net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  */
   7
   8 #include <linux/if.h>
   9 #include <linux/module.h>
  10 #include <linux/err.h>
  11 #include <linux/slab.h>
  12 #include <linux/list.h>
  13 #include <linux/if_ether.h>
  14 #include <linux/ieee80211.h>
  15 #include <linux/nl80211.h>
  16 #include <linux/rtnetlink.h>
  17 #include <linux/netlink.h>
  18 #include <linux/etherdevice.h>
  19 #include <net/net_namespace.h>
  20 #include <net/genetlink.h>
  21 #include <net/cfg80211.h>
  22 #include <net/sock.h>
  23 #include <net/inet_connection_sock.h>
  24 #include "core.h"
  25 #include "nl80211.h"
  26 #include "reg.h"
  27 #include "rdev-ops.h"
  28
  29 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  30                                    struct genl_info *info,
  31                                    struct cfg80211_crypto_settings *settings,
  32                                    int cipher_limit);
  33
  34 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  35                             struct genl_info *info);
  36 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  37                               struct genl_info *info);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam = {
  41         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  42         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  43         .hdrsize = 0,                   /* no private header */
  44         .version = 1,                   /* no particular meaning now */
  45         .maxattr = NL80211_ATTR_MAX,
  46         .netnsok = true,
  47         .pre_doit = nl80211_pre_doit,
  48         .post_doit = nl80211_post_doit,
  49 };
  50
  51 /* multicast groups */
  52 enum nl80211_multicast_groups {
  53         NL80211_MCGRP_CONFIG,
  54         NL80211_MCGRP_SCAN,
  55         NL80211_MCGRP_REGULATORY,
  56         NL80211_MCGRP_MLME,
  57         NL80211_MCGRP_VENDOR,
  58         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  59 };
  60
  61 static const struct genl_multicast_group nl80211_mcgrps[] = {
  62         [NL80211_MCGRP_CONFIG] = { .name = "config", },
  63         [NL80211_MCGRP_SCAN] = { .name = "scan", },
  64         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
  65         [NL80211_MCGRP_MLME] = { .name = "mlme", },
  66         [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
  67 #ifdef CONFIG_NL80211_TESTMODE
  68         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
  69 #endif
  70 };
  71
  72 /* returns ERR_PTR values */
  73 static struct wireless_dev *
  74 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  75 {
  76         struct cfg80211_registered_device *rdev;
  77         struct wireless_dev *result = NULL;
  78         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  79         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  80         u64 wdev_id;
  81         int wiphy_idx = -1;
  82         int ifidx = -1;
  83
  84         ASSERT_RTNL();
  85
  86         if (!have_ifidx && !have_wdev_id)
  87                 return ERR_PTR(-EINVAL);
  88
  89         if (have_ifidx)
  90                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  91         if (have_wdev_id) {
  92                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  93                 wiphy_idx = wdev_id >> 32;
  94         }
  95
  96         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  97                 struct wireless_dev *wdev;
  98
  99                 if (wiphy_net(&rdev->wiphy) != netns)
 100                         continue;
 101
 102                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 103                         continue;
 104
 105                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 106                         if (have_ifidx && wdev->netdev &&
 107                             wdev->netdev->ifindex == ifidx) {
 108                                 result = wdev;
 109                                 break;
 110                         }
 111                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 112                                 result = wdev;
 113                                 break;
 114                         }
 115                 }
 116
 117                 if (result)
 118                         break;
 119         }
 120
 121         if (result)
 122                 return result;
 123         return ERR_PTR(-ENODEV);
 124 }
 125
 126 static struct cfg80211_registered_device *
 127 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 128 {
 129         struct cfg80211_registered_device *rdev = NULL, *tmp;
 130         struct net_device *netdev;
 131
 132         ASSERT_RTNL();
 133
 134         if (!attrs[NL80211_ATTR_WIPHY] &&
 135             !attrs[NL80211_ATTR_IFINDEX] &&
 136             !attrs[NL80211_ATTR_WDEV])
 137                 return ERR_PTR(-EINVAL);
 138
 139         if (attrs[NL80211_ATTR_WIPHY])
 140                 rdev = cfg80211_rdev_by_wiphy_idx(
 141                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 142
 143         if (attrs[NL80211_ATTR_WDEV]) {
 144                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 145                 struct wireless_dev *wdev;
 146                 bool found = false;
 147
 148                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 149                 if (tmp) {
 150                         /* make sure wdev exists */
 151                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 152                                 if (wdev->identifier != (u32)wdev_id)
 153                                         continue;
 154                                 found = true;
 155                                 break;
 156                         }
 157
 158                         if (!found)
 159                                 tmp = NULL;
 160
 161                         if (rdev && tmp != rdev)
 162                                 return ERR_PTR(-EINVAL);
 163                         rdev = tmp;
 164                 }
 165         }
 166
 167         if (attrs[NL80211_ATTR_IFINDEX]) {
 168                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 169                 netdev = __dev_get_by_index(netns, ifindex);
 170                 if (netdev) {
 171                         if (netdev->ieee80211_ptr)
 172                                 tmp = wiphy_to_rdev(
 173                                         netdev->ieee80211_ptr->wiphy);
 174                         else
 175                                 tmp = NULL;
 176
 177                         /* not wireless device -- return error */
 178                         if (!tmp)
 179                                 return ERR_PTR(-EINVAL);
 180
 181                         /* mismatch -- return error */
 182                         if (rdev && tmp != rdev)
 183                                 return ERR_PTR(-EINVAL);
 184
 185                         rdev = tmp;
 186                 }
 187         }
 188
 189         if (!rdev)
 190                 return ERR_PTR(-ENODEV);
 191
 192         if (netns != wiphy_net(&rdev->wiphy))
 193                 return ERR_PTR(-ENODEV);
 194
 195         return rdev;
 196 }
 197
 198 /*
 199  * This function returns a pointer to the driver
 200  * that the genl_info item that is passed refers to.
 201  *
 202  * The result of this can be a PTR_ERR and hence must
 203  * be checked with IS_ERR() for errors.
 204  */
 205 static struct cfg80211_registered_device *
 206 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 207 {
 208         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 209 }
 210
 211 /* policy for the attributes */
 212 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 213         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 214         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 215                                       .len = 20-1 },
 216         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 217
 218         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 219         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 220         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 223
 224         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 225         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 226         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 229         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 230
 231         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 232         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 233         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 234
 235         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 236         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 237
 238         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 239         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 240                                     .len = WLAN_MAX_KEY_LEN },
 241         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 242         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 243         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 244         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 245         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 246
 247         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 248         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 249         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 252                                        .len = IEEE80211_MAX_DATA_LEN },
 253         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 255         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 256         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 257                                                .len = NL80211_MAX_SUPP_RATES },
 258         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 259         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 260         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 261         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 262                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 263         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 264
 265         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 266         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 267
 268         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 270         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 272                                            .len = NL80211_MAX_SUPP_RATES },
 273         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 274
 275         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 276         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 277
 278         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 279
 280         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 281         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 282                               .len = IEEE80211_MAX_DATA_LEN },
 283         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 284         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 285
 286         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 287                                 .len = IEEE80211_MAX_SSID_LEN },
 288         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 289         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 290         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 291         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 293         [NL80211_ATTR_STA_FLAGS2] = {
 294                 .len = sizeof(struct nl80211_sta_flag_update),
 295         },
 296         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 298         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 299         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 301         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 302         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 303         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 304         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 305                                  .len = WLAN_PMKID_LEN },
 306         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 307         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 308         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 309         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 310                                  .len = IEEE80211_MAX_DATA_LEN },
 311         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 312         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 313         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 314         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 316         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 317         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 318         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 319         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 320         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 321         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 323         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 324         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 326         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 330         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 333                                          .len = IEEE80211_MAX_DATA_LEN },
 334         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 336         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 339         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 342         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 345                                       .len = IEEE80211_MAX_DATA_LEN },
 346         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 348         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 349                 .len = NL80211_HT_CAPABILITY_LEN
 350         },
 351         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 352         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 353         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 354         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 355         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 356         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 357         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 358         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 359         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 360         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 361         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 362         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 363         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 364         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 366         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 367         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 368                 .len = NL80211_VHT_CAPABILITY_LEN,
 369         },
 370         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 371         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 372                                   .len = IEEE80211_MAX_DATA_LEN },
 373         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 374         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 375         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 376         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 377         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 378         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 381         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 382         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 383         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 384         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 385         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 386         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 387                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 388         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 389         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 390         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 391         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 392         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 393         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 394         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 395         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 396         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 397         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 398         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 399 };
 400
 401 /* policy for the key attributes */
