce->rules[i];
8391                 for (j = 0; j < rule->n_patterns; j++)
8392                         kfree(rule->patterns[j].mask);
8393                 kfree(rule->patterns);
8394         }
8395         kfree(coalesce->rules);
8396         kfree(coalesce);
8397         rdev->coalesce = NULL;
8398 }
8399
8400 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
8401                                        struct nlattr *rule,
8402                                        struct cfg80211_coalesce_rules *new_rule)
8403 {
8404         int err, i;
8405         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8406         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
8407         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
8408         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8409
8410         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
8411                         nla_len(rule), nl80211_coalesce_policy);
8412         if (err)
8413                 return err;
8414
8415         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
8416                 new_rule->delay =
8417                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
8418         if (new_rule->delay > coalesce->max_delay)
8419                 return -EINVAL;
8420
8421         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
8422                 new_rule->condition =
8423                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
8424         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
8425             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
8426                 return -EINVAL;
8427
8428         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
8429                 return -EINVAL;
8430
8431         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8432                             rem)
8433                 n_patterns++;
8434         if (n_patterns > coalesce->n_patterns)
8435                 return -EINVAL;
8436
8437         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
8438                                      GFP_KERNEL);
8439         if (!new_rule->patterns)
8440                 return -ENOMEM;
8441
8442         new_rule->n_patterns = n_patterns;
8443         i = 0;
8444
8445         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8446                             rem) {
8447                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8448                           nla_len(pat), NULL);
8449                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
8450                     !pat_tb[NL80211_PKTPAT_PATTERN])
8451                         return -EINVAL;
8452                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8453                 mask_len = DIV_ROUND_UP(pat_len, 8);
8454                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8455                         return -EINVAL;
8456                 if (pat_len > coalesce->pattern_max_len ||
8457                     pat_len < coalesce->pattern_min_len)
8458                         return -EINVAL;
8459
8460                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
8461                         pkt_offset = 0;
8462                 else
8463                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
8464                 if (pkt_offset > coalesce->max_pkt_offset)
8465                         return -EINVAL;
8466                 new_rule->patterns[i].pkt_offset = pkt_offset;
8467
8468                 new_rule->patterns[i].mask =
8469                         kmalloc(mask_len + pat_len, GFP_KERNEL);
8470                 if (!new_rule->patterns[i].mask)
8471                         return -ENOMEM;
8472                 new_rule->patterns[i].pattern =
8473                         new_rule->patterns[i].mask + mask_len;
8474                 memcpy(new_rule->patterns[i].mask,
8475                        nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
8476                 new_rule->patterns[i].pattern_len = pat_len;
8477                 memcpy(new_rule->patterns[i].pattern,
8478                        nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
8479                 i++;
8480         }
8481
8482         return 0;
8483 }
8484
8485 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
8486 {
8487         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8488         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8489         struct cfg80211_coalesce new_coalesce = {};
8490         struct cfg80211_coalesce *n_coalesce;
8491         int err, rem_rule, n_rules = 0, i, j;
8492         struct nlattr *rule;
8493         struct cfg80211_coalesce_rules *tmp_rule;
8494
8495         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
8496                 return -EOPNOTSUPP;
8497
8498         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
8499                 cfg80211_rdev_free_coalesce(rdev);
8500                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
8501                 return 0;
8502         }
8503
8504         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8505                             rem_rule)
8506                 n_rules++;
8507         if (n_rules > coalesce->n_rules)
8508                 return -EINVAL;
8509
8510         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
8511                                      GFP_KERNEL);
8512         if (!new_coalesce.rules)
8513                 return -ENOMEM;
8514
8515         new_coalesce.n_rules = n_rules;
8516         i = 0;
8517
8518         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8519                             rem_rule) {
8520                 err = nl80211_parse_coalesce_rule(rdev, rule,
8521                                                   &new_coalesce.rules[i]);
8522                 if (err)
8523                         goto error;
8524
8525                 i++;
8526         }
8527
8528         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
8529         if (err)
8530                 goto error;
8531
8532         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
8533         if (!n_coalesce) {
8534                 err = -ENOMEM;
8535                 goto error;
8536         }
8537         cfg80211_rdev_free_coalesce(rdev);
8538         rdev->coalesce = n_coalesce;
8539
8540         return 0;
8541 error:
8542         for (i = 0; i < new_coalesce.n_rules; i++) {
8543                 tmp_rule = &new_coalesce.rules[i];
8544                 for (j = 0; j < tmp_rule->n_patterns; j++)
8545                         kfree(tmp_rule->patterns[j].mask);
8546                 kfree(tmp_rule->patterns);
8547         }
8548         kfree(new_coalesce.rules);
8549
8550         return err;
8551 }
8552
8553 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8554 {
8555         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8556         struct net_device *dev = info->user_ptr[1];
8557         struct wireless_dev *wdev = dev->ieee80211_ptr;
8558         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8559         struct cfg80211_gtk_rekey_data rekey_data;
8560         int err;
8561
8562         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8563                 return -EINVAL;
8564
8565         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8566                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8567                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8568                         nl80211_rekey_policy);
8569         if (err)
8570                 return err;
8571
8572         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8573                 return -ERANGE;
8574         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8575                 return -ERANGE;
8576         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8577                 return -ERANGE;
8578
8579         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8580                NL80211_KEK_LEN);
8581         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8582                NL80211_KCK_LEN);
8583         memcpy(rekey_data.replay_ctr,
8584                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8585                NL80211_REPLAY_CTR_LEN);
8586
8587         wdev_lock(wdev);
8588         if (!wdev->current_bss) {
8589                 err = -ENOTCONN;
8590                 goto out;
8591         }
8592
8593         if (!rdev->ops->set_rekey_data) {
8594                 err = -EOPNOTSUPP;
8595                 goto out;
8596         }
8597
8598         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8599  out:
8600         wdev_unlock(wdev);
8601         return err;
8602 }
8603
8604 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8605                                              struct genl_info *info)
8606 {
8607         struct net_device *dev = info->user_ptr[1];
8608         struct wireless_dev *wdev = dev->ieee80211_ptr;
8609
8610         if (wdev->iftype != NL80211_IFTYPE_AP &&
8611             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8612                 return -EINVAL;
8613
8614         if (wdev->ap_unexpected_nlportid)
8615                 return -EBUSY;
8616
8617         wdev->ap_unexpected_nlportid = info->snd_portid;
8618         return 0;
8619 }
8620
8621 static int nl80211_probe_client(struct sk_buff *skb,
8622                                 struct genl_info *info)
8623 {
8624         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8625         struct net_device *dev = info->user_ptr[1];
8626         struct wireless_dev *wdev = dev->ieee80211_ptr;
8627         struct sk_buff *msg;
8628         void *hdr;
8629         const u8 *addr;
8630         u64 cookie;
8631         int err;
8632
8633         if (wdev->iftype != NL80211_IFTYPE_AP &&
8634             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8635                 return -EOPNOTSUPP;
8636
8637         if (!info->attrs[NL80211_ATTR_MAC])
8638                 return -EINVAL;
8639
8640         if (!rdev->ops->probe_client)
8641                 return -EOPNOTSUPP;
8642
8643         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8644         if (!msg)
8645                 return -ENOMEM;
8646
8647         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8648                              NL80211_CMD_PROBE_CLIENT);
8649         if (!hdr) {
8650                 err = -ENOBUFS;
8651                 goto free_msg;
8652         }
8653
8654         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8655
8656         err = rdev_probe_client(rdev, dev, addr, &cookie);
8657         if (err)
8658                 goto free_msg;
8659
8660         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8661                 goto nla_put_failure;
8662
8663         genlmsg_end(msg, hdr);
8664
8665         return genlmsg_reply(msg, info);
8666
8667  nla_put_failure:
8668         err = -ENOBUFS;
8669  free_msg:
8670         nlmsg_free(msg);
8671         return err;
8672 }
8673
8674 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8675 {
8676         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8677         struct cfg80211_beacon_registration *reg, *nreg;
8678         int rv;
8679
8680         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8681                 return -EOPNOTSUPP;
8682
8683         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8684         if (!nreg)
8685                 return -ENOMEM;
8686
8687         /* First, check if already registered. */
8688         spin_lock_bh(&rdev->beacon_registrations_lock);
8689         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8690                 if (reg->nlportid == info->snd_portid) {
8691                         rv = -EALREADY;
8692                         goto out_err;
8693                 }
8694         }
8695         /* Add it to the list */
8696         nreg->nlportid = info->snd_portid;
8697         list_add(&nreg->list, &rdev->beacon_registrations);
8698
8699         spin_unlock_bh(&rdev->beacon_registrations_lock);
8700
8701         return 0;
8702 out_err:
8703         spin_unlock_bh(&rdev->beacon_registrations_lock);
8704         kfree(nreg);
8705         return rv;
8706 }
8707
8708 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8709 {
8710         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8711         struct wireless_dev *wdev = info->user_ptr[1];
8712         int err;
8713
8714         if (!rdev->ops->start_p2p_device)
8715                 return -EOPNOTSUPP;
8716
8717         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8718                 return -EOPNOTSUPP;
8719
8720         if (wdev->p2p_started)
8721                 return 0;
8722
8723         err = cfg80211_can_add_interface(rdev, wdev->iftype);
8724         if (err)
8725                 return err;
8726
8727         err = rdev_start_p2p_device(rdev, wdev);
8728         if (err)
8729                 return err;
8730
8731         wdev->p2p_started = true;
8732         rdev->opencount++;
8733
8734         return 0;
8735 }
8736
8737 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8738 {
8739         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8740         struct wireless_dev *wdev = info->user_ptr[1];
8741
8742         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8743                 return -EOPNOTSUPP;
8744
8745         if (!rdev->ops->stop_p2p_device)
8746                 return -EOPNOTSUPP;
8747
8748         cfg80211_stop_p2p_device(rdev, wdev);
8749
8750         return 0;
8751 }
8752
8753 static int nl80211_get_protocol_features(struct sk_buff *skb,
8754                                          struct genl_info *info)
8755 {
8756         void *hdr;
8757         struct sk_buff *msg;
8758
8759         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8760         if (!msg)
8761                 return -ENOMEM;
8762
8763         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8764                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8765         if (!hdr)
8766                 goto nla_put_failure;
8767
8768         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8769                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8770                 goto nla_put_failure;
8771
8772         genlmsg_end(msg, hdr);
8773         return genlmsg_reply(msg, info);
8774
8775  nla_put_failure:
8776         kfree_skb(msg);
8777         return -ENOBUFS;
8778 }
8779
8780 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
8781 {
8782         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8783         struct cfg80211_update_ft_ies_params ft_params;
8784         struct net_device *dev = info->user_ptr[1];
8785
8786         if (!rdev->ops->update_ft_ies)
8787                 return -EOPNOTSUPP;
8788
8789         if (!info->attrs[NL80211_ATTR_MDID] ||
8790             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8791                 return -EINVAL;
8792
8793         memset(&ft_params, 0, sizeof(ft_params));
8794         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
8795         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8796         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8797
8798         return rdev_update_ft_ies(rdev, dev, &ft_params);
8799 }
8800
8801 static int nl80211_crit_protocol_start(struct sk_buff *skb,
8802                                        struct genl_info *info)
8803 {
8804         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8805         struct wireless_dev *wdev = info->user_ptr[1];
8806         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
8807         u16 duration;
8808         int ret;
8809
8810         if (!rdev->ops->crit_proto_start)
8811                 return -EOPNOTSUPP;
8812
8813         if (WARN_ON(!rdev->ops->crit_proto_stop))
8814                 return -EINVAL;
8815
8816         if (rdev->crit_proto_nlportid)
8817                 return -EBUSY;
8818
8819         /* determine protocol if provided */
8820         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
8821                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
8822
8823         if (proto >= NUM_NL80211_CRIT_PROTO)
8824                 return -EINVAL;
8825
8826         /* timeout must be provided */
8827         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
8828                 return -EINVAL;
8829
8830         duration =
8831                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
8832
8833         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
8834                 return -ERANGE;
8835
8836         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
8837         if (!ret)
8838                 rdev->crit_proto_nlportid = info->snd_portid;
8839
8840         return ret;
8841 }
8842
8843 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
8844                                       struct genl_info *info)
8845 {
8846         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8847         struct wireless_dev *wdev = info->user_ptr[1];
8848
8849         if (!rdev->ops->crit_proto_stop)
8850                 return -EOPNOTSUPP;
8851
8852         if (rdev->crit_proto_nlportid) {
8853                 rdev->crit_proto_nlportid = 0;
8854                 rdev_crit_proto_stop(rdev, wdev);
8855         }
8856         return 0;
8857 }
8858
8859 #define NL80211_FLAG_NEED_WIPHY         0x01
8860 #define NL80211_FLAG_NEED_NETDEV        0x02
8861 #define NL80211_FLAG_NEED_RTNL          0x04
8862 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
8863 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
8864                                          NL80211_FLAG_CHECK_NETDEV_UP)
8865 #define NL80211_FLAG_NEED_WDEV          0x10
8866 /* If a netdev is associated, it must be UP, P2P must be started */
8867 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
8868                                          NL80211_FLAG_CHECK_NETDEV_UP)
8869
8870 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
8871                             struct genl_info *info)
8872 {
8873         struct cfg80211_registered_device *rdev;
8874         struct wireless_dev *wdev;
8875         struct net_device *dev;
8876         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
8877
8878         if (rtnl)
8879                 rtnl_lock();
8880
8881         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
8882                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8883                 if (IS_ERR(rdev)) {
8884                         if (rtnl)
8885                                 rtnl_unlock();
8886                         return PTR_ERR(rdev);
8887                 }
8888                 info->user_ptr[0] = rdev;
8889         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
8890                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8891                 ASSERT_RTNL();
8892
8893                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
8894                                                   info->attrs);
8895                 if (IS_ERR(wdev)) {
8896                         if (rtnl)
8897                                 rtnl_unlock();
8898                         return PTR_ERR(wdev);
8899                 }
8900
8901                 dev = wdev->netdev;
8902                 rdev = wiphy_to_dev(wdev->wiphy);
8903
8904                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
8905                         if (!dev) {
8906                                 if (rtnl)
8907                                         rtnl_unlock();
8908                                 return -EINVAL;
8909                         }
8910
8911                         info->user_ptr[1] = dev;
8912                 } else {
8913                         info->user_ptr[1] = wdev;
8914                 }
8915
8916                 if (dev) {
8917                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
8918                             !netif_running(dev)) {
8919                                 if (rtnl)
8920                                         rtnl_unlock();
8921                                 return -ENETDOWN;
8922                         }
8923
8924                         dev_hold(dev);
8925                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
8926                         if (!wdev->p2p_started) {
8927                                 if (rtnl)
8928                                         rtnl_unlock();
8929                                 return -ENETDOWN;
8930                         }
8931                 }
8932
8933                 info->user_ptr[0] = rdev;
8934         }
8935
8936         return 0;
8937 }
8938
8939 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
8940                               struct genl_info *info)
8941 {
8942         if (info->user_ptr[1]) {
8943                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8944                         struct wireless_dev *wdev = info->user_ptr[1];
8945
8946                         if (wdev->netdev)
8947                                 dev_put(wdev->netdev);
8948                 } else {
8949                         dev_put(info->user_ptr[1]);
8950                 }
8951         }
8952         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
8953                 rtnl_unlock();
8954 }
8955
8956 static struct genl_ops nl80211_ops[] = {
8957         {
8958                 .cmd = NL80211_CMD_GET_WIPHY,
8959                 .doit = nl80211_get_wiphy,
8960                 .dumpit = nl80211_dump_wiphy,
8961                 .done = nl80211_dump_wiphy_done,
8962                 .policy = nl80211_policy,
8963                 /* can be retrieved by unprivileged users */
8964                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8965                                   NL80211_FLAG_NEED_RTNL,
8966         },
8967         {
8968                 .cmd = NL80211_CMD_SET_WIPHY,
8969                 .doit = nl80211_set_wiphy,
8970                 .policy = nl80211_policy,
8971                 .flags = GENL_ADMIN_PERM,
8972                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8973         },
8974         {
8975                 .cmd = NL80211_CMD_GET_INTERFACE,
8976                 .doit = nl80211_get_interface,
8977                 .dumpit = nl80211_dump_interface,
8978                 .policy = nl80211_policy,
8979                 /* can be retrieved by unprivileged users */
8980                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8981                                   NL80211_FLAG_NEED_RTNL,
8982         },
8983         {
8984                 .cmd = NL80211_CMD_SET_INTERFACE,
8985                 .doit = nl80211_set_interface,
8986                 .policy = nl80211_policy,
8987                 .flags = GENL_ADMIN_PERM,
8988                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8989                                   NL80211_FLAG_NEED_RTNL,
8990         },
8991         {
8992                 .cmd = NL80211_CMD_NEW_INTERFACE,
8993                 .doit = nl80211_new_interface,
8994                 .policy = nl80211_policy,
8995                 .flags = GENL_ADMIN_PERM,
8996                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8997                                   NL80211_FLAG_NEED_RTNL,
8998         },
8999         {
9000                 .cmd = NL80211_CMD_DEL_INTERFACE,
9001                 .doit = nl80211_del_interface,
9002                 .policy = nl80211_policy,
9003                 .flags = GENL_ADMIN_PERM,
9004                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9005                                   NL80211_FLAG_NEED_RTNL,
9006         },
9007         {
9008                 .cmd = NL80211_CMD_GET_KEY,
9009                 .doit = nl80211_get_key,
9010                 .policy = nl80211_policy,
9011                 .flags = GENL_ADMIN_PERM,
9012                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9013                                   NL80211_FLAG_NEED_RTNL,
9014         },
9015         {
9016                 .cmd = NL80211_CMD_SET_KEY,
9017                 .doit = nl80211_set_key,
9018                 .policy = nl80211_policy,
9019                 .flags = GENL_ADMIN_PERM,
9020                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9021                                   NL80211_FLAG_NEED_RTNL,
9022         },
9023         {
9024                 .cmd = NL80211_CMD_NEW_KEY,
9025                 .doit = nl80211_new_key,
9026                 .policy = nl80211_policy,
9027                 .flags = GENL_ADMIN_PERM,
9028                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9029                                   NL80211_FLAG_NEED_RTNL,
9030         },
9031         {
9032                 .cmd = NL80211_CMD_DEL_KEY,
9033                 .doit = nl80211_del_key,
9034                 .policy = nl80211_policy,
9035                 .flags = GENL_ADMIN_PERM,
9036                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9037                                   NL80211_FLAG_NEED_RTNL,
9038         },
9039         {
9040                 .cmd = NL80211_CMD_SET_BEACON,
9041                 .policy = nl80211_policy,
9042                 .flags = GENL_ADMIN_PERM,
9043                 .doit = nl80211_set_beacon,
9044                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9045                                   NL80211_FLAG_NEED_RTNL,
9046         },
9047         {
9048                 .cmd = NL80211_CMD_START_AP,
9049                 .policy = nl80211_policy,
9050                 .flags = GENL_ADMIN_PERM,
9051                 .doit = nl80211_start_ap,
9052                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9053                                   NL80211_FLAG_NEED_RTNL,
9054         },
9055         {
9056                 .cmd = NL80211_CMD_STOP_AP,
9057                 .policy = nl80211_policy,
9058                 .flags = GENL_ADMIN_PERM,
9059                 .doit = nl80211_stop_ap,
9060                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9061                                   NL80211_FLAG_NEED_RTNL,
9062         },
9063         {
9064                 .cmd = NL80211_CMD_GET_STATION,
9065                 .doit = nl80211_get_station,
9066                 .dumpit = nl80211_dump_station,
9067                 .policy = nl80211_policy,
9068                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9069                                   NL80211_FLAG_NEED_RTNL,
9070         },
9071         {
9072                 .cmd = NL80211_CMD_SET_STATION,
9073                 .doit = nl80211_set_station,
9074                 .policy = nl80211_policy,
9075                 .flags = GENL_ADMIN_PERM,
9076                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9077                                   NL80211_FLAG_NEED_RTNL,
9078         },
9079         {
9080                 .cmd = NL80211_CMD_NEW_STATION,
9081                 .doit = nl80211_new_station,
9082                 .policy = nl80211_policy,
9083                 .flags = GENL_ADMIN_PERM,
9084                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9085                                   NL80211_FLAG_NEED_RTNL,
9086         },
9087         {
9088                 .cmd = NL80211_CMD_DEL_STATION,
9089                 .doit = nl80211_del_station,
9090                 .policy = nl80211_policy,
9091                 .flags = GENL_ADMIN_PERM,
9092                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9093                                   NL80211_FLAG_NEED_RTNL,
9094         },
9095         {
9096                 .cmd = NL80211_CMD_GET_MPATH,
9097                 .doit = nl80211_get_mpath,
9098                 .dumpit = nl80211_dump_mpath,
9099                 .policy = nl80211_policy,
9100                 .flags = GENL_ADMIN_PERM,
9101                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9102                                   NL80211_FLAG_NEED_RTNL,
9103         },
9104         {
9105                 .cmd = NL80211_CMD_SET_MPATH,
9106                 .doit = nl80211_set_mpath,
9107                 .policy = nl80211_policy,
9108                 .flags = GENL_ADMIN_PERM,
9109                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9110                                   NL80211_FLAG_NEED_RTNL,
9111         },
9112         {
9113                 .cmd = NL80211_CMD_NEW_MPATH,
9114                 .doit = nl80211_new_mpath,
9115                 .policy = nl80211_policy,
9116                 .flags = GENL_ADMIN_PERM,
9117                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9118                                   NL80211_FLAG_NEED_RTNL,
9119         },
9120         {