 402 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 403         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 404         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 405         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 406         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 407         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 408         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 409         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 410         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 411 };
 412
 413 /* policy for the key default flags */
 414 static const struct nla_policy
 415 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 416         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 417         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 418 };
 419
 420 /* policy for WoWLAN attributes */
 421 static const struct nla_policy
 422 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 423         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 424         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 425         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 426         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 427         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 428         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 429         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 430         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 431         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 432         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 433 };
 434
 435 static const struct nla_policy
 436 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 437         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 438         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 439         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 440         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 441         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 442         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 443         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 444                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 445         },
 446         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 447                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 448         },
 449         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 450         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 451         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 452 };
 453
 454 /* policy for coalesce rule attributes */
 455 static const struct nla_policy
 456 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 457         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 458         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 459         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 460 };
 461
 462 /* policy for GTK rekey offload attributes */
 463 static const struct nla_policy
 464 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 465         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 466         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 467         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 468 };
 469
 470 static const struct nla_policy
 471 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 472         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 473                                                  .len = IEEE80211_MAX_SSID_LEN },
 474         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 475 };
 476
 477 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 478                                      struct netlink_callback *cb,
 479                                      struct cfg80211_registered_device **rdev,
 480                                      struct wireless_dev **wdev)
 481 {
 482         int err;
 483
 484         rtnl_lock();
 485
 486         if (!cb->args[0]) {
 487                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 488                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 489                                   nl80211_policy);
 490                 if (err)
 491                         goto out_unlock;
 492
 493                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 494                                                    nl80211_fam.attrbuf);
 495                 if (IS_ERR(*wdev)) {
 496                         err = PTR_ERR(*wdev);
 497                         goto out_unlock;
 498                 }
 499                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 500                 /* 0 is the first index - add 1 to parse only once */
 501                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 502                 cb->args[1] = (*wdev)->identifier;
 503         } else {
 504                 /* subtract the 1 again here */
 505                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 506                 struct wireless_dev *tmp;
 507
 508                 if (!wiphy) {
 509                         err = -ENODEV;
 510                         goto out_unlock;
 511                 }
 512                 *rdev = wiphy_to_rdev(wiphy);
 513                 *wdev = NULL;
 514
 515                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 516                         if (tmp->identifier == cb->args[1]) {
 517                                 *wdev = tmp;
 518                                 break;
 519                         }
 520                 }
 521
 522                 if (!*wdev) {
 523                         err = -ENODEV;
 524                         goto out_unlock;
 525                 }
 526         }
 527
 528         return 0;
 529  out_unlock:
 530         rtnl_unlock();
 531         return err;
 532 }
 533
 534 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 535 {
 536         rtnl_unlock();
 537 }
 538
 539 /* IE validation */
 540 static bool is_valid_ie_attr(const struct nlattr *attr)
 541 {
 542         const u8 *pos;
 543         int len;
 544
 545         if (!attr)
 546                 return true;
 547
 548         pos = nla_data(attr);
 549         len = nla_len(attr);
 550
 551         while (len) {
 552                 u8 elemlen;
 553
 554                 if (len < 2)
 555                         return false;
 556                 len -= 2;
 557
 558                 elemlen = pos[1];
 559                 if (elemlen > len)
 560                         return false;
 561
 562                 len -= elemlen;
 563                 pos += 2 + elemlen;
 564         }
 565
 566         return true;
 567 }
 568
 569 /* message building helper */
 570 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 571                                    int flags, u8 cmd)
 572 {
 573         /* since there is no private header just add the generic one */
 574         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 575 }
 576
 577 static int nl80211_msg_put_channel(struct sk_buff *msg,
 578                                    struct ieee80211_channel *chan,
 579                                    bool large)
 580 {
 581         /* Some channels must be completely excluded from the
 582          * list to protect old user-space tools from breaking
 583          */
 584         if (!large && chan->flags &
 585             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 586                 return 0;
 587
 588         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 589                         chan->center_freq))
 590                 goto nla_put_failure;
 591
 592         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 593             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 594                 goto nla_put_failure;
 595         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 596                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 597                         goto nla_put_failure;
 598                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 599                         goto nla_put_failure;
 600         }
 601         if (chan->flags & IEEE80211_CHAN_RADAR) {
 602                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 603                         goto nla_put_failure;
 604                 if (large) {
 605                         u32 time;
 606
 607                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 608
 609                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 610                                         chan->dfs_state))
 611                                 goto nla_put_failure;
 612                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 613                                         time))
 614                                 goto nla_put_failure;
 615                         if (nla_put_u32(msg,
 616                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 617                                         chan->dfs_cac_ms))
 618                                 goto nla_put_failure;
 619                 }
 620         }
 621
 622         if (large) {
 623                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 624                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 625                         goto nla_put_failure;
 626                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 627                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 628                         goto nla_put_failure;
 629                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 630                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 631                         goto nla_put_failure;
 632                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 633                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 634                         goto nla_put_failure;
 635                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 636                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 637                         goto nla_put_failure;
 638                 if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
 639                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
 640                         goto nla_put_failure;
 641                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 642                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 643                         goto nla_put_failure;
 644                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 645                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 646                         goto nla_put_failure;
 647         }
 648
 649         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 650                         DBM_TO_MBM(chan->max_power)))
 651                 goto nla_put_failure;
 652
 653         return 0;
 654
 655  nla_put_failure:
 656         return -ENOBUFS;
 657 }
 658
 659 /* netlink command implementations */
 660
 661 struct key_parse {
 662         struct key_params p;
 663         int idx;
 664         int type;
 665         bool def, defmgmt;
 666         bool def_uni, def_multi;
 667 };
 668
 669 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 670 {
 671         struct nlattr *tb[NL80211_KEY_MAX + 1];
 672         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 673                                    nl80211_key_policy);
 674         if (err)
 675                 return err;
 676
 677         k->def = !!tb[NL80211_KEY_DEFAULT];
 678         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 679
 680         if (k->def) {
 681                 k->def_uni = true;
 682                 k->def_multi = true;
 683         }
 684         if (k->defmgmt)
 685                 k->def_multi = true;
 686
 687         if (tb[NL80211_KEY_IDX])
 688                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 689
 690         if (tb[NL80211_KEY_DATA]) {
 691                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 692                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 693         }
 694
 695         if (tb[NL80211_KEY_SEQ]) {
 696                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 697                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 698         }
 699
 700         if (tb[NL80211_KEY_CIPHER])
 701                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 702
 703         if (tb[NL80211_KEY_TYPE]) {
 704                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 705                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 706                         return -EINVAL;
 707         }
 708
 709         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 710                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 711                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 712                                        tb[NL80211_KEY_DEFAULT_TYPES],
 713                                        nl80211_key_default_policy);
 714                 if (err)
 715                         return err;
 716
 717                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 718                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 719         }
 720
 721         return 0;
 722 }
 723
 724 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 725 {
 726         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 727                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 728                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 729         }
 730
 731         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 732                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 733                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 734         }
 735
 736         if (info->attrs[NL80211_ATTR_KEY_IDX])
 737                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 738
 739         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 740                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 741
 742         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 743         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 744
 745         if (k->def) {
 746                 k->def_uni = true;
 747                 k->def_multi = true;
 748         }
 749         if (k->defmgmt)
 750                 k->def_multi = true;
 751
 752         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 753                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 754                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 755                         return -EINVAL;
 756         }
 757
 758         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 759                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 760                 int err = nla_parse_nested(
 761                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 762                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 763                                 nl80211_key_default_policy);
 764                 if (err)
 765                         return err;
 766
 767                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 768                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 769         }
 770
 771         return 0;
 772 }
 773
 774 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 775 {
 776         int err;
 777
 778         memset(k, 0, sizeof(*k));
 779         k->idx = -1;
 780         k->type = -1;
 781
 782         if (info->attrs[NL80211_ATTR_KEY])
 783                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 784         else
 785                 err = nl80211_parse_key_old(info, k);
 786
 787         if (err)
 788                 return err;
 789
 790         if (k->def && k->defmgmt)
 791                 return -EINVAL;
 792
 793         if (k->defmgmt) {
 794                 if (k->def_uni || !k->def_multi)
 795                         return -EINVAL;
 796         }
 797
 798         if (k->idx != -1) {
 799                 if (k->defmgmt) {
 800                         if (k->idx < 4 || k->idx > 5)
 801                                 return -EINVAL;
 802                 } else if (k->def) {
 803                         if (k->idx < 0 || k->idx > 3)
 804                                 return -EINVAL;
 805                 } else {
 806                         if (k->idx < 0 || k->idx > 5)
 807                                 return -EINVAL;
 808                 }
 809         }
 810
 811         return 0;
 812 }
 813
 814 static struct cfg80211_cached_keys *
 815 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 816                        struct nlattr *keys, bool *no_ht)
 817 {
 818         struct key_parse parse;
 819         struct nlattr *key;
 820         struct cfg80211_cached_keys *result;
 821         int rem, err, def = 0;
 822
 823         result = kzalloc(sizeof(*result), GFP_KERNEL);
 824         if (!result)
 825                 return ERR_PTR(-ENOMEM);
 826
 827         result->def = -1;
 828         result->defmgmt = -1;
 829
 830         nla_for_each_nested(key, keys, rem) {
 831                 memset(&parse, 0, sizeof(parse));
 832                 parse.idx = -1;
 833
 834                 err = nl80211_parse_key_new(key, &parse);
 835                 if (err)
 836                         goto error;
 837                 err = -EINVAL;
 838                 if (!parse.p.key)
 839                         goto error;
 840                 if (parse.idx < 0 || parse.idx > 4)
 841                         goto error;
 842                 if (parse.def) {
 843                         if (def)
 844                                 goto error;
 845                         def = 1;
 846                         result->def = parse.idx;
 847                         if (!parse.def_uni || !parse.def_multi)
 848                                 goto error;
 849                 } else if (parse.defmgmt)
 850                         goto error;
 851                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 852                                                      parse.idx, false, NULL);
 853                 if (err)
 854                         goto error;
 855                 result->params[parse.idx].cipher = parse.p.cipher;
 856                 result->params[parse.idx].key_len = parse.p.key_len;
 857                 result->params[parse.idx].key = result->data[parse.idx];
 858                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 859
 860                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 861                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 862                         if (no_ht)
 863                                 *no_ht = true;
 864                 }
 865         }
 866
 867         return result;
 868  error:
 869         kfree(result);
 870         return ERR_PTR(err);
 871 }
 872
 873 static int nl80211_key_allowed(struct wireless_dev *wdev)
 874 {
 875         ASSERT_WDEV_LOCK(wdev);
 876
 877         switch (wdev->iftype) {
 878         case NL80211_IFTYPE_AP:
 879         case NL80211_IFTYPE_AP_VLAN:
 880         case NL80211_IFTYPE_P2P_GO:
 881         case NL80211_IFTYPE_MESH_POINT:
 882                 break;
 883         case NL80211_IFTYPE_ADHOC:
 884         case NL80211_IFTYPE_STATION:
 885         case NL80211_IFTYPE_P2P_CLIENT:
 886                 if (!wdev->current_bss)
 887                         return -ENOLINK;
 888                 break;
 889         case NL80211_IFTYPE_UNSPECIFIED:
 890         case NL80211_IFTYPE_OCB:
 891         case NL80211_IFTYPE_MONITOR:
 892         case NL80211_IFTYPE_P2P_DEVICE:
 893         case NL80211_IFTYPE_WDS:
 894         case NUM_NL80211_IFTYPES:
 895                 return -EINVAL;
 896         }
 897
 898         return 0;
 899 }
 900
 901 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 902                                                         struct nlattr *tb)
 903 {
 904         struct ieee80211_channel *chan;
 905
 906         if (tb == NULL)
 907                 return NULL;
 908         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 909         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 910                 return NULL;
 911         return chan;
 912 }
 913
 914 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 915 {
 916         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 917         int i;
 918
 919         if (!nl_modes)
 920                 goto nla_put_failure;
 921
 922         i = 0;
 923         while (ifmodes) {
 924                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 925                         goto nla_put_failure;
 926                 ifmodes >>= 1;
 927                 i++;
 928         }
 929
 930         nla_nest_end(msg, nl_modes);
 931         return 0;
 932
 933 nla_put_failure:
 934         return -ENOBUFS;
 935 }
 936
 937 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 938                                           struct sk_buff *msg,
 939                                           bool large)
 940 {
 941         struct nlattr *nl_combis;
 942         int i, j;
 943
 944         nl_combis = nla_nest_start(msg,
 945                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 946         if (!nl_combis)
 947                 goto nla_put_failure;
 948
 949         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 950                 const struct ieee80211_iface_combination *c;
 951                 struct nlattr *nl_combi, *nl_limits;
 952
 953                 c = &wiphy->iface_combinations[i];
 954
 955                 nl_combi = nla_nest_start(msg, i + 1);
 956                 if (!nl_combi)
 957                         goto nla_put_failure;
 958
 959                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 960                 if (!nl_limits)
 961                         goto nla_put_failure;
 962
 963                 for (j = 0; j < c->n_limits; j++) {
 964                         struct nlattr *nl_limit;
 965
 966                         nl_limit = nla_nest_start(msg, j + 1);
 967                         if (!nl_limit)
 968                                 goto nla_put_failure;
 969                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 970                                         c->limits[j].max))
 971                                 goto nla_put_failure;
 972                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 973                                                 c->limits[j].types))
 974                                 goto nla_put_failure;
 975                         nla_nest_end(msg, nl_limit);
 976                 }
 977
 978                 nla_nest_end(msg, nl_limits);
 979
 980                 if (c->beacon_int_infra_match &&
 981                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 982                         goto nla_put_failure;
 983                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 984                                 c->num_different_channels) ||
 985                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 986                                 c->max_interfaces))
 987                         goto nla_put_failure;
 988                 if (large &&
 989                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 990                                 c->radar_detect_widths) ||
 991                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
 992                                 c->radar_detect_regions)))
 993                         goto nla_put_failure;
 994
 995                 nla_nest_end(msg, nl_combi);
 996         }
 997
 998         nla_nest_end(msg, nl_combis);
 999
1000         return 0;
1001 nla_put_failure:
1002         return -ENOBUFS;
1003 }
1004
1005 #ifdef CONFIG_PM
1006 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1007                                         struct sk_buff *msg)
1008 {
1009         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1010         struct nlattr *nl_tcp;
1011
1012         if (!tcp)
1013                 return 0;
1014
1015         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1016         if (!nl_tcp)
1017                 return -ENOBUFS;
1018
1019         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1020                         tcp->data_payload_max))
1021                 return -ENOBUFS;
1022
1023         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1024                         tcp->data_payload_max))
1025                 return -ENOBUFS;
1026
1027         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1028                 return -ENOBUFS;
1029
1030         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1031                                 sizeof(*tcp->tok), tcp->tok))
1032                 return -ENOBUFS;
1033
1034         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1035                         tcp->data_interval_max))
1036                 return -ENOBUFS;
1037
1038         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1039                         tcp->wake_payload_max))
1040                 return -ENOBUFS;
1041
1042         nla_nest_end(msg, nl_tcp);
1043         return 0;
1044 }
1045
1046 static int nl80211_send_wowlan(struct sk_buff *msg,
1047                                struct cfg80211_registered_device *rdev,
1048                                bool large)
1049 {
1050         struct nlattr *nl_wowlan;
1051
1052         if (!rdev->wiphy.wowlan)
1053                 return 0;
1054
1055         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1056         if (!nl_wowlan)
1057                 return -ENOBUFS;
1058
1059         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1060              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1061             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1062              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1063             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1064              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1065             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1066              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1067             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1068              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1069             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1070              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1071             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1072              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1073             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1074              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1075                 return -ENOBUFS;
1076
1077         if (rdev->wiphy.wowlan->n_patterns) {
1078                 struct nl80211_pattern_support pat = {
1079                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1080                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1081                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1082                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1083                 };
1084
1085                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1086                             sizeof(pat), &pat))
1087                         return -ENOBUFS;
1088         }
1089
1090         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1091                 return -ENOBUFS;
1092
1093         /* TODO: send wowlan net detect */
1094
1095         nla_nest_end(msg, nl_wowlan);
1096
1097         return 0;
1098 }
1099 #endif
1100
1101 static int nl80211_send_coalesce(struct sk_buff *msg,
1102                                  struct cfg80211_registered_device *rdev)
1103 {
1104         struct nl80211_coalesce_rule_support rule;
1105
1106         if (!rdev->wiphy.coalesce)
1107                 return 0;
1108
1109         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1110         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1111         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1112         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1113         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1114         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1115
1116         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1117                 return -ENOBUFS;
1118
1119         return 0;
1120 }
1121
1122 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1123                                       struct ieee80211_supported_band *sband)
1124 {
1125         struct nlattr *nl_rates, *nl_rate;
1126         struct ieee80211_rate *rate;
1127         int i;
1128
1129         /* add HT info */
1130         if (sband->ht_cap.ht_supported &&
1131             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1132                      sizeof(sband->ht_cap.mcs),
1133                      &sband->ht_cap.mcs) ||
1134              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1135                          sband->ht_cap.cap) ||
1136              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1137                         sband->ht_cap.ampdu_factor) ||
1138              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1139                         sband->ht_cap.ampdu_density)))
1140                 return -ENOBUFS;
1141
1142         /* add VHT info */
1143         if (sband->vht_cap.vht_supported &&
1144             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1145                      sizeof(sband->vht_cap.vht_mcs),
1146                      &sband->vht_cap.vht_mcs) ||
1147              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1148                          sband->vht_cap.cap)))
1149                 return -ENOBUFS;
1150
1151         /* add bitrates */
1152         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1153         if (!nl_rates)
1154                 return -ENOBUFS;
1155
1156         for (i = 0; i < sband->n_bitrates; i++) {
1157                 nl_rate = nla_nest_start(msg, i);
1158                 if (!nl_rate)
1159                         return -ENOBUFS;
1160
1161                 rate = &sband->bitrates[i];
1162                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1163                                 rate->bitrate))
1164                         return -ENOBUFS;
1165                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1166                     nla_put_flag(msg,
1167                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1168                         return -ENOBUFS;
1169
1170                 nla_nest_end(msg, nl_rate);
1171         }
1172
1173         nla_nest_end(msg, nl_rates);
1174
1175         return 0;
1176 }
1177
1178 static int
1179 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1180                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1181 {
1182         u16 stypes;
1183         struct nlattr *nl_ftypes, *nl_ifs;
1184         enum nl80211_iftype ift;
1185         int i;
1186
1187         if (!mgmt_stypes)
1188                 return 0;
1189
1190         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1191         if (!nl_ifs)
1192                 return -ENOBUFS;
1193
1194         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1195                 nl_ftypes = nla_nest_start(msg, ift);
1196                 if (!nl_ftypes)
1197                         return -ENOBUFS;
1198                 i = 0;
1199                 stypes = mgmt_stypes[ift].tx;
1200                 while (stypes) {
1201                         if ((stypes & 1) &&
1202                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1203                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1204                                 return -ENOBUFS;
1205                         stypes >>= 1;
1206                         i++;
1207                 }
1208                 nla_nest_end(msg, nl_ftypes);
1209         }
1210
1211         nla_nest_end(msg, nl_ifs);
1212
1213         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1214         if (!nl_ifs)
1215                 return -ENOBUFS;
1216
1217         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1218                 nl_ftypes = nla_nest_start(msg, ift);
1219                 if (!nl_ftypes)
1220                         return -ENOBUFS;
1221                 i = 0;
1222                 stypes = mgmt_stypes[ift].rx;
1223                 while (stypes) {
1224                         if ((stypes & 1) &&
1225                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1226                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1227                                 return -ENOBUFS;
1228                         stypes >>= 1;
1229                         i++;
1230                 }
1231                 nla_nest_end(msg, nl_ftypes);
1232         }
1233         nla_nest_end(msg, nl_ifs);
1234
1235         return 0;
1236 }
1237
1238 struct nl80211_dump_wiphy_state {
1239         s64 filter_wiphy;
1240         long start;
1241         long split_start, band_start, chan_start;
1242         bool split;
1243 };
1244
1245 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1246                               enum nl80211_commands cmd,
1247                               struct sk_buff *msg, u32 portid, u32 seq,
1248                               int flags, struct nl80211_dump_wiphy_state *state)
1249 {
1250         void *hdr;
1251         struct nlattr *nl_bands, *nl_band;
1252         struct nlattr *nl_freqs, *nl_freq;
1253         struct nlattr *nl_cmds;
1254         enum ieee80211_band band;
1255         struct ieee80211_channel *chan;
1256         int i;
1257         const struct ieee80211_txrx_stypes *mgmt_stypes =