9121                 .cmd = NL80211_CMD_DEL_MPATH,
9122                 .doit = nl80211_del_mpath,
9123                 .policy = nl80211_policy,
9124                 .flags = GENL_ADMIN_PERM,
9125                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9126                                   NL80211_FLAG_NEED_RTNL,
9127         },
9128         {
9129                 .cmd = NL80211_CMD_SET_BSS,
9130                 .doit = nl80211_set_bss,
9131                 .policy = nl80211_policy,
9132                 .flags = GENL_ADMIN_PERM,
9133                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9134                                   NL80211_FLAG_NEED_RTNL,
9135         },
9136         {
9137                 .cmd = NL80211_CMD_GET_REG,
9138                 .doit = nl80211_get_reg,
9139                 .policy = nl80211_policy,
9140                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9141                 /* can be retrieved by unprivileged users */
9142         },
9143         {
9144                 .cmd = NL80211_CMD_SET_REG,
9145                 .doit = nl80211_set_reg,
9146                 .policy = nl80211_policy,
9147                 .flags = GENL_ADMIN_PERM,
9148                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9149         },
9150         {
9151                 .cmd = NL80211_CMD_REQ_SET_REG,
9152                 .doit = nl80211_req_set_reg,
9153                 .policy = nl80211_policy,
9154                 .flags = GENL_ADMIN_PERM,
9155         },
9156         {
9157                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
9158                 .doit = nl80211_get_mesh_config,
9159                 .policy = nl80211_policy,
9160                 /* can be retrieved by unprivileged users */
9161                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9162                                   NL80211_FLAG_NEED_RTNL,
9163         },
9164         {
9165                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
9166                 .doit = nl80211_update_mesh_config,
9167                 .policy = nl80211_policy,
9168                 .flags = GENL_ADMIN_PERM,
9169                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9170                                   NL80211_FLAG_NEED_RTNL,
9171         },
9172         {
9173                 .cmd = NL80211_CMD_TRIGGER_SCAN,
9174                 .doit = nl80211_trigger_scan,
9175                 .policy = nl80211_policy,
9176                 .flags = GENL_ADMIN_PERM,
9177                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9178                                   NL80211_FLAG_NEED_RTNL,
9179         },
9180         {
9181                 .cmd = NL80211_CMD_GET_SCAN,
9182                 .policy = nl80211_policy,
9183                 .dumpit = nl80211_dump_scan,
9184         },
9185         {
9186                 .cmd = NL80211_CMD_START_SCHED_SCAN,
9187                 .doit = nl80211_start_sched_scan,
9188                 .policy = nl80211_policy,
9189                 .flags = GENL_ADMIN_PERM,
9190                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9191                                   NL80211_FLAG_NEED_RTNL,
9192         },
9193         {
9194                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
9195                 .doit = nl80211_stop_sched_scan,
9196                 .policy = nl80211_policy,
9197                 .flags = GENL_ADMIN_PERM,
9198                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9199                                   NL80211_FLAG_NEED_RTNL,
9200         },
9201         {
9202                 .cmd = NL80211_CMD_AUTHENTICATE,
9203                 .doit = nl80211_authenticate,
9204                 .policy = nl80211_policy,
9205                 .flags = GENL_ADMIN_PERM,
9206                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9207                                   NL80211_FLAG_NEED_RTNL,
9208         },
9209         {
9210                 .cmd = NL80211_CMD_ASSOCIATE,
9211                 .doit = nl80211_associate,
9212                 .policy = nl80211_policy,
9213                 .flags = GENL_ADMIN_PERM,
9214                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9215                                   NL80211_FLAG_NEED_RTNL,
9216         },
9217         {
9218                 .cmd = NL80211_CMD_DEAUTHENTICATE,
9219                 .doit = nl80211_deauthenticate,
9220                 .policy = nl80211_policy,
9221                 .flags = GENL_ADMIN_PERM,
9222                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9223                                   NL80211_FLAG_NEED_RTNL,
9224         },
9225         {
9226                 .cmd = NL80211_CMD_DISASSOCIATE,
9227                 .doit = nl80211_disassociate,
9228                 .policy = nl80211_policy,
9229                 .flags = GENL_ADMIN_PERM,
9230                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9231                                   NL80211_FLAG_NEED_RTNL,
9232         },
9233         {
9234                 .cmd = NL80211_CMD_JOIN_IBSS,
9235                 .doit = nl80211_join_ibss,
9236                 .policy = nl80211_policy,
9237                 .flags = GENL_ADMIN_PERM,
9238                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9239                                   NL80211_FLAG_NEED_RTNL,
9240         },
9241         {
9242                 .cmd = NL80211_CMD_LEAVE_IBSS,
9243                 .doit = nl80211_leave_ibss,
9244                 .policy = nl80211_policy,
9245                 .flags = GENL_ADMIN_PERM,
9246                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9247                                   NL80211_FLAG_NEED_RTNL,
9248         },
9249 #ifdef CONFIG_NL80211_TESTMODE
9250         {
9251                 .cmd = NL80211_CMD_TESTMODE,
9252                 .doit = nl80211_testmode_do,
9253                 .dumpit = nl80211_testmode_dump,
9254                 .policy = nl80211_policy,
9255                 .flags = GENL_ADMIN_PERM,
9256                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9257                                   NL80211_FLAG_NEED_RTNL,
9258         },
9259 #endif
9260         {
9261                 .cmd = NL80211_CMD_CONNECT,
9262                 .doit = nl80211_connect,
9263                 .policy = nl80211_policy,
9264                 .flags = GENL_ADMIN_PERM,
9265                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9266                                   NL80211_FLAG_NEED_RTNL,
9267         },
9268         {
9269                 .cmd = NL80211_CMD_DISCONNECT,
9270                 .doit = nl80211_disconnect,
9271                 .policy = nl80211_policy,
9272                 .flags = GENL_ADMIN_PERM,
9273                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9274                                   NL80211_FLAG_NEED_RTNL,
9275         },
9276         {
9277                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
9278                 .doit = nl80211_wiphy_netns,
9279                 .policy = nl80211_policy,
9280                 .flags = GENL_ADMIN_PERM,
9281                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9282                                   NL80211_FLAG_NEED_RTNL,
9283         },
9284         {
9285                 .cmd = NL80211_CMD_GET_SURVEY,
9286                 .policy = nl80211_policy,
9287                 .dumpit = nl80211_dump_survey,
9288         },
9289         {
9290                 .cmd = NL80211_CMD_SET_PMKSA,
9291                 .doit = nl80211_setdel_pmksa,
9292                 .policy = nl80211_policy,
9293                 .flags = GENL_ADMIN_PERM,
9294                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9295                                   NL80211_FLAG_NEED_RTNL,
9296         },
9297         {
9298                 .cmd = NL80211_CMD_DEL_PMKSA,
9299                 .doit = nl80211_setdel_pmksa,
9300                 .policy = nl80211_policy,
9301                 .flags = GENL_ADMIN_PERM,
9302                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9303                                   NL80211_FLAG_NEED_RTNL,
9304         },
9305         {
9306                 .cmd = NL80211_CMD_FLUSH_PMKSA,
9307                 .doit = nl80211_flush_pmksa,
9308                 .policy = nl80211_policy,
9309                 .flags = GENL_ADMIN_PERM,
9310                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9311                                   NL80211_FLAG_NEED_RTNL,
9312         },
9313         {
9314                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
9315                 .doit = nl80211_remain_on_channel,
9316                 .policy = nl80211_policy,
9317                 .flags = GENL_ADMIN_PERM,
9318                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9319                                   NL80211_FLAG_NEED_RTNL,
9320         },
9321         {
9322                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9323                 .doit = nl80211_cancel_remain_on_channel,
9324                 .policy = nl80211_policy,
9325                 .flags = GENL_ADMIN_PERM,
9326                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9327                                   NL80211_FLAG_NEED_RTNL,
9328         },
9329         {
9330                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
9331                 .doit = nl80211_set_tx_bitrate_mask,
9332                 .policy = nl80211_policy,
9333                 .flags = GENL_ADMIN_PERM,
9334                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9335                                   NL80211_FLAG_NEED_RTNL,
9336         },
9337         {
9338                 .cmd = NL80211_CMD_REGISTER_FRAME,
9339                 .doit = nl80211_register_mgmt,
9340                 .policy = nl80211_policy,
9341                 .flags = GENL_ADMIN_PERM,
9342                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9343                                   NL80211_FLAG_NEED_RTNL,
9344         },
9345         {
9346                 .cmd = NL80211_CMD_FRAME,
9347                 .doit = nl80211_tx_mgmt,
9348                 .policy = nl80211_policy,
9349                 .flags = GENL_ADMIN_PERM,
9350                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9351                                   NL80211_FLAG_NEED_RTNL,
9352         },
9353         {
9354                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
9355                 .doit = nl80211_tx_mgmt_cancel_wait,
9356                 .policy = nl80211_policy,
9357                 .flags = GENL_ADMIN_PERM,
9358                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9359                                   NL80211_FLAG_NEED_RTNL,
9360         },
9361         {
9362                 .cmd = NL80211_CMD_SET_POWER_SAVE,
9363                 .doit = nl80211_set_power_save,
9364                 .policy = nl80211_policy,
9365                 .flags = GENL_ADMIN_PERM,
9366                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9367                                   NL80211_FLAG_NEED_RTNL,
9368         },
9369         {
9370                 .cmd = NL80211_CMD_GET_POWER_SAVE,
9371                 .doit = nl80211_get_power_save,
9372                 .policy = nl80211_policy,
9373                 /* can be retrieved by unprivileged users */
9374                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9375                                   NL80211_FLAG_NEED_RTNL,
9376         },
9377         {
9378                 .cmd = NL80211_CMD_SET_CQM,
9379                 .doit = nl80211_set_cqm,
9380                 .policy = nl80211_policy,
9381                 .flags = GENL_ADMIN_PERM,
9382                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9383                                   NL80211_FLAG_NEED_RTNL,
9384         },
9385         {
9386                 .cmd = NL80211_CMD_SET_CHANNEL,
9387                 .doit = nl80211_set_channel,
9388                 .policy = nl80211_policy,
9389                 .flags = GENL_ADMIN_PERM,
9390                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9391                                   NL80211_FLAG_NEED_RTNL,
9392         },
9393         {
9394                 .cmd = NL80211_CMD_SET_WDS_PEER,
9395                 .doit = nl80211_set_wds_peer,
9396                 .policy = nl80211_policy,
9397                 .flags = GENL_ADMIN_PERM,
9398                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9399                                   NL80211_FLAG_NEED_RTNL,
9400         },
9401         {
9402                 .cmd = NL80211_CMD_JOIN_MESH,
9403                 .doit = nl80211_join_mesh,
9404                 .policy = nl80211_policy,
9405                 .flags = GENL_ADMIN_PERM,
9406                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9407                                   NL80211_FLAG_NEED_RTNL,
9408         },
9409         {
9410                 .cmd = NL80211_CMD_LEAVE_MESH,
9411                 .doit = nl80211_leave_mesh,
9412                 .policy = nl80211_policy,
9413                 .flags = GENL_ADMIN_PERM,
9414                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9415                                   NL80211_FLAG_NEED_RTNL,
9416         },
9417 #ifdef CONFIG_PM
9418         {
9419                 .cmd = NL80211_CMD_GET_WOWLAN,
9420                 .doit = nl80211_get_wowlan,
9421                 .policy = nl80211_policy,
9422                 /* can be retrieved by unprivileged users */
9423                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9424                                   NL80211_FLAG_NEED_RTNL,
9425         },
9426         {
9427                 .cmd = NL80211_CMD_SET_WOWLAN,
9428                 .doit = nl80211_set_wowlan,
9429                 .policy = nl80211_policy,
9430                 .flags = GENL_ADMIN_PERM,
9431                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9432                                   NL80211_FLAG_NEED_RTNL,
9433         },
9434 #endif
9435         {
9436                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
9437                 .doit = nl80211_set_rekey_data,
9438                 .policy = nl80211_policy,