1258                                 rdev->wiphy.mgmt_stypes;
1259         u32 features;
1260
1261         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1262         if (!hdr)
1263                 return -ENOBUFS;
1264
1265         if (WARN_ON(!state))
1266                 return -EINVAL;
1267
1268         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1269             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1270                            wiphy_name(&rdev->wiphy)) ||
1271             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1272                         cfg80211_rdev_list_generation))
1273                 goto nla_put_failure;
1274
1275         if (cmd != NL80211_CMD_NEW_WIPHY)
1276                 goto finish;
1277
1278         switch (state->split_start) {
1279         case 0:
1280                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1281                                rdev->wiphy.retry_short) ||
1282                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1283                                rdev->wiphy.retry_long) ||
1284                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1285                                 rdev->wiphy.frag_threshold) ||
1286                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1287                                 rdev->wiphy.rts_threshold) ||
1288                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1289                                rdev->wiphy.coverage_class) ||
1290                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1291                                rdev->wiphy.max_scan_ssids) ||
1292                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1293                                rdev->wiphy.max_sched_scan_ssids) ||
1294                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1295                                 rdev->wiphy.max_scan_ie_len) ||
1296                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1297                                 rdev->wiphy.max_sched_scan_ie_len) ||
1298                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1299                                rdev->wiphy.max_match_sets))
1300                         goto nla_put_failure;
1301
1302                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1303                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1304                         goto nla_put_failure;
1305                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1306                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1307                         goto nla_put_failure;
1308                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1309                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1310                         goto nla_put_failure;
1311                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1312                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1313                         goto nla_put_failure;
1314                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1315                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1316                         goto nla_put_failure;
1317                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1318                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1319                         goto nla_put_failure;
1320                 state->split_start++;
1321                 if (state->split)
1322                         break;
1323         case 1:
1324                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1325                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1326                             rdev->wiphy.cipher_suites))
1327                         goto nla_put_failure;
1328
1329                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1330                                rdev->wiphy.max_num_pmkids))
1331                         goto nla_put_failure;
1332
1333                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1334                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1335                         goto nla_put_failure;
1336
1337                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1338                                 rdev->wiphy.available_antennas_tx) ||
1339                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1340                                 rdev->wiphy.available_antennas_rx))
1341                         goto nla_put_failure;
1342
1343                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1344                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1345                                 rdev->wiphy.probe_resp_offload))
1346                         goto nla_put_failure;
1347
1348                 if ((rdev->wiphy.available_antennas_tx ||
1349                      rdev->wiphy.available_antennas_rx) &&
1350                     rdev->ops->get_antenna) {
1351                         u32 tx_ant = 0, rx_ant = 0;
1352                         int res;
1353                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1354                         if (!res) {
1355                                 if (nla_put_u32(msg,
1356                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1357                                                 tx_ant) ||
1358                                     nla_put_u32(msg,
1359                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1360                                                 rx_ant))
1361                                         goto nla_put_failure;
1362                         }
1363                 }
1364
1365                 state->split_start++;
1366                 if (state->split)
1367                         break;
1368         case 2:
1369                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1370                                         rdev->wiphy.interface_modes))
1371                                 goto nla_put_failure;
1372                 state->split_start++;
1373                 if (state->split)
1374                         break;
1375         case 3:
1376                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1377                 if (!nl_bands)
1378                         goto nla_put_failure;
1379
1380                 for (band = state->band_start;
1381                      band < IEEE80211_NUM_BANDS; band++) {
1382                         struct ieee80211_supported_band *sband;
1383
1384                         sband = rdev->wiphy.bands[band];
1385
1386                         if (!sband)
1387                                 continue;
1388
1389                         nl_band = nla_nest_start(msg, band);
1390                         if (!nl_band)
1391                                 goto nla_put_failure;
1392
1393                         switch (state->chan_start) {
1394                         case 0:
1395                                 if (nl80211_send_band_rateinfo(msg, sband))
1396                                         goto nla_put_failure;
1397                                 state->chan_start++;
1398                                 if (state->split)
1399                                         break;
1400                         default:
1401                                 /* add frequencies */
1402                                 nl_freqs = nla_nest_start(
1403                                         msg, NL80211_BAND_ATTR_FREQS);
1404                                 if (!nl_freqs)
1405                                         goto nla_put_failure;
1406
1407                                 for (i = state->chan_start - 1;
1408                                      i < sband->n_channels;
1409                                      i++) {
1410                                         nl_freq = nla_nest_start(msg, i);
1411                                         if (!nl_freq)
1412                                                 goto nla_put_failure;
1413
1414                                         chan = &sband->channels[i];
1415
1416                                         if (nl80211_msg_put_channel(
1417                                                         msg, chan,
1418                                                         state->split))
1419                                                 goto nla_put_failure;
1420
1421                                         nla_nest_end(msg, nl_freq);
1422                                         if (state->split)
1423                                                 break;
1424                                 }
1425                                 if (i < sband->n_channels)
1426                                         state->chan_start = i + 2;
1427                                 else
1428                                         state->chan_start = 0;
1429                                 nla_nest_end(msg, nl_freqs);
1430                         }
1431
1432                         nla_nest_end(msg, nl_band);
1433
1434                         if (state->split) {
1435                                 /* start again here */
1436                                 if (state->chan_start)
1437                                         band--;
1438                                 break;
1439                         }
1440                 }
1441                 nla_nest_end(msg, nl_bands);
1442
1443                 if (band < IEEE80211_NUM_BANDS)
1444                         state->band_start = band + 1;
1445                 else
1446                         state->band_start = 0;
1447
1448                 /* if bands & channels are done, continue outside */
1449                 if (state->band_start == 0 && state->chan_start == 0)
1450                         state->split_start++;
1451                 if (state->split)
1452                         break;
1453         case 4:
1454                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1455                 if (!nl_cmds)
1456                         goto nla_put_failure;
1457
1458                 i = 0;
1459 #define CMD(op, n)                                                      \
1460                  do {                                                   \
1461                         if (rdev->ops->op) {                            \
1462                                 i++;                                    \
1463                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1464                                         goto nla_put_failure;           \
1465                         }                                               \
1466                 } while (0)
1467
1468                 CMD(add_virtual_intf, NEW_INTERFACE);
1469                 CMD(change_virtual_intf, SET_INTERFACE);
1470                 CMD(add_key, NEW_KEY);
1471                 CMD(start_ap, START_AP);
1472                 CMD(add_station, NEW_STATION);
1473                 CMD(add_mpath, NEW_MPATH);
1474                 CMD(update_mesh_config, SET_MESH_CONFIG);
1475                 CMD(change_bss, SET_BSS);
1476                 CMD(auth, AUTHENTICATE);
1477                 CMD(assoc, ASSOCIATE);
1478                 CMD(deauth, DEAUTHENTICATE);
1479                 CMD(disassoc, DISASSOCIATE);
1480                 CMD(join_ibss, JOIN_IBSS);
1481                 CMD(join_mesh, JOIN_MESH);
1482                 CMD(set_pmksa, SET_PMKSA);
1483                 CMD(del_pmksa, DEL_PMKSA);
1484                 CMD(flush_pmksa, FLUSH_PMKSA);
1485                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1486                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1487                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1488                 CMD(mgmt_tx, FRAME);
1489                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1490                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1491                         i++;
1492                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1493                                 goto nla_put_failure;
1494                 }
1495                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1496                     rdev->ops->join_mesh) {
1497                         i++;
1498                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1499                                 goto nla_put_failure;
1500                 }
1501                 CMD(set_wds_peer, SET_WDS_PEER);
1502                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1503                         CMD(tdls_mgmt, TDLS_MGMT);
1504                         CMD(tdls_oper, TDLS_OPER);
1505                 }
1506                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1507                         CMD(sched_scan_start, START_SCHED_SCAN);
1508                 CMD(probe_client, PROBE_CLIENT);
1509                 CMD(set_noack_map, SET_NOACK_MAP);
1510                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1511                         i++;
1512                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1513                                 goto nla_put_failure;
1514                 }
1515                 CMD(start_p2p_device, START_P2P_DEVICE);
1516                 CMD(set_mcast_rate, SET_MCAST_RATE);
1517 #ifdef CONFIG_NL80211_TESTMODE
1518                 CMD(testmode_cmd, TESTMODE);
1519 #endif
1520                 if (state->split) {
1521                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1522                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1523                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1524                                 CMD(channel_switch, CHANNEL_SWITCH);
1525                         CMD(set_qos_map, SET_QOS_MAP);
1526                         if (rdev->wiphy.features &
1527                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1528                                 CMD(add_tx_ts, ADD_TX_TS);
1529                 }
1530                 /* add into the if now */
1531 #undef CMD
1532
1533                 if (rdev->ops->connect || rdev->ops->auth) {
1534                         i++;
1535                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1536                                 goto nla_put_failure;
1537                 }
1538
1539                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1540                         i++;
1541                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1542                                 goto nla_put_failure;
1543                 }
1544
1545                 nla_nest_end(msg, nl_cmds);
1546                 state->split_start++;
1547                 if (state->split)
1548                         break;
1549         case 5:
1550                 if (rdev->ops->remain_on_channel &&
1551                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1552                     nla_put_u32(msg,
1553                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1554                                 rdev->wiphy.max_remain_on_channel_duration))
1555                         goto nla_put_failure;
1556
1557                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1558                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1559                         goto nla_put_failure;
1560
1561                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1562                         goto nla_put_failure;
1563                 state->split_start++;
1564                 if (state->split)
1565                         break;
1566         case 6:
1567 #ifdef CONFIG_PM
1568                 if (nl80211_send_wowlan(msg, rdev, state->split))
1569                         goto nla_put_failure;
1570                 state->split_start++;
1571                 if (state->split)
1572                         break;
1573 #else
1574                 state->split_start++;
1575 #endif
1576         case 7:
1577                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1578                                         rdev->wiphy.software_iftypes))
1579                         goto nla_put_failure;
1580
1581                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1582                                                    state->split))
1583                         goto nla_put_failure;
1584
1585                 state->split_start++;
1586                 if (state->split)
1587                         break;
1588         case 8:
1589                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1590                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1591                                 rdev->wiphy.ap_sme_capa))
1592                         goto nla_put_failure;
1593
1594                 features = rdev->wiphy.features;
1595                 /*
1596                  * We can only add the per-channel limit information if the
1597                  * dump is split, otherwise it makes it too big. Therefore
1598                  * only advertise it in that case.