9439                 .flags = GENL_ADMIN_PERM,
9440                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9441                                   NL80211_FLAG_NEED_RTNL,
9442         },
9443         {
9444                 .cmd = NL80211_CMD_TDLS_MGMT,
9445                 .doit = nl80211_tdls_mgmt,
9446                 .policy = nl80211_policy,
9447                 .flags = GENL_ADMIN_PERM,
9448                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9449                                   NL80211_FLAG_NEED_RTNL,
9450         },
9451         {
9452                 .cmd = NL80211_CMD_TDLS_OPER,
9453                 .doit = nl80211_tdls_oper,
9454                 .policy = nl80211_policy,
9455                 .flags = GENL_ADMIN_PERM,
9456                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9457                                   NL80211_FLAG_NEED_RTNL,
9458         },
9459         {
9460                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
9461                 .doit = nl80211_register_unexpected_frame,
9462                 .policy = nl80211_policy,
9463                 .flags = GENL_ADMIN_PERM,
9464                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9465                                   NL80211_FLAG_NEED_RTNL,
9466         },
9467         {
9468                 .cmd = NL80211_CMD_PROBE_CLIENT,
9469                 .doit = nl80211_probe_client,
9470                 .policy = nl80211_policy,
9471                 .flags = GENL_ADMIN_PERM,
9472                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9473                                   NL80211_FLAG_NEED_RTNL,
9474         },
9475         {
9476                 .cmd = NL80211_CMD_REGISTER_BEACONS,
9477                 .doit = nl80211_register_beacons,
9478                 .policy = nl80211_policy,
9479                 .flags = GENL_ADMIN_PERM,
9480                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9481                                   NL80211_FLAG_NEED_RTNL,
9482         },
9483         {
9484                 .cmd = NL80211_CMD_SET_NOACK_MAP,
9485                 .doit = nl80211_set_noack_map,
9486                 .policy = nl80211_policy,
9487                 .flags = GENL_ADMIN_PERM,
9488                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9489                                   NL80211_FLAG_NEED_RTNL,
9490         },
9491         {
9492                 .cmd = NL80211_CMD_START_P2P_DEVICE,
9493                 .doit = nl80211_start_p2p_device,
9494                 .policy = nl80211_policy,
9495                 .flags = GENL_ADMIN_PERM,
9496                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9497                                   NL80211_FLAG_NEED_RTNL,
9498         },
9499         {
9500                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
9501                 .doit = nl80211_stop_p2p_device,
9502                 .policy = nl80211_policy,
9503                 .flags = GENL_ADMIN_PERM,
9504                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9505                                   NL80211_FLAG_NEED_RTNL,
9506         },
9507         {
9508                 .cmd = NL80211_CMD_SET_MCAST_RATE,
9509                 .doit = nl80211_set_mcast_rate,
9510                 .policy = nl80211_policy,
9511                 .flags = GENL_ADMIN_PERM,
9512                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9513                                   NL80211_FLAG_NEED_RTNL,
9514         },
9515         {
9516                 .cmd = NL80211_CMD_SET_MAC_ACL,
9517                 .doit = nl80211_set_mac_acl,
9518                 .policy = nl80211_policy,
9519                 .flags = GENL_ADMIN_PERM,
9520                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9521                                   NL80211_FLAG_NEED_RTNL,
9522         },
9523         {
9524                 .cmd = NL80211_CMD_RADAR_DETECT,
9525                 .doit = nl80211_start_radar_detection,
9526                 .policy = nl80211_policy,
9527                 .flags = GENL_ADMIN_PERM,
9528                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9529                                   NL80211_FLAG_NEED_RTNL,
9530         },
9531         {
9532                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
9533                 .doit = nl80211_get_protocol_features,
9534                 .policy = nl80211_policy,
9535         },
9536         {
9537                 .cmd = NL80211_CMD_UPDATE_FT_IES,
9538                 .doit = nl80211_update_ft_ies,
9539                 .policy = nl80211_policy,
9540                 .flags = GENL_ADMIN_PERM,
9541                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9542                                   NL80211_FLAG_NEED_RTNL,
9543         },
9544         {
9545                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
9546                 .doit = nl80211_crit_protocol_start,
9547                 .policy = nl80211_policy,
9548                 .flags = GENL_ADMIN_PERM,
9549                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9550                                   NL80211_FLAG_NEED_RTNL,
9551         },
9552         {
9553                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
9554                 .doit = nl80211_crit_protocol_stop,
9555                 .policy = nl80211_policy,
9556                 .flags = GENL_ADMIN_PERM,
9557                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9558                                   NL80211_FLAG_NEED_RTNL,
9559         },
9560         {
9561                 .cmd = NL80211_CMD_GET_COALESCE,
9562                 .doit = nl80211_get_coalesce,
9563                 .policy = nl80211_policy,
9564                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9565                                   NL80211_FLAG_NEED_RTNL,
9566         },
9567         {
9568                 .cmd = NL80211_CMD_SET_COALESCE,
9569                 .doit = nl80211_set_coalesce,
9570                 .policy = nl80211_policy,
9571                 .flags = GENL_ADMIN_PERM,
9572                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9573                                   NL80211_FLAG_NEED_RTNL,
9574         },
9575         {
9576                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
9577                 .doit = nl80211_channel_switch,
9578                 .policy = nl80211_policy,
9579                 .flags = GENL_ADMIN_PERM,
9580                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9581                                   NL80211_FLAG_NEED_RTNL,
9582         },
9583 };
9584
9585 static struct genl_multicast_group nl80211_mlme_mcgrp = {
9586         .name = "mlme",
9587 };
9588
9589 /* multicast groups */
9590 static struct genl_multicast_group nl80211_config_mcgrp = {
9591         .name = "config",
9592 };
9593 static struct genl_multicast_group nl80211_scan_mcgrp = {
9594         .name = "scan",
9595 };
9596 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
9597         .name = "regulatory",
9598 };
9599
9600 /* notification functions */
9601
9602 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
9603 {
9604         struct sk_buff *msg;
9605         struct nl80211_dump_wiphy_state state = {};
9606
9607         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9608         if (!msg)
9609                 return;
9610
9611         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
9612                 nlmsg_free(msg);
9613                 return;
9614         }
9615
9616         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9617                                 nl80211_config_mcgrp.id, GFP_KERNEL);
9618 }
9619
9620 static int nl80211_add_scan_req(struct sk_buff *msg,
9621                                 struct cfg80211_registered_device *rdev)
9622 {
9623         struct cfg80211_scan_request *req = rdev->scan_req;
9624         struct nlattr *nest;
9625         int i;
9626
9627         if (WARN_ON(!req))
9628                 return 0;
9629
9630         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
9631         if (!nest)
9632                 goto nla_put_failure;
9633         for (i = 0; i < req->n_ssids; i++) {
9634                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
9635                         goto nla_put_failure;
9636         }
9637         nla_nest_end(msg, nest);
9638
9639         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9640         if (!nest)
9641                 goto nla_put_failure;
9642         for (i = 0; i < req->n_channels; i++) {
9643                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9644                         goto nla_put_failure;
9645         }
9646         nla_nest_end(msg, nest);
9647
9648         if (req->ie &&
9649             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
9650                 goto nla_put_failure;
9651
9652         if (req->flags)
9653                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
9654
9655         return 0;
9656  nla_put_failure:
9657         return -ENOBUFS;
9658 }
9659
9660 static int nl80211_send_scan_msg(struct sk_buff *msg,
9661                                  struct cfg80211_registered_device *rdev,
9662                                  struct wireless_dev *wdev,
9663                                  u32 portid, u32 seq, int flags,
9664                                  u32 cmd)
9665 {
9666         void *hdr;
9667
9668         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9669         if (!hdr)
9670                 return -1;
9671
9672         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9673             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9674                                          wdev->netdev->ifindex)) ||
9675             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9676                 goto nla_put_failure;
9677
9678         /* ignore errors and send incomplete event anyway */
9679         nl80211_add_scan_req(msg, rdev);
9680
9681         return genlmsg_end(msg, hdr);
9682
9683  nla_put_failure:
9684         genlmsg_cancel(msg, hdr);
9685         return -EMSGSIZE;
9686 }
9687
9688 static int
9689 nl80211_send_sched_scan_msg(struct sk_buff *msg,
9690                             struct cfg80211_registered_device *rdev,
9691                             struct net_device *netdev,
9692                             u32 portid, u32 seq, int flags, u32 cmd)
9693 {
9694         void *hdr;
9695
9696         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9697         if (!hdr)
9698                 return -1;
9699
9700         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9701             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9702                 goto nla_put_failure;
9703
9704         return genlmsg_end(msg, hdr);
9705
9706  nla_put_failure:
9707         genlmsg_cancel(msg, hdr);
9708         return -EMSGSIZE;
9709 }
9710
9711 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
9712                              struct wireless_dev *wdev)
9713 {
9714         struct sk_buff *msg;
9715
9716         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9717         if (!msg)
9718                 return;
9719
9720         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9721                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
9722                 nlmsg_free(msg);
9723                 return;
9724         }
9725
9726         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9727                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9728 }
9729
9730 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
9731                             struct wireless_dev *wdev)
9732 {
9733         struct sk_buff *msg;
9734
9735         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9736         if (!msg)
9737                 return;
9738
9739         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9740                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
9741                 nlmsg_free(msg);
9742                 return;
9743         }
9744
9745         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9746                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9747 }
9748
9749 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
9750                                struct wireless_dev *wdev)
9751 {
9752         struct sk_buff *msg;
9753
9754         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9755         if (!msg)
9756                 return;
9757
9758         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9759                                   NL80211_CMD_SCAN_ABORTED) < 0) {
9760                 nlmsg_free(msg);
9761                 return;
9762         }
9763
9764         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9765                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9766 }
9767
9768 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
9769                                      struct net_device *netdev)
9770 {
9771         struct sk_buff *msg;
9772
9773         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9774         if (!msg)
9775                 return;
9776
9777         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
9778                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
9779                 nlmsg_free(msg);
9780                 return;
9781         }
9782
9783         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9784                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9785 }
9786
9787 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
9788                              struct net_device *netdev, u32 cmd)
9789 {
9790         struct sk_buff *msg;
9791
9792         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9793         if (!msg)
9794                 return;
9795
9796         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
9797                 nlmsg_free(msg);
9798                 return;
9799         }
9800
9801         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9802                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9803 }
9804
9805 /*
9806  * This can happen on global regulatory changes or device specific settings
9807  * based on custom world regulatory domains.