1599                  */
1600                 if (state->split)
1601                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1602                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1603                         goto nla_put_failure;
1604
1605                 if (rdev->wiphy.ht_capa_mod_mask &&
1606                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1607                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1608                             rdev->wiphy.ht_capa_mod_mask))
1609                         goto nla_put_failure;
1610
1611                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1612                     rdev->wiphy.max_acl_mac_addrs &&
1613                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1614                                 rdev->wiphy.max_acl_mac_addrs))
1615                         goto nla_put_failure;
1616
1617                 /*
1618                  * Any information below this point is only available to
1619                  * applications that can deal with it being split. This
1620                  * helps ensure that newly added capabilities don't break
1621                  * older tools by overrunning their buffers.
1622                  *
1623                  * We still increment split_start so that in the split
1624                  * case we'll continue with more data in the next round,
1625                  * but break unconditionally so unsplit data stops here.
1626                  */
1627                 state->split_start++;
1628                 break;
1629         case 9:
1630                 if (rdev->wiphy.extended_capabilities &&
1631                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1632                              rdev->wiphy.extended_capabilities_len,
1633                              rdev->wiphy.extended_capabilities) ||
1634                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1635                              rdev->wiphy.extended_capabilities_len,
1636                              rdev->wiphy.extended_capabilities_mask)))
1637                         goto nla_put_failure;
1638
1639                 if (rdev->wiphy.vht_capa_mod_mask &&
1640                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1641                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1642                             rdev->wiphy.vht_capa_mod_mask))
1643                         goto nla_put_failure;
1644
1645                 state->split_start++;
1646                 break;
1647         case 10:
1648                 if (nl80211_send_coalesce(msg, rdev))
1649                         goto nla_put_failure;
1650
1651                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1652                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1653                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1654                         goto nla_put_failure;
1655
1656                 if (rdev->wiphy.max_ap_assoc_sta &&
1657                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1658                                 rdev->wiphy.max_ap_assoc_sta))
1659                         goto nla_put_failure;
1660
1661                 state->split_start++;
1662                 break;
1663         case 11:
1664                 if (rdev->wiphy.n_vendor_commands) {
1665                         const struct nl80211_vendor_cmd_info *info;
1666                         struct nlattr *nested;
1667
1668                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1669                         if (!nested)
1670                                 goto nla_put_failure;
1671
1672                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1673                                 info = &rdev->wiphy.vendor_commands[i].info;
1674                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1675                                         goto nla_put_failure;
1676                         }
1677                         nla_nest_end(msg, nested);
1678                 }
1679
1680                 if (rdev->wiphy.n_vendor_events) {
1681                         const struct nl80211_vendor_cmd_info *info;
1682                         struct nlattr *nested;
1683
1684                         nested = nla_nest_start(msg,
1685                                                 NL80211_ATTR_VENDOR_EVENTS);
1686                         if (!nested)
1687                                 goto nla_put_failure;
1688
1689                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1690                                 info = &rdev->wiphy.vendor_events[i];
1691                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1692                                         goto nla_put_failure;
1693                         }
1694                         nla_nest_end(msg, nested);
1695                 }
1696                 state->split_start++;
1697                 break;
1698         case 12:
1699                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1700                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1701                                rdev->wiphy.max_num_csa_counters))
1702                         goto nla_put_failure;
1703
1704                 /* done */
1705                 state->split_start = 0;
1706                 break;
1707         }
1708  finish:
1709         return genlmsg_end(msg, hdr);
1710
1711  nla_put_failure:
1712         genlmsg_cancel(msg, hdr);
1713         return -EMSGSIZE;
1714 }
1715
1716 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1717                                     struct netlink_callback *cb,
1718                                     struct nl80211_dump_wiphy_state *state)
1719 {
1720         struct nlattr **tb = nl80211_fam.attrbuf;
1721         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1722                               tb, nl80211_fam.maxattr, nl80211_policy);
1723         /* ignore parse errors for backward compatibility */
1724         if (ret)
1725                 return 0;
1726
1727         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1728         if (tb[NL80211_ATTR_WIPHY])
1729                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1730         if (tb[NL80211_ATTR_WDEV])
1731                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1732         if (tb[NL80211_ATTR_IFINDEX]) {
1733                 struct net_device *netdev;
1734                 struct cfg80211_registered_device *rdev;
1735                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1736
1737                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1738                 if (!netdev)
1739                         return -ENODEV;
1740                 if (netdev->ieee80211_ptr) {
1741                         rdev = wiphy_to_rdev(
1742                                 netdev->ieee80211_ptr->wiphy);
1743                         state->filter_wiphy = rdev->wiphy_idx;
1744                 }
1745         }
1746
1747         return 0;
1748 }
1749
1750 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1751 {
1752         int idx = 0, ret;
1753         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1754         struct cfg80211_registered_device *rdev;
1755
1756         rtnl_lock();
1757         if (!state) {
1758                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1759                 if (!state) {
1760                         rtnl_unlock();
1761                         return -ENOMEM;
1762                 }
1763                 state->filter_wiphy = -1;
1764                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1765                 if (ret) {
1766                         kfree(state);
1767                         rtnl_unlock();
1768                         return ret;
1769                 }
1770                 cb->args[0] = (long)state;
1771         }
1772
1773         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1774                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1775                         continue;
1776                 if (++idx <= state->start)
1777                         continue;
1778                 if (state->filter_wiphy != -1 &&
1779                     state->filter_wiphy != rdev->wiphy_idx)
1780                         continue;
1781                 /* attempt to fit multiple wiphy data chunks into the skb */
1782                 do {
1783                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1784                                                  skb,
1785                                                  NETLINK_CB(cb->skb).portid,
1786                                                  cb->nlh->nlmsg_seq,
1787                                                  NLM_F_MULTI, state);
1788                         if (ret < 0) {
1789                                 /*
1790                                  * If sending the wiphy data didn't fit (ENOBUFS
1791                                  * or EMSGSIZE returned), this SKB is still
1792                                  * empty (so it's not too big because another
1793                                  * wiphy dataset is already in the skb) and
1794                                  * we've not tried to adjust the dump allocation
1795                                  * yet ... then adjust the alloc size to be
1796                                  * bigger, and return 1 but with the empty skb.
1797                                  * This results in an empty message being RX'ed
1798                                  * in userspace, but that is ignored.
1799                                  *
1800                                  * We can then retry with the larger buffer.
1801                                  */
1802                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1803                                     !skb->len && !state->split &&
1804                                     cb->min_dump_alloc < 4096) {
1805                                         cb->min_dump_alloc = 4096;
1806                                         state->split_start = 0;
1807                                         rtnl_unlock();
1808                                         return 1;
1809                                 }
1810                                 idx--;
1811                                 break;
1812                         }
1813                 } while (state->split_start > 0);
1814                 break;
1815         }
1816         rtnl_unlock();
1817
1818         state->start = idx;
1819
1820         return skb->len;
1821 }
1822
1823 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1824 {
1825         kfree((void *)cb->args[0]);
1826         return 0;
1827 }
1828
1829 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1830 {
1831         struct sk_buff *msg;
1832         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1833         struct nl80211_dump_wiphy_state state = {};
1834
1835         msg = nlmsg_new(4096, GFP_KERNEL);
1836         if (!msg)
1837                 return -ENOMEM;
1838
1839         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1840                                info->snd_portid, info->snd_seq, 0,
1841                                &state) < 0) {
1842                 nlmsg_free(msg);
1843                 return -ENOBUFS;
1844         }
1845
1846         return genlmsg_reply(msg, info);
1847 }
1848
1849 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1850         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1851         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1852         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1853         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1854         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1855 };
1856
1857 static int parse_txq_params(struct nlattr *tb[],
1858                             struct ieee80211_txq_params *txq_params)
1859 {
1860         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1861             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1862             !tb[NL80211_TXQ_ATTR_AIFS])
1863                 return -EINVAL;
1864
1865         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1866         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1867         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1868         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1869         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1870
1871         if (txq_params->ac >= NL80211_NUM_ACS)
1872                 return -EINVAL;
1873
1874         return 0;
1875 }
1876
1877 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1878 {
1879         /*
1880          * You can only set the channel explicitly for WDS interfaces,
1881          * all others have their channel managed via their respective
1882          * "establish a connection" command (connect, join, ...)
1883          *
1884          * For AP/GO and mesh mode, the channel can be set with the
1885          * channel userspace API, but is only stored and passed to the
1886          * low-level driver when the AP starts or the mesh is joined.
1887          * This is for backward compatibility, userspace can also give
1888          * the channel in the start-ap or join-mesh commands instead.
1889          *
1890          * Monitors are special as they are normally slaved to
1891          * whatever else is going on, so they have their own special
1892          * operation to set the monitor channel if possible.