9808  */
9809 void nl80211_send_reg_change_event(struct regulatory_request *request)
9810 {
9811         struct sk_buff *msg;
9812         void *hdr;
9813
9814         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9815         if (!msg)
9816                 return;
9817
9818         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
9819         if (!hdr) {
9820                 nlmsg_free(msg);
9821                 return;
9822         }
9823
9824         /* Userspace can always count this one always being set */
9825         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
9826                 goto nla_put_failure;
9827
9828         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
9829                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9830                                NL80211_REGDOM_TYPE_WORLD))
9831                         goto nla_put_failure;
9832         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
9833                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9834                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
9835                         goto nla_put_failure;
9836         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
9837                    request->intersect) {
9838                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9839                                NL80211_REGDOM_TYPE_INTERSECTION))
9840                         goto nla_put_failure;
9841         } else {
9842                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9843                                NL80211_REGDOM_TYPE_COUNTRY) ||
9844                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
9845                                    request->alpha2))
9846                         goto nla_put_failure;
9847         }
9848
9849         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
9850             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
9851                 goto nla_put_failure;
9852
9853         genlmsg_end(msg, hdr);
9854
9855         rcu_read_lock();
9856         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9857                                 GFP_ATOMIC);
9858         rcu_read_unlock();
9859
9860         return;
9861
9862 nla_put_failure:
9863         genlmsg_cancel(msg, hdr);
9864         nlmsg_free(msg);
9865 }
9866
9867 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
9868                                     struct net_device *netdev,
9869                                     const u8 *buf, size_t len,
9870                                     enum nl80211_commands cmd, gfp_t gfp)
9871 {
9872         struct sk_buff *msg;
9873         void *hdr;
9874
9875         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9876         if (!msg)
9877                 return;
9878
9879         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9880         if (!hdr) {
9881                 nlmsg_free(msg);
9882                 return;
9883         }
9884
9885         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9886             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9887             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9888                 goto nla_put_failure;
9889
9890         genlmsg_end(msg, hdr);
9891
9892         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9893                                 nl80211_mlme_mcgrp.id, gfp);
9894         return;
9895
9896  nla_put_failure:
9897         genlmsg_cancel(msg, hdr);
9898         nlmsg_free(msg);
9899 }
9900
9901 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9902                           struct net_device *netdev, const u8 *buf,
9903                           size_t len, gfp_t gfp)
9904 {
9905         nl80211_send_mlme_event(rdev, netdev, buf, len,
9906                                 NL80211_CMD_AUTHENTICATE, gfp);
9907 }
9908
9909 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
9910                            struct net_device *netdev, const u8 *buf,
9911                            size_t len, gfp_t gfp)
9912 {
9913         nl80211_send_mlme_event(rdev, netdev, buf, len,
9914                                 NL80211_CMD_ASSOCIATE, gfp);
9915 }
9916
9917 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9918                          struct net_device *netdev, const u8 *buf,
9919                          size_t len, gfp_t gfp)
9920 {
9921         nl80211_send_mlme_event(rdev, netdev, buf, len,
9922                                 NL80211_CMD_DEAUTHENTICATE, gfp);
9923 }
9924
9925 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
9926                            struct net_device *netdev, const u8 *buf,
9927                            size_t len, gfp_t gfp)
9928 {
9929         nl80211_send_mlme_event(rdev, netdev, buf, len,
9930                                 NL80211_CMD_DISASSOCIATE, gfp);
9931 }
9932
9933 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
9934                                   size_t len)
9935 {
9936         struct wireless_dev *wdev = dev->ieee80211_ptr;
9937         struct wiphy *wiphy = wdev->wiphy;
9938         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9939         const struct ieee80211_mgmt *mgmt = (void *)buf;
9940         u32 cmd;
9941
9942         if (WARN_ON(len < 2))
9943                 return;
9944
9945         if (ieee80211_is_deauth(mgmt->frame_control))
9946                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
9947         else
9948                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
9949
9950         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
9951         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
9952 }
9953 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
9954
9955 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
9956                                       struct net_device *netdev, int cmd,
9957                                       const u8 *addr, gfp_t gfp)
9958 {
9959         struct sk_buff *msg;
9960         void *hdr;
9961
9962         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9963         if (!msg)
9964                 return;
9965
9966         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9967         if (!hdr) {
9968                 nlmsg_free(msg);
9969                 return;
9970         }
9971
9972         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9973             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9974             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
9975             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9976                 goto nla_put_failure;
9977
9978         genlmsg_end(msg, hdr);
9979
9980         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9981                                 nl80211_mlme_mcgrp.id, gfp);
9982         return;
9983
9984  nla_put_failure:
9985         genlmsg_cancel(msg, hdr);
9986         nlmsg_free(msg);
9987 }
9988
9989 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9990                                struct net_device *netdev, const u8 *addr,
9991                                gfp_t gfp)
9992 {
9993         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
9994                                   addr, gfp);
9995 }
9996
9997 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
9998                                 struct net_device *netdev, const u8 *addr,
9999                                 gfp_t gfp)
10000 {
10001         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
10002                                   addr, gfp);
10003 }
10004
10005 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
10006                                  struct net_device *netdev, const u8 *bssid,
10007                                  const u8 *req_ie, size_t req_ie_len,
10008                                  const u8 *resp_ie, size_t resp_ie_len,
10009                                  u16 status, gfp_t gfp)
10010 {
10011         struct sk_buff *msg;
10012         void *hdr;
10013
10014         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10015         if (!msg)
10016                 return;
10017
10018         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
10019         if (!hdr) {
10020                 nlmsg_free(msg);
10021                 return;
10022         }
10023
10024         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10025             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10026             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
10027             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
10028             (req_ie &&
10029              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10030             (resp_ie &&
10031              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10032                 goto nla_put_failure;
10033
10034         genlmsg_end(msg, hdr);
10035
10036         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10037                                 nl80211_mlme_mcgrp.id, gfp);
10038         return;
10039
10040  nla_put_failure:
10041         genlmsg_cancel(msg, hdr);
10042         nlmsg_free(msg);
10043
10044 }
10045
10046 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
10047                          struct net_device *netdev, const u8 *bssid,
10048                          const u8 *req_ie, size_t req_ie_len,
10049                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
10050 {
10051         struct sk_buff *msg;
10052         void *hdr;
10053
10054         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10055         if (!msg)
10056                 return;
10057
10058         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
10059         if (!hdr) {
10060                 nlmsg_free(msg);
10061                 return;
10062         }
10063
10064         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10065             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10066             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
10067             (req_ie &&
10068              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10069             (resp_ie &&
10070              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10071                 goto nla_put_failure;
10072
10073         genlmsg_end(msg, hdr);
10074
10075         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10076                                 nl80211_mlme_mcgrp.id, gfp);
10077         return;
10078
10079  nla_put_failure:
10080         genlmsg_cancel(msg, hdr);
10081         nlmsg_free(msg);
10082
10083 }
10084
10085 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
10086                                struct net_device *netdev, u16 reason,
10087                                const u8 *ie, size_t ie_len, bool from_ap)
10088 {
10089         struct sk_buff *msg;
10090         void *hdr;
10091
10092         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10093         if (!msg)
10094                 return;
10095
10096         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
10097         if (!hdr) {
10098                 nlmsg_free(msg);
10099                 return;
10100         }
10101
10102         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10103             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10104             (from_ap && reason &&
10105              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
10106             (from_ap &&
10107              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
10108             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
10109                 goto nla_put_failure;
10110
10111         genlmsg_end(msg, hdr);
10112
10113         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10114                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
10115         return;
10116
10117  nla_put_failure:
10118         genlmsg_cancel(msg, hdr);
10119         nlmsg_free(msg);
10120
10121 }
10122
10123 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
10124                              struct net_device *netdev, const u8 *bssid,
10125                              gfp_t gfp)
10126 {
10127         struct sk_buff *msg;
10128         void *hdr;
10129
10130         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10131         if (!msg)
10132                 return;
10133
10134         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
10135         if (!hdr) {
10136                 nlmsg_free(msg);
10137                 return;
10138         }
10139
10140         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10141             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10142             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10143                 goto nla_put_failure;
10144
10145         genlmsg_end(msg, hdr);
10146
10147         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10148                                 nl80211_mlme_mcgrp.id, gfp);
10149         return;
10150
10151  nla_put_failure:
10152         genlmsg_cancel(msg, hdr);
10153         nlmsg_free(msg);
10154 }
10155
10156 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
10157                                         const u8* ie, u8 ie_len, gfp_t gfp)
10158 {
10159         struct wireless_dev *wdev = dev->ieee80211_ptr;
10160         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10161         struct sk_buff *msg;
10162         void *hdr;
10163
10164         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10165                 return;
10166
10167         trace_cfg80211_notify_new_peer_candidate(dev, addr);
10168
10169         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10170         if (!msg)
10171                 return;
10172
10173         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
10174         if (!hdr) {
10175                 nlmsg_free(msg);
10176                 return;
10177         }
10178
10179         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10180             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10181             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10182             (ie_len && ie &&
10183              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
10184                 goto nla_put_failure;
10185
10186         genlmsg_end(msg, hdr);
10187
10188         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10189                                 nl80211_mlme_mcgrp.id, gfp);
10190         return;
10191
10192  nla_put_failure:
10193         genlmsg_cancel(msg, hdr);
10194         nlmsg_free(msg);
10195 }
10196 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
10197
10198 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
10199                                  struct net_device *netdev, const u8 *addr,
10200                                  enum nl80211_key_type key_type, int key_id,