1893          */
1894         return !wdev ||
1895                 wdev->iftype == NL80211_IFTYPE_AP ||
1896                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1897                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1898                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1899 }
1900
1901 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1902                                  struct genl_info *info,
1903                                  struct cfg80211_chan_def *chandef)
1904 {
1905         u32 control_freq;
1906
1907         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1908                 return -EINVAL;
1909
1910         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1911
1912         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1913         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1914         chandef->center_freq1 = control_freq;
1915         chandef->center_freq2 = 0;
1916
1917         /* Primary channel not allowed */
1918         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1919                 return -EINVAL;
1920
1921         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1922                 enum nl80211_channel_type chantype;
1923
1924                 chantype = nla_get_u32(
1925                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1926
1927                 switch (chantype) {
1928                 case NL80211_CHAN_NO_HT:
1929                 case NL80211_CHAN_HT20:
1930                 case NL80211_CHAN_HT40PLUS:
1931                 case NL80211_CHAN_HT40MINUS:
1932                         cfg80211_chandef_create(chandef, chandef->chan,
1933                                                 chantype);
1934                         break;
1935                 default:
1936                         return -EINVAL;
1937                 }
1938         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1939                 chandef->width =
1940                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1941                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1942                         chandef->center_freq1 =
1943                                 nla_get_u32(
1944                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1945                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1946                         chandef->center_freq2 =
1947                                 nla_get_u32(
1948                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1949         }
1950
1951         if (!cfg80211_chandef_valid(chandef))
1952                 return -EINVAL;
1953
1954         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1955                                      IEEE80211_CHAN_DISABLED))
1956                 return -EINVAL;
1957
1958         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1959              chandef->width == NL80211_CHAN_WIDTH_10) &&
1960             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1961                 return -EINVAL;
1962
1963         return 0;
1964 }
1965
1966 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1967                                  struct net_device *dev,
1968                                  struct genl_info *info)
1969 {
1970         struct cfg80211_chan_def chandef;
1971         int result;
1972         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1973         struct wireless_dev *wdev = NULL;
1974
1975         if (dev)
1976                 wdev = dev->ieee80211_ptr;
1977         if (!nl80211_can_set_dev_channel(wdev))
1978                 return -EOPNOTSUPP;
1979         if (wdev)
1980                 iftype = wdev->iftype;
1981
1982         result = nl80211_parse_chandef(rdev, info, &chandef);
1983         if (result)
1984                 return result;
1985
1986         switch (iftype) {
1987         case NL80211_IFTYPE_AP:
1988         case NL80211_IFTYPE_P2P_GO:
1989                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
1990                         result = -EINVAL;
1991                         break;
1992                 }
1993                 if (wdev->beacon_interval) {
1994                         if (!dev || !rdev->ops->set_ap_chanwidth ||
1995                             !(rdev->wiphy.features &
1996                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
1997                                 result = -EBUSY;
1998                                 break;
1999                         }
2000
2001                         /* Only allow dynamic channel width changes */
2002                         if (chandef.chan != wdev->preset_chandef.chan) {
2003                                 result = -EBUSY;
2004                                 break;
2005                         }
2006                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2007                         if (result)
2008                                 break;
2009                 }
2010                 wdev->preset_chandef = chandef;
2011                 result = 0;
2012                 break;
2013         case NL80211_IFTYPE_MESH_POINT:
2014                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2015                 break;
2016         case NL80211_IFTYPE_MONITOR:
2017                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2018                 break;
2019         default:
2020                 result = -EINVAL;
2021         }
2022
2023         return result;
2024 }
2025
2026 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2027 {
2028         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2029         struct net_device *netdev = info->user_ptr[1];
2030
2031         return __nl80211_set_channel(rdev, netdev, info);
2032 }
2033
2034 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2035 {
2036         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2037         struct net_device *dev = info->user_ptr[1];
2038         struct wireless_dev *wdev = dev->ieee80211_ptr;
2039         const u8 *bssid;
2040
2041         if (!info->attrs[NL80211_ATTR_MAC])
2042                 return -EINVAL;
2043
2044         if (netif_running(dev))
2045                 return -EBUSY;
2046
2047         if (!rdev->ops->set_wds_peer)
2048                 return -EOPNOTSUPP;
2049
2050         if (wdev->iftype != NL80211_IFTYPE_WDS)
2051                 return -EOPNOTSUPP;
2052
2053         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2054         return rdev_set_wds_peer(rdev, dev, bssid);
2055 }
2056
2057
2058 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2059 {
2060         struct cfg80211_registered_device *rdev;
2061         struct net_device *netdev = NULL;
2062         struct wireless_dev *wdev;
2063         int result = 0, rem_txq_params = 0;
2064         struct nlattr *nl_txq_params;
2065         u32 changed;
2066         u8 retry_short = 0, retry_long = 0;
2067         u32 frag_threshold = 0, rts_threshold = 0;
2068         u8 coverage_class = 0;
2069
2070         ASSERT_RTNL();
2071
2072         /*
2073          * Try to find the wiphy and netdev. Normally this
2074          * function shouldn't need the netdev, but this is
2075          * done for backward compatibility -- previously
2076          * setting the channel was done per wiphy, but now
2077          * it is per netdev. Previous userland like hostapd
2078          * also passed a netdev to set_wiphy, so that it is
2079          * possible to let that go to the right netdev!
2080          */
2081
2082         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2083                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2084
2085                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2086                 if (netdev && netdev->ieee80211_ptr)
2087                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2088                 else
2089                         netdev = NULL;
2090         }
2091
2092         if (!netdev) {
2093                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2094                                                   info->attrs);
2095                 if (IS_ERR(rdev))
2096                         return PTR_ERR(rdev);
2097                 wdev = NULL;
2098                 netdev = NULL;
2099                 result = 0;
2100         } else
2101                 wdev = netdev->ieee80211_ptr;
2102
2103         /*
2104          * end workaround code, by now the rdev is available
2105          * and locked, and wdev may or may not be NULL.
2106          */
2107
2108         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2109                 result = cfg80211_dev_rename(
2110                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2111
2112         if (result)
2113                 return result;
2114
2115         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2116                 struct ieee80211_txq_params txq_params;
2117                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2118
2119                 if (!rdev->ops->set_txq_params)
2120                         return -EOPNOTSUPP;
2121
2122                 if (!netdev)
2123                         return -EINVAL;
2124
2125                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2126                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2127                         return -EINVAL;
2128
2129                 if (!netif_running(netdev))
2130                         return -ENETDOWN;
2131
2132                 nla_for_each_nested(nl_txq_params,
2133                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2134                                     rem_txq_params) {
2135                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2136                                            nla_data(nl_txq_params),
2137                                            nla_len(nl_txq_params),
2138                                            txq_params_policy);
2139                         if (result)
2140                                 return result;
2141                         result = parse_txq_params(tb, &txq_params);
2142                         if (result)
2143                                 return result;
2144
2145                         result = rdev_set_txq_params(rdev, netdev,
2146                                                      &txq_params);
2147                         if (result)
2148                                 return result;
2149                 }
2150         }
2151
2152         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2153                 result = __nl80211_set_channel(
2154                         rdev,
2155                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2156                         info);
2157                 if (result)
2158                         return result;
2159         }
2160
2161         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2162                 struct wireless_dev *txp_wdev = wdev;
2163                 enum nl80211_tx_power_setting type;
2164                 int idx, mbm = 0;
2165
2166                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2167                         txp_wdev = NULL;
2168
2169                 if (!rdev->ops->set_tx_power)
2170                         return -EOPNOTSUPP;
2171
2172                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2173                 type = nla_get_u32(info->attrs[idx]);
2174
2175                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2176                     (type != NL80211_TX_POWER_AUTOMATIC))
2177                         return -EINVAL;
2178
2179                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2180                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2181                         mbm = nla_get_u32(info->attrs[idx]);
2182                 }
2183
2184                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2185                 if (result)
2186                         return result;
2187         }
2188
2189         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2190             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2191                 u32 tx_ant, rx_ant;
2192                 if ((!rdev->wiphy.available_antennas_tx &&
2193                      !rdev->wiphy.available_antennas_rx) ||
2194                     !rdev->ops->set_antenna)
2195                         return -EOPNOTSUPP;
2196
2197                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2198                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2199
2200                 /* reject antenna configurations which don't match the
2201                  * available antenna masks, except for the "all" mask */
2202                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2203                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2204                         return -EINVAL;
2205
2206                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2207                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2208
2209                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2210                 if (result)
2211                         return result;
2212         }
2213
2214         changed = 0;
2215
2216         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2217                 retry_short = nla_get_u8(
2218                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2219                 if (retry_short == 0)
2220                         return -EINVAL;
2221
2222                 changed |= WIPHY_PARAM_RETRY_SHORT;
2223         }
2224
2225         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2226                 retry_long = nla_get_u8(
2227                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2228                 if (retry_long == 0)
2229                         return -EINVAL;
2230
2231                 changed |= WIPHY_PARAM_RETRY_LONG;
2232         }
2233
2234         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2235                 frag_threshold = nla_get_u32(
2236                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2237                 if (frag_threshold < 256)
2238                         return -EINVAL;
2239
2240                 if (frag_threshold != (u32) -1) {
2241                         /*
2242                          * Fragments (apart from the last one) are required to
2243                          * have even length. Make the fragmentation code
2244                          * simpler by stripping LSB should someone try to use
2245                          * odd threshold value.
2246                          */
2247                         frag_threshold &= ~0x1;
2248                 }
2249                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2250         }
2251
2252         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2253                 rts_threshold = nla_get_u32(
2254                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2255                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2256         }
2257
2258         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2259                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2260                         return -EINVAL;
2261
2262                 coverage_class = nla_get_u8(
2263                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2264                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2265         }
2266
2267         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2268                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2269                         return -EOPNOTSUPP;
2270
2271                 changed |= WIPHY_PARAM_DYN_ACK;
2272         }
2273
2274         if (changed) {
2275                 u8 old_retry_short, old_retry_long;
2276                 u32 old_frag_threshold, old_rts_threshold;
2277                 u8 old_coverage_class;
2278
2279                 if (!rdev->ops->set_wiphy_params)
2280                         return -EOPNOTSUPP;
2281
2282                 old_retry_short = rdev->wiphy.retry_short;
2283                 old_retry_long = rdev->wiphy.retry_long;
2284                 old_frag_threshold = rdev->wiphy.frag_threshold;
2285                 old_rts_threshold = rdev->wiphy.rts_threshold;
2286                 old_coverage_class = rdev->wiphy.coverage_class;
2287
2288                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2289                         rdev->wiphy.retry_short = retry_short;
2290                 if (changed & WIPHY_PARAM_RETRY_LONG)
2291                         rdev->wiphy.retry_long = retry_long;
2292                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2293                         rdev->wiphy.frag_threshold = frag_threshold;
2294                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2295                         rdev->wiphy.rts_threshold = rts_threshold;
2296                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2297                         rdev->wiphy.coverage_class = coverage_class;
2298
2299                 result = rdev_set_wiphy_params(rdev, changed);
2300                 if (result) {
2301                         rdev->wiphy.retry_short = old_retry_short;
2302                         rdev->wiphy.retry_long = old_retry_long;
2303                         rdev->wiphy.frag_threshold = old_frag_threshold;
2304                         rdev->wiphy.rts_threshold = old_rts_threshold;
2305                         rdev->wiphy.coverage_class = old_coverage_class;
2306                 }
2307         }
2308         return 0;
2309 }
2310
2311 static inline u64 wdev_id(struct wireless_dev *wdev)
2312 {
2313         return (u64)wdev->identifier |
2314                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2315 }
2316
2317 static int nl80211_send_chandef(struct sk_buff *msg,
2318                                 const struct cfg80211_chan_def *chandef)
2319 {
2320         WARN_ON(!cfg80211_chandef_valid(chandef));
2321
2322         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2323                         chandef->chan->center_freq))
2324                 return -ENOBUFS;
2325         switch (chandef->width) {
2326         case NL80211_CHAN_WIDTH_20_NOHT:
2327         case NL80211_CHAN_WIDTH_20:
2328         case NL80211_CHAN_WIDTH_40:
2329                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2330                                 cfg80211_get_chandef_type(chandef)))
2331                         return -ENOBUFS;
2332                 break;
2333         default:
2334                 break;
2335         }
2336         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2337                 return -ENOBUFS;
2338         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2339                 return -ENOBUFS;
2340         if (chandef->center_freq2 &&
2341             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2342                 return -ENOBUFS;
2343         return 0;
2344 }
2345
2346 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2347                               struct cfg80211_registered_device *rdev,
2348                               struct wireless_dev *wdev, bool removal)
2349 {
2350         struct net_device *dev = wdev->netdev;
2351         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2352         void *hdr;
2353
2354         if (removal)
2355                 cmd = NL80211_CMD_DEL_INTERFACE;
2356
2357         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2358         if (!hdr)
2359                 return -1;
2360
2361         if (dev &&
2362             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2363              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2364                 goto nla_put_failure;
2365
2366         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2367             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2368             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2369             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2370             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2371                         rdev->devlist_generation ^
2372                         (cfg80211_rdev_list_generation << 2)))
2373                 goto nla_put_failure;
2374
2375         if (rdev->ops->get_channel) {
2376                 int ret;
2377                 struct cfg80211_chan_def chandef;
2378
2379                 ret = rdev_get_channel(rdev, wdev, &chandef);
2380                 if (ret == 0) {
2381                         if (nl80211_send_chandef(msg, &chandef))
2382                                 goto nla_put_failure;
2383                 }
2384         }
2385
2386         if (wdev->ssid_len) {
2387                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2388                         goto nla_put_failure;
2389         }
2390
2391         return genlmsg_end(msg, hdr);
2392
2393  nla_put_failure:
2394         genlmsg_cancel(msg, hdr);
2395         return -EMSGSIZE;
2396 }
2397
2398 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2399 {
2400         int wp_idx = 0;
2401         int if_idx = 0;
2402         int wp_start = cb->args[0];
2403         int if_start = cb->args[1];
2404         struct cfg80211_registered_device *rdev;
2405         struct wireless_dev *wdev;
2406
2407         rtnl_lock();
2408         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2409                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2410                         continue;
2411                 if (wp_idx < wp_start) {
2412                         wp_idx++;
2413                         continue;
2414                 }
2415                 if_idx = 0;
2416
2417                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2418                         if (if_idx < if_start) {
2419                                 if_idx++;
2420                                 continue;
2421                         }
2422                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2423                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2424                                                rdev, wdev, false) < 0) {
2425                                 goto out;
2426                         }
2427                         if_idx++;
2428                 }
2429
2430                 wp_idx++;
2431         }
2432  out:
2433         rtnl_unlock();
2434
2435         cb->args[0] = wp_idx;
2436         cb->args[1] = if_idx;
2437
2438         return skb->len;
2439 }
2440
2441 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2442 {
2443         struct sk_buff *msg;
2444         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2445         struct wireless_dev *wdev = info->user_ptr[1];
2446
2447         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2448         if (!msg)
2449                 return -ENOMEM;
2450
2451         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2452                                rdev, wdev, false) < 0) {
2453                 nlmsg_free(msg);
2454                 return -ENOBUFS;
2455         }
2456
2457         return genlmsg_reply(msg, info);
2458 }
2459
2460 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2461         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2462         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2463         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2464         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2465         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2466         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2467 };
2468
2469 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2470 {
2471         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2472         int flag;
2473
2474         *mntrflags = 0;
2475
2476         if (!nla)
2477                 return -EINVAL;
2478
2479         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2480                              nla, mntr_flags_policy))
2481                 return -EINVAL;
2482
2483         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2484                 if (flags[flag])
2485                         *mntrflags |= (1<<flag);
2486
2487         return 0;
2488 }
2489
2490 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2491                                struct net_device *netdev, u8 use_4addr,
2492                                enum nl80211_iftype iftype)
2493 {
2494         if (!use_4addr) {
2495                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2496                         return -EBUSY;
2497                 return 0;
2498         }
2499
2500         switch (iftype) {
2501         case NL80211_IFTYPE_AP_VLAN:
2502                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2503                         return 0;
2504                 break;
2505         case NL80211_IFTYPE_STATION:
2506                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2507                         return 0;
2508                 break;
2509         default:
2510                 break;
2511         }
2512
2513         return -EOPNOTSUPP;
2514 }
2515
2516 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2517 {
2518         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2519         struct vif_params params;
2520         int err;
2521         enum nl80211_iftype otype, ntype;
2522         struct net_device *dev = info->user_ptr[1];
2523         u32 _flags, *flags = NULL;
2524         bool change = false;
2525
2526         memset(&params, 0, sizeof(params));
2527
2528         otype = ntype = dev->ieee80211_ptr->iftype;
2529
2530         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2531                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2532                 if (otype != ntype)
2533                         change = true;
2534                 if (ntype > NL80211_IFTYPE_MAX)
2535                         return -EINVAL;
2536         }
2537
2538         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2539                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2540
2541                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2542                         return -EINVAL;
2543                 if (netif_running(dev))
2544                         return -EBUSY;
2545
2546                 wdev_lock(wdev);
2547                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2548                              IEEE80211_MAX_MESH_ID_LEN);
2549                 wdev->mesh_id_up_len =
2550                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2551                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2552                        wdev->mesh_id_up_len);
2553                 wdev_unlock(wdev);
2554         }
2555
2556         if (info->attrs[NL80211_ATTR_4ADDR]) {
2557                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2558                 change = true;
2559                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2560                 if (err)
2561                         return err;
2562         } else {
2563                 params.use_4addr = -1;
2564         }
2565
2566         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2567                 if (ntype != NL80211_IFTYPE_MONITOR)
2568                         return -EINVAL;
2569                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2570                                           &_flags);
2571                 if (err)
2572                         return err;
2573
2574                 flags = &_flags;
2575                 change = true;
2576         }
2577
2578         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2579             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2580                 return -EOPNOTSUPP;
2581
2582         if (change)
2583                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2584         else
2585                 err = 0;
2586
2587         if (!err && params.use_4addr != -1)
2588                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2589
2590         return err;
2591 }
2592
2593 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2594 {
2595         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2596         struct vif_params params;
2597         struct wireless_dev *wdev;
2598         struct sk_buff *msg, *event;
2599         int err;
2600         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2601         u32 flags;
2602
2603         /* to avoid failing a new interface creation due to pending removal */
2604         cfg80211_destroy_ifaces(rdev);
2605
2606         memset(&params, 0, sizeof(params));
2607
2608         if (!info->attrs[NL80211_ATTR_IFNAME])
2609                 return -EINVAL;
2610
2611         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2612                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2613                 if (type > NL80211_IFTYPE_MAX)
2614                         return -EINVAL;
2615         }
2616
2617         if (!rdev->ops->add_virtual_intf ||
2618             !(rdev->wiphy.interface_modes & (1 << type)))
2619                 return -EOPNOTSUPP;
2620
2621         if ((type == NL80211_IFTYPE_P2P_DEVICE ||
2622              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2623             info->attrs[NL80211_ATTR_MAC]) {
2624                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2625                            ETH_ALEN);
2626                 if (!is_valid_ether_addr(params.macaddr))
2627                         return -EADDRNOTAVAIL;
2628         }
2629
2630         if (info->attrs[NL80211_ATTR_4ADDR]) {
2631                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2632                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2633                 if (err)
2634                         return err;
2635         }
2636
2637         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2638         if (!msg)
2639                 return -ENOMEM;
2640
2641         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2642                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2643                                   &flags);
2644
2645         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2646             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2647                 return -EOPNOTSUPP;
2648
2649         wdev = rdev_add_virtual_intf(rdev,
2650                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2651                                 type, err ? NULL : &flags, &params);
2652         if (WARN_ON(!wdev)) {
2653                 nlmsg_free(msg);
2654                 return -EPROTO;
2655         } else if (IS_ERR(wdev)) {
2656                 nlmsg_free(msg);
2657                 return PTR_ERR(wdev);
2658         }
2659
2660         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2661                 wdev->owner_nlportid = info->snd_portid;
2662
2663         switch (type) {
2664         case NL80211_IFTYPE_MESH_POINT:
2665                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2666                         break;
2667                 wdev_lock(wdev);
2668                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2669                              IEEE80211_MAX_MESH_ID_LEN);
2670                 wdev->mesh_id_up_len =
2671                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2672                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2673                        wdev->mesh_id_up_len);
2674                 wdev_unlock(wdev);
2675                 break;
2676         case NL80211_IFTYPE_P2P_DEVICE:
2677                 /*
2678                  * P2P Device doesn't have a netdev, so doesn't go
2679                  * through the netdev notifier and must be added here
2680                  */
2681                 mutex_init(&wdev->mtx);
2682                 INIT_LIST_HEAD(&wdev->event_list);
2683                 spin_lock_init(&wdev->event_lock);
2684                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2685                 spin_lock_init(&wdev->mgmt_registrations_lock);
2686
2687                 wdev->identifier = ++rdev->wdev_id;
2688                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2689                 rdev->devlist_generation++;
2690                 break;
2691         default:
2692                 break;
2693         }
2694
2695         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2696                                rdev, wdev, false) < 0) {
2697                 nlmsg_free(msg);
2698                 return -ENOBUFS;
2699         }
2700
2701         event = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2702         if (event) {
2703                 if (nl80211_send_iface(event, 0, 0, 0,
2704                                        rdev, wdev, false) < 0) {
2705                         nlmsg_free(event);
2706                         goto out;
2707                 }
2708
2709                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2710                                         event, 0, NL80211_MCGRP_CONFIG,
2711                                         GFP_KERNEL);
2712         }
2713
2714 out:
2715         return genlmsg_reply(msg, info);
2716 }
2717
2718 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2719 {
2720         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2721         struct wireless_dev *wdev = info->user_ptr[1];
2722         struct sk_buff *msg;
2723         int status;
2724
2725         if (!rdev->ops->del_virtual_intf)
2726                 return -EOPNOTSUPP;
2727
2728         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2729         if (msg && nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, true) < 0) {
2730                 nlmsg_free(msg);
2731                 msg = NULL;
2732         }
2733
2734         /*
2735          * If we remove a wireless device without a netdev then clear
2736          * user_ptr[1] so that nl80211_post_doit won't dereference it
2737          * to check if it needs to do dev_put(). Otherwise it crashes
2738          * since the wdev has been freed, unlike with a netdev where
2739          * we need the dev_put() for the netdev to really be freed.