10201                                  const u8 *tsc, gfp_t gfp)
10202 {
10203         struct sk_buff *msg;
10204         void *hdr;
10205
10206         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10207         if (!msg)
10208                 return;
10209
10210         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
10211         if (!hdr) {
10212                 nlmsg_free(msg);
10213                 return;
10214         }
10215
10216         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10217             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10218             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
10219             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
10220             (key_id != -1 &&
10221              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
10222             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
10223                 goto nla_put_failure;
10224
10225         genlmsg_end(msg, hdr);
10226
10227         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10228                                 nl80211_mlme_mcgrp.id, gfp);
10229         return;
10230
10231  nla_put_failure:
10232         genlmsg_cancel(msg, hdr);
10233         nlmsg_free(msg);
10234 }
10235
10236 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
10237                                     struct ieee80211_channel *channel_before,
10238                                     struct ieee80211_channel *channel_after)
10239 {
10240         struct sk_buff *msg;
10241         void *hdr;
10242         struct nlattr *nl_freq;
10243
10244         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
10245         if (!msg)
10246                 return;
10247
10248         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
10249         if (!hdr) {
10250                 nlmsg_free(msg);
10251                 return;
10252         }
10253
10254         /*
10255          * Since we are applying the beacon hint to a wiphy we know its
10256          * wiphy_idx is valid
10257          */
10258         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
10259                 goto nla_put_failure;
10260
10261         /* Before */
10262         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
10263         if (!nl_freq)
10264                 goto nla_put_failure;
10265         if (nl80211_msg_put_channel(msg, channel_before, false))
10266                 goto nla_put_failure;
10267         nla_nest_end(msg, nl_freq);
10268
10269         /* After */
10270         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
10271         if (!nl_freq)
10272                 goto nla_put_failure;
10273         if (nl80211_msg_put_channel(msg, channel_after, false))
10274                 goto nla_put_failure;
10275         nla_nest_end(msg, nl_freq);
10276
10277         genlmsg_end(msg, hdr);
10278
10279         rcu_read_lock();
10280         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
10281                                 GFP_ATOMIC);
10282         rcu_read_unlock();
10283
10284         return;
10285
10286 nla_put_failure:
10287         genlmsg_cancel(msg, hdr);
10288         nlmsg_free(msg);
10289 }
10290
10291 static void nl80211_send_remain_on_chan_event(
10292         int cmd, struct cfg80211_registered_device *rdev,
10293         struct wireless_dev *wdev, u64 cookie,
10294         struct ieee80211_channel *chan,
10295         unsigned int duration, gfp_t gfp)
10296 {
10297         struct sk_buff *msg;
10298         void *hdr;
10299
10300         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10301         if (!msg)
10302                 return;
10303
10304         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10305         if (!hdr) {
10306                 nlmsg_free(msg);
10307                 return;
10308         }
10309
10310         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10311             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10312                                          wdev->netdev->ifindex)) ||
10313             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10314             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
10315             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10316                         NL80211_CHAN_NO_HT) ||
10317             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
10318                 goto nla_put_failure;
10319
10320         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
10321             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
10322                 goto nla_put_failure;
10323
10324         genlmsg_end(msg, hdr);
10325
10326         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10327                                 nl80211_mlme_mcgrp.id, gfp);
10328         return;
10329
10330  nla_put_failure:
10331         genlmsg_cancel(msg, hdr);
10332         nlmsg_free(msg);
10333 }
10334
10335 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
10336                                struct ieee80211_channel *chan,
10337                                unsigned int duration, gfp_t gfp)
10338 {
10339         struct wiphy *wiphy = wdev->wiphy;
10340         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10341
10342         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
10343         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
10344                                           rdev, wdev, cookie, chan,
10345                                           duration, gfp);
10346 }
10347 EXPORT_SYMBOL(cfg80211_ready_on_channel);
10348
10349 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
10350                                         struct ieee80211_channel *chan,
10351                                         gfp_t gfp)
10352 {
10353         struct wiphy *wiphy = wdev->wiphy;
10354         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10355
10356         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
10357         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10358                                           rdev, wdev, cookie, chan, 0, gfp);
10359 }
10360 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
10361
10362 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
10363                       struct station_info *sinfo, gfp_t gfp)
10364 {
10365         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10366         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10367         struct sk_buff *msg;
10368
10369         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
10370
10371         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10372         if (!msg)
10373                 return;
10374
10375         if (nl80211_send_station(msg, 0, 0, 0,
10376                                  rdev, dev, mac_addr, sinfo) < 0) {
10377                 nlmsg_free(msg);
10378                 return;
10379         }
10380
10381         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10382                                 nl80211_mlme_mcgrp.id, gfp);
10383 }
10384 EXPORT_SYMBOL(cfg80211_new_sta);
10385
10386 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
10387 {
10388         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10389         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10390         struct sk_buff *msg;
10391         void *hdr;
10392
10393         trace_cfg80211_del_sta(dev, mac_addr);
10394
10395         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10396         if (!msg)
10397                 return;
10398
10399         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
10400         if (!hdr) {
10401                 nlmsg_free(msg);
10402                 return;
10403         }
10404
10405         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10406             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
10407                 goto nla_put_failure;
10408
10409         genlmsg_end(msg, hdr);
10410
10411         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10412                                 nl80211_mlme_mcgrp.id, gfp);
10413         return;
10414
10415  nla_put_failure:
10416         genlmsg_cancel(msg, hdr);
10417         nlmsg_free(msg);
10418 }
10419 EXPORT_SYMBOL(cfg80211_del_sta);
10420
10421 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
10422                           enum nl80211_connect_failed_reason reason,
10423                           gfp_t gfp)
10424 {
10425         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10426         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10427         struct sk_buff *msg;
10428         void *hdr;
10429
10430         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10431         if (!msg)
10432                 return;
10433
10434         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
10435         if (!hdr) {
10436                 nlmsg_free(msg);
10437                 return;
10438         }
10439
10440         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10441             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
10442             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
10443                 goto nla_put_failure;
10444
10445         genlmsg_end(msg, hdr);
10446
10447         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10448                                 nl80211_mlme_mcgrp.id, gfp);
10449         return;
10450
10451  nla_put_failure:
10452         genlmsg_cancel(msg, hdr);
10453         nlmsg_free(msg);
10454 }
10455 EXPORT_SYMBOL(cfg80211_conn_failed);
10456
10457 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
10458                                        const u8 *addr, gfp_t gfp)
10459 {
10460         struct wireless_dev *wdev = dev->ieee80211_ptr;
10461         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10462         struct sk_buff *msg;
10463         void *hdr;
10464         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
10465
10466         if (!nlportid)
10467                 return false;
10468
10469         msg = nlmsg_new(100, gfp);
10470         if (!msg)
10471                 return true;
10472
10473         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10474         if (!hdr) {
10475                 nlmsg_free(msg);
10476                 return true;
10477         }
10478
10479         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10480             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10481             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10482                 goto nla_put_failure;
10483
10484         genlmsg_end(msg, hdr);
10485         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10486         return true;
10487
10488  nla_put_failure:
10489         genlmsg_cancel(msg, hdr);
10490         nlmsg_free(msg);
10491         return true;
10492 }
10493
10494 bool cfg80211_rx_spurious_frame(struct net_device *dev,
10495                                 const u8 *addr, gfp_t gfp)
10496 {
10497         struct wireless_dev *wdev = dev->ieee80211_ptr;
10498         bool ret;
10499
10500         trace_cfg80211_rx_spurious_frame(dev, addr);
10501
10502         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10503                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
10504                 trace_cfg80211_return_bool(false);
10505                 return false;
10506         }
10507         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
10508                                          addr, gfp);
10509         trace_cfg80211_return_bool(ret);
10510         return ret;
10511 }
10512 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
10513
10514 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
10515                                         const u8 *addr, gfp_t gfp)
10516 {
10517         struct wireless_dev *wdev = dev->ieee80211_ptr;
10518         bool ret;
10519
10520         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
10521
10522         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10523                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
10524                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
10525                 trace_cfg80211_return_bool(false);
10526                 return false;
10527         }
10528         ret = __nl80211_unexpected_frame(dev,
10529                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
10530                                          addr, gfp);
10531         trace_cfg80211_return_bool(ret);
10532         return ret;
10533 }
10534 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
10535
10536 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
10537                       struct wireless_dev *wdev, u32 nlportid,
10538                       int freq, int sig_dbm,
10539                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
10540 {
10541         struct net_device *netdev = wdev->netdev;
10542         struct sk_buff *msg;
10543         void *hdr;
10544
10545         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10546         if (!msg)
10547                 return -ENOMEM;
10548
10549         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10550         if (!hdr) {
10551                 nlmsg_free(msg);
10552                 return -ENOMEM;
10553         }
10554
10555         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10556             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10557                                         netdev->ifindex)) ||
10558             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10559             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
10560             (sig_dbm &&
10561              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10562             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10563             (flags &&
10564              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
10565                 goto nla_put_failure;
10566
10567         genlmsg_end(msg, hdr);
10568
10569         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10570
10571  nla_put_failure:
10572         genlmsg_cancel(msg, hdr);
10573         nlmsg_free(msg);
10574         return -ENOBUFS;
10575 }
10576
10577 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
10578                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
10579 {
10580         struct wiphy *wiphy = wdev->wiphy;
10581         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10582         struct net_device *netdev = wdev->netdev;
10583         struct sk_buff *msg;
10584         void *hdr;
10585
10586         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
10587
10588         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10589         if (!msg)
10590                 return;
10591
10592         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10593         if (!hdr) {
10594                 nlmsg_free(msg);
10595                 return;
10596         }
10597
10598         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10599             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10600                                    netdev->ifindex)) ||
10601             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10602             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10603             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10604             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
10605                 goto nla_put_failure;
10606
10607         genlmsg_end(msg, hdr);
10608
10609         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10610                                 nl80211_mlme_mcgrp.id, gfp);
10611         return;
10612
10613  nla_put_failure:
10614         genlmsg_cancel(msg, hdr);
10615         nlmsg_free(msg);
10616 }
10617 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10618
10619 void cfg80211_cqm_rssi_notify(struct net_device *dev,
10620                               enum nl80211_cqm_rssi_threshold_event rssi_event,
10621                               gfp_t gfp)
10622 {
10623         struct wireless_dev *wdev = dev->ieee80211_ptr;
10624         struct wiphy *wiphy = wdev->wiphy;
10625         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10626         struct sk_buff *msg;
10627         struct nlattr *pinfoattr;
10628         void *hdr;
10629
10630         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
10631
10632         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10633         if (!msg)
10634                 return;
10635
10636         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10637         if (!hdr) {
10638                 nlmsg_free(msg);
10639                 return;
10640         }
10641
10642         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10643             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10644                 goto nla_put_failure;
10645
10646         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10647         if (!pinfoattr)
10648                 goto nla_put_failure;
10649
10650         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
10651                         rssi_event))
10652                 goto nla_put_failure;
10653
10654         nla_nest_end(msg, pinfoattr);
10655
10656         genlmsg_end(msg, hdr);
10657
10658         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10659                                 nl80211_mlme_mcgrp.id, gfp);
10660         return;
10661
10662  nla_put_failure:
10663         genlmsg_cancel(msg, hdr);
10664         nlmsg_free(msg);
10665 }
10666 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10667
10668 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
10669                                      struct net_device *netdev, const u8 *bssid,
10670                                      const u8 *replay_ctr, gfp_t gfp)
10671 {
10672         struct sk_buff *msg;
10673         struct nlattr *rekey_attr;
10674         void *hdr;
10675
10676         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10677         if (!msg)
10678                 return;
10679
10680         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
10681         if (!hdr) {
10682                 nlmsg_free(msg);
10683                 return;
10684         }
10685
10686         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10687             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10688             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10689                 goto nla_put_failure;
10690
10691         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
10692         if (!rekey_attr)
10693                 goto nla_put_failure;
10694
10695         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
10696                     NL80211_REPLAY_CTR_LEN, replay_ctr))
10697                 goto nla_put_failure;
10698
10699         nla_nest_end(msg, rekey_attr);
10700
10701         genlmsg_end(msg, hdr);
10702
10703         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10704                                 nl80211_mlme_mcgrp.id, gfp);
10705         return;
10706
10707  nla_put_failure:
10708         genlmsg_cancel(msg, hdr);
10709         nlmsg_free(msg);
10710 }
10711
10712 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
10713                                const u8 *replay_ctr, gfp_t gfp)
10714 {
10715         struct wireless_dev *wdev = dev->ieee80211_ptr;
10716         struct wiphy *wiphy = wdev->wiphy;
10717         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10718
10719         trace_cfg80211_gtk_rekey_notify(dev, bssid);
10720         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
10721 }
10722 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
10723
10724 static void
10725 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
10726                                struct net_device *netdev, int index,
10727                                const u8 *bssid, bool preauth, gfp_t gfp)
10728 {
10729         struct sk_buff *msg;
10730         struct nlattr *attr;
10731         void *hdr;
10732
10733         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10734         if (!msg)
10735                 return;
10736
10737         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
10738         if (!hdr) {
10739                 nlmsg_free(msg);
10740                 return;
10741         }
10742
10743         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10744             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10745                 goto nla_put_failure;
10746
10747         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
10748         if (!attr)
10749                 goto nla_put_failure;
10750
10751         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
10752             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
10753             (preauth &&
10754              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
10755                 goto nla_put_failure;
10756
10757         nla_nest_end(msg, attr);
10758
10759         genlmsg_end(msg, hdr);
10760
10761         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10762                                 nl80211_mlme_mcgrp.id, gfp);
10763         return;
10764
10765  nla_put_failure:
10766         genlmsg_cancel(msg, hdr);
10767         nlmsg_free(msg);
10768 }
10769
10770 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
10771                                      const u8 *bssid, bool preauth, gfp_t gfp)
10772 {
10773         struct wireless_dev *wdev = dev->ieee80211_ptr;
10774         struct wiphy *wiphy = wdev->wiphy;
10775         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10776
10777         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
10778         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
10779 }
10780 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
10781
10782 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
10783                                      struct net_device *netdev,
10784                                      struct cfg80211_chan_def *chandef,
10785                                      gfp_t gfp)
10786 {
10787         struct sk_buff *msg;
10788         void *hdr;
10789
10790         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10791         if (!msg)
10792                 return;
10793
10794         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
10795         if (!hdr) {
10796                 nlmsg_free(msg);
10797                 return;
10798         }
10799
10800         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10801                 goto nla_put_failure;
10802
10803         if (nl80211_send_chandef(msg, chandef))
10804                 goto nla_put_failure;
10805
10806         genlmsg_end(msg, hdr);
10807
10808         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10809                                 nl80211_mlme_mcgrp.id, gfp);
10810         return;
10811
10812  nla_put_failure:
10813         genlmsg_cancel(msg, hdr);
10814         nlmsg_free(msg);
10815 }
10816
10817 void cfg80211_ch_switch_notify(struct net_device *dev,
10818                                struct cfg80211_chan_def *chandef)
10819 {
10820         struct wireless_dev *wdev = dev->ieee80211_ptr;
10821         struct wiphy *wiphy = wdev->wiphy;
10822         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10823
10824         ASSERT_WDEV_LOCK(wdev);
10825
10826         trace_cfg80211_ch_switch_notify(dev, chandef);
10827
10828         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10829                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
10830                     wdev->iftype != NL80211_IFTYPE_ADHOC &&
10831                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10832                 return;
10833
10834         wdev->channel = chandef->chan;
10835         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
10836 }
10837 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
10838
10839 void cfg80211_cqm_txe_notify(struct net_device *dev,
10840                              const u8 *peer, u32 num_packets,
10841                              u32 rate, u32 intvl, gfp_t gfp)
10842 {
10843         struct wireless_dev *wdev = dev->ieee80211_ptr;
10844         struct wiphy *wiphy = wdev->wiphy;
10845         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10846         struct sk_buff *msg;
10847         struct nlattr *pinfoattr;
10848         void *hdr;
10849
10850         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10851         if (!msg)
10852                 return;
10853
10854         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10855         if (!hdr) {
10856                 nlmsg_free(msg);
10857                 return;
10858         }
10859
10860         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10861             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10862             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10863                 goto nla_put_failure;
10864
10865         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10866         if (!pinfoattr)
10867                 goto nla_put_failure;
10868
10869         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
10870                 goto nla_put_failure;
10871
10872         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
10873                 goto nla_put_failure;
10874
10875         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
10876                 goto nla_put_failure;
10877
10878         nla_nest_end(msg, pinfoattr);
10879
10880         genlmsg_end(msg, hdr);
10881
10882         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10883                                 nl80211_mlme_mcgrp.id, gfp);
10884         return;
10885
10886  nla_put_failure:
10887         genlmsg_cancel(msg, hdr);
10888         nlmsg_free(msg);
10889 }
10890 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
10891
10892 void
10893 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
10894                      const struct cfg80211_chan_def *chandef,
10895                      enum nl80211_radar_event event,
10896                      struct net_device *netdev, gfp_t gfp)
10897 {
10898         struct sk_buff *msg;
10899         void *hdr;
10900
10901         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10902         if (!msg)
10903                 return;
10904
10905         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
10906         if (!hdr) {
10907                 nlmsg_free(msg);
10908                 return;
10909         }
10910
10911         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10912                 goto nla_put_failure;
10913
10914         /* NOP and radar events don't need a netdev parameter */
10915         if (netdev) {
10916                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
10917
10918                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10919                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10920                         goto nla_put_failure;
10921         }
10922
10923         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
10924                 goto nla_put_failure;
10925
10926         if (nl80211_send_chandef(msg, chandef))
10927                 goto nla_put_failure;
10928
10929         genlmsg_end(msg, hdr);
10930
10931         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10932                                 nl80211_mlme_mcgrp.id, gfp);
10933         return;
10934
10935  nla_put_failure:
10936         genlmsg_cancel(msg, hdr);
10937         nlmsg_free(msg);
10938 }
10939
10940 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
10941                                  const u8 *peer, u32 num_packets, gfp_t gfp)
10942 {
10943         struct wireless_dev *wdev = dev->ieee80211_ptr;
10944         struct wiphy *wiphy = wdev->wiphy;
10945         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10946         struct sk_buff *msg;
10947         struct nlattr *pinfoattr;
10948         void *hdr;
10949
10950         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
10951
10952         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10953         if (!msg)
10954                 return;
10955
10956         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10957         if (!hdr) {
10958                 nlmsg_free(msg);
10959                 return;
10960         }
10961
10962         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10963             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10964             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10965                 goto nla_put_failure;
10966
10967         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10968         if (!pinfoattr)
10969                 goto nla_put_failure;
10970
10971         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
10972                 goto nla_put_failure;
10973
10974         nla_nest_end(msg, pinfoattr);
10975
10976         genlmsg_end(msg, hdr);
10977
10978         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10979                                 nl80211_mlme_mcgrp.id, gfp);
10980         return;
10981
10982  nla_put_failure:
10983         genlmsg_cancel(msg, hdr);
10984         nlmsg_free(msg);
10985 }
10986 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
10987
10988 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
10989                            u64 cookie, bool acked, gfp_t gfp)
10990 {
10991         struct wireless_dev *wdev = dev->ieee80211_ptr;
10992         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10993         struct sk_buff *msg;
10994         void *hdr;
10995
10996         trace_cfg80211_probe_status(dev, addr, cookie, acked);
10997
10998         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10999
11000         if (!msg)
11001                 return;
11002
11003         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
11004         if (!hdr) {
11005                 nlmsg_free(msg);
11006                 return;
11007         }
11008
11009         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11010             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11011             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11012             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11013             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
11014                 goto nla_put_failure;
11015
11016         genlmsg_end(msg, hdr);
11017
11018         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
11019                                 nl80211_mlme_mcgrp.id, gfp);
11020         return;
11021
11022  nla_put_failure:
11023         genlmsg_cancel(msg, hdr);
11024         nlmsg_free(msg);
11025 }
11026 EXPORT_SYMBOL(cfg80211_probe_status);
11027
11028 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
11029                                  const u8 *frame, size_t len,
11030                                  int freq, int sig_dbm)
11031 {
11032         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11033         struct sk_buff *msg;
11034         void *hdr;
11035         struct cfg80211_beacon_registration *reg;
11036
11037         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
11038
11039         spin_lock_bh(&rdev->beacon_registrations_lock);
11040         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11041                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
11042                 if (!msg) {
11043                         spin_unlock_bh(&rdev->beacon_registrations_lock);
11044                         return;
11045                 }
11046
11047                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11048                 if (!hdr)
11049                         goto nla_put_failure;
11050
11051                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11052                     (freq &&
11053                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
11054                     (sig_dbm &&
11055                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11056                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
11057                         goto nla_put_failure;
11058
11059                 genlmsg_end(msg, hdr);
11060
11061                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
11062         }
11063         spin_unlock_bh(&rdev->beacon_registrations_lock);
11064         return;
11065
11066  nla_put_failure:
11067         spin_unlock_bh(&rdev->beacon_registrations_lock);
11068         if (hdr)
11069                 genlmsg_cancel(msg, hdr);
11070         nlmsg_free(msg);
11071 }
11072 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
11073
11074 #ifdef CONFIG_PM
11075 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
11076                                    struct cfg80211_wowlan_wakeup *wakeup,
11077                                    gfp_t gfp)
11078 {
11079         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
11080         struct sk_buff *msg;
11081         void *hdr;
11082         int size = 200;
11083
11084         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
11085
11086         if (wakeup)
11087                 size += wakeup->packet_present_len;
11088
11089         msg = nlmsg_new(size, gfp);
11090         if (!msg)
11091                 return;
11092
11093         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
11094         if (!hdr)
11095                 goto free_msg;
11096
11097         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11098             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11099                 goto free_msg;
11100
11101         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11102                                         wdev->netdev->ifindex))
11103                 goto free_msg;
11104
11105         if (wakeup) {
11106                 struct nlattr *reasons;
11107
11108                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
11109
11110                 if (wakeup->disconnect &&
11111                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
11112                         goto free_msg;
11113                 if (wakeup->magic_pkt &&
11114                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
11115                         goto free_msg;
11116                 if (wakeup->gtk_rekey_failure &&
11117                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
11118                         goto free_msg;
11119                 if (wakeup->eap_identity_req &&
11120                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
11121                         goto free_msg;
11122                 if (wakeup->four_way_handshake &&
11123                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
11124                         goto free_msg;
11125                 if (wakeup->rfkill_release &&
11126                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
11127                         goto free_msg;
11128
11129                 if (wakeup->pattern_idx >= 0 &&
11130                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
11131                                 wakeup->pattern_idx))
11132                         goto free_msg;
11133
11134                 if (wakeup->tcp_match)
11135                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
11136
11137                 if (wakeup->tcp_connlost)
11138                         nla_put_flag(msg,
11139                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
11140
11141                 if (wakeup->tcp_nomoretokens)
11142                         nla_put_flag(msg,
11143                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
11144
11145                 if (wakeup->packet) {
11146                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
11147                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
11148
11149                         if (!wakeup->packet_80211) {
11150                                 pkt_attr =
11151                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
11152                                 len_attr =
11153                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
11154                         }
11155
11156                         if (wakeup->packet_len &&
11157                             nla_put_u32(msg, len_attr, wakeup->packet_len))
11158                                 goto free_msg;
11159
11160                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
11161                                     wakeup->packet))
11162                                 goto free_msg;
11163                 }
11164
11165                 nla_nest_end(msg, reasons);
11166         }
11167
11168         genlmsg_end(msg, hdr);
11169
11170         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
11171                                 nl80211_mlme_mcgrp.id, gfp);
11172         return;
11173
11174  free_msg:
11175         nlmsg_free(msg);
11176 }
11177 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
11178 #endif
11179
11180 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
11181                                 enum nl80211_tdls_operation oper,
11182                                 u16 reason_code, gfp_t gfp)
11183 {
11184         struct wireless_dev *wdev = dev->ieee80211_ptr;
11185         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
11186         struct sk_buff *msg;
11187         void *hdr;
11188
11189         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
11190                                          reason_code);
11191
11192         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11193         if (!msg)
11194                 return;
11195
11196         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
11197         if (!hdr) {
11198                 nlmsg_free(msg);
11199                 return;
11200         }
11201
11202         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11203             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11204             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
11205             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
11206             (reason_code > 0 &&
11207              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
11208                 goto nla_put_failure;
11209
11210         genlmsg_end(msg, hdr);
11211
11212         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
11213                                 nl80211_mlme_mcgrp.id, gfp);
11214         return;
11215
11216  nla_put_failure:
11217         genlmsg_cancel(msg, hdr);
11218         nlmsg_free(msg);
11219 }
11220 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
11221
11222 static int nl80211_netlink_notify(struct notifier_block * nb,
11223                                   unsigned long state,
11224                                   void *_notify)
11225 {
11226         struct netlink_notify *notify = _notify;
11227         struct cfg80211_registered_device *rdev;
11228         struct wireless_dev *wdev;
11229         struct cfg80211_beacon_registration *reg, *tmp;
11230
11231         if (state != NETLINK_URELEASE)
11232                 return NOTIFY_DONE;
11233
11234         rcu_read_lock();
11235
11236         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
11237                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
11238                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
11239
11240                 spin_lock_bh(&rdev->beacon_registrations_lock);
11241                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
11242                                          list) {
11243                         if (reg->nlportid == notify->portid) {
11244                                 list_del(&reg->list);
11245                                 kfree(reg);
11246                                 break;
11247                         }
11248                 }
11249                 spin_unlock_bh(&rdev->beacon_registrations_lock);
11250         }
11251
11252         rcu_read_unlock();
11253
11254         return NOTIFY_DONE;
11255 }
11256
11257 static struct notifier_block nl80211_netlink_notifier = {
11258         .notifier_call = nl80211_netlink_notify,
11259 };
11260
11261 void cfg80211_ft_event(struct net_device *netdev,
11262                        struct cfg80211_ft_event_params *ft_event)
11263 {
11264         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
11265         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11266         struct sk_buff *msg;
11267         void *hdr;
11268
11269         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
11270
11271         if (!ft_event->target_ap)
11272                 return;
11273
11274         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11275         if (!msg)
11276                 return;
11277
11278         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
11279         if (!hdr) {
11280                 nlmsg_free(msg);
11281                 return;
11282         }
11283
11284         nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
11285         nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
11286         nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
11287         if (ft_event->ies)
11288                 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
11289         if (ft_event->ric_ies)
11290                 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
11291                         ft_event->ric_ies);
11292
11293         genlmsg_end(msg, hdr);
11294
11295         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
11296                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
11297 }
11298 EXPORT_SYMBOL(cfg80211_ft_event);
11299
11300 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
11301 {
11302         struct cfg80211_registered_device *rdev;
11303         struct sk_buff *msg;
11304         void *hdr;
11305         u32 nlportid;
11306
11307         rdev = wiphy_to_dev(wdev->wiphy);
11308         if (!rdev->crit_proto_nlportid)
11309                 return;
11310
11311         nlportid = rdev->crit_proto_nlportid;
11312         rdev->crit_proto_nlportid = 0;
11313
11314         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11315         if (!msg)
11316                 return;
11317
11318         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
11319         if (!hdr)
11320                 goto nla_put_failure;
11321
11322         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11323             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11324                 goto nla_put_failure;
11325
11326         genlmsg_end(msg, hdr);
11327
11328         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11329         return;
11330
11331  nla_put_failure:
11332         if (hdr)
11333                 genlmsg_cancel(msg, hdr);
11334         nlmsg_free(msg);
11335
11336 }
11337 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
11338
11339 /* initialisation/exit functions */
11340
11341 int nl80211_init(void)
11342 {
11343         int err;
11344
11345         err = genl_register_family_with_ops(&nl80211_fam,
11346                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
11347         if (err)
11348                 return err;
11349
11350         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
11351         if (err)
11352                 goto err_out;
11353
11354         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
11355         if (err)
11356                 goto err_out;
11357
11358         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
11359         if (err)
11360                 goto err_out;
11361
11362         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
11363         if (err)
11364                 goto err_out;
11365
11366 #ifdef CONFIG_NL80211_TESTMODE
11367         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
11368         if (err)
11369                 goto err_out;
11370 #endif
11371
11372         err = netlink_register_notifier(&nl80211_netlink_notifier);
11373         if (err)
11374                 goto err_out;
11375
11376         return 0;
11377  err_out:
11378         genl_unregister_family(&nl80211_fam);
11379         return err;
11380 }
11381
11382 void nl80211_exit(void)
11383 {
11384         netlink_unregister_notifier(&nl80211_netlink_notifier);
11385         genl_unregister_family(&nl80211_fam);
11386 }