2740          */
2741         if (!wdev->netdev)
2742                 info->user_ptr[1] = NULL;
2743
2744         status = rdev_del_virtual_intf(rdev, wdev);
2745         if (status >= 0 && msg)
2746                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2747                                         msg, 0, NL80211_MCGRP_CONFIG,
2748                                         GFP_KERNEL);
2749         else
2750                 nlmsg_free(msg);
2751
2752         return status;
2753 }
2754
2755 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2756 {
2757         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2758         struct net_device *dev = info->user_ptr[1];
2759         u16 noack_map;
2760
2761         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2762                 return -EINVAL;
2763
2764         if (!rdev->ops->set_noack_map)
2765                 return -EOPNOTSUPP;
2766
2767         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2768
2769         return rdev_set_noack_map(rdev, dev, noack_map);
2770 }
2771
2772 struct get_key_cookie {
2773         struct sk_buff *msg;
2774         int error;
2775         int idx;
2776 };
2777
2778 static void get_key_callback(void *c, struct key_params *params)
2779 {
2780         struct nlattr *key;
2781         struct get_key_cookie *cookie = c;
2782
2783         if ((params->key &&
2784              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2785                      params->key_len, params->key)) ||
2786             (params->seq &&
2787              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2788                      params->seq_len, params->seq)) ||
2789             (params->cipher &&
2790              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2791                          params->cipher)))
2792                 goto nla_put_failure;
2793
2794         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2795         if (!key)
2796                 goto nla_put_failure;
2797
2798         if ((params->key &&
2799              nla_put(cookie->msg, NL80211_KEY_DATA,
2800                      params->key_len, params->key)) ||
2801             (params->seq &&
2802              nla_put(cookie->msg, NL80211_KEY_SEQ,
2803                      params->seq_len, params->seq)) ||
2804             (params->cipher &&
2805              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2806                          params->cipher)))
2807                 goto nla_put_failure;
2808
2809         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2810                 goto nla_put_failure;
2811
2812         nla_nest_end(cookie->msg, key);
2813
2814         return;
2815  nla_put_failure:
2816         cookie->error = 1;
2817 }
2818
2819 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2820 {
2821         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2822         int err;
2823         struct net_device *dev = info->user_ptr[1];
2824         u8 key_idx = 0;
2825         const u8 *mac_addr = NULL;
2826         bool pairwise;
2827         struct get_key_cookie cookie = {
2828                 .error = 0,
2829         };
2830         void *hdr;
2831         struct sk_buff *msg;
2832
2833         if (info->attrs[NL80211_ATTR_KEY_IDX])
2834                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2835
2836         if (key_idx > 5)
2837                 return -EINVAL;
2838
2839         if (info->attrs[NL80211_ATTR_MAC])
2840                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2841
2842         pairwise = !!mac_addr;
2843         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2844                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2845                 if (kt >= NUM_NL80211_KEYTYPES)
2846                         return -EINVAL;
2847                 if (kt != NL80211_KEYTYPE_GROUP &&
2848                     kt != NL80211_KEYTYPE_PAIRWISE)
2849                         return -EINVAL;
2850                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2851         }
2852
2853         if (!rdev->ops->get_key)
2854                 return -EOPNOTSUPP;
2855
2856         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2857         if (!msg)
2858                 return -ENOMEM;
2859
2860         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2861                              NL80211_CMD_NEW_KEY);
2862         if (!hdr)
2863                 goto nla_put_failure;
2864
2865         cookie.msg = msg;
2866         cookie.idx = key_idx;
2867
2868         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2869             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2870                 goto nla_put_failure;
2871         if (mac_addr &&
2872             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2873                 goto nla_put_failure;
2874
2875         if (pairwise && mac_addr &&
2876             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2877                 return -ENOENT;
2878
2879         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2880                            get_key_callback);
2881
2882         if (err)
2883                 goto free_msg;
2884
2885         if (cookie.error)
2886                 goto nla_put_failure;
2887
2888         genlmsg_end(msg, hdr);
2889         return genlmsg_reply(msg, info);
2890
2891  nla_put_failure:
2892         err = -ENOBUFS;
2893  free_msg:
2894         nlmsg_free(msg);
2895         return err;
2896 }
2897
2898 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2899 {
2900         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2901         struct key_parse key;
2902         int err;
2903         struct net_device *dev = info->user_ptr[1];
2904
2905         err = nl80211_parse_key(info, &key);
2906         if (err)
2907                 return err;
2908
2909         if (key.idx < 0)
2910                 return -EINVAL;
2911
2912         /* only support setting default key */
2913         if (!key.def && !key.defmgmt)
2914                 return -EINVAL;
2915
2916         wdev_lock(dev->ieee80211_ptr);
2917
2918         if (key.def) {
2919                 if (!rdev->ops->set_default_key) {
2920                         err = -EOPNOTSUPP;
2921                         goto out;
2922                 }
2923
2924                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2925                 if (err)
2926                         goto out;
2927
2928                 err = rdev_set_default_key(rdev, dev, key.idx,
2929                                                  key.def_uni, key.def_multi);
2930
2931                 if (err)
2932                         goto out;
2933
2934 #ifdef CONFIG_CFG80211_WEXT
2935                 dev->ieee80211_ptr->wext.default_key = key.idx;
2936 #endif
2937         } else {
2938                 if (key.def_uni || !key.def_multi) {
2939                         err = -EINVAL;
2940                         goto out;
2941                 }
2942
2943                 if (!rdev->ops->set_default_mgmt_key) {
2944                         err = -EOPNOTSUPP;
2945                         goto out;
2946                 }
2947
2948                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2949                 if (err)
2950                         goto out;
2951
2952                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2953                 if (err)
2954                         goto out;
2955
2956 #ifdef CONFIG_CFG80211_WEXT
2957                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2958 #endif
2959         }
2960
2961  out:
2962         wdev_unlock(dev->ieee80211_ptr);
2963
2964         return err;
2965 }
2966
2967 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2968 {
2969         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2970         int err;
2971         struct net_device *dev = info->user_ptr[1];
2972         struct key_parse key;
2973         const u8 *mac_addr = NULL;
2974
2975         err = nl80211_parse_key(info, &key);
2976         if (err)
2977                 return err;
2978
2979         if (!key.p.key)
2980                 return -EINVAL;
2981
2982         if (info->attrs[NL80211_ATTR_MAC])
2983                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2984
2985         if (key.type == -1) {
2986                 if (mac_addr)
2987                         key.type = NL80211_KEYTYPE_PAIRWISE;
2988                 else
2989                         key.type = NL80211_KEYTYPE_GROUP;
2990         }
2991
2992         /* for now */
2993         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2994             key.type != NL80211_KEYTYPE_GROUP)
2995                 return -EINVAL;
2996
2997         if (!rdev->ops->add_key)
2998                 return -EOPNOTSUPP;
2999
3000         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3001                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3002                                            mac_addr))
3003                 return -EINVAL;
3004
3005         wdev_lock(dev->ieee80211_ptr);
3006         err = nl80211_key_allowed(dev->ieee80211_ptr);
3007         if (!err)
3008                 err = rdev_add_key(rdev, dev, key.idx,
3009                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3010                                     mac_addr, &key.p);
3011         wdev_unlock(dev->ieee80211_ptr);
3012
3013         return err;
3014 }
3015
3016 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3017 {
3018         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3019         int err;
3020         struct net_device *dev = info->user_ptr[1];
3021         u8 *mac_addr = NULL;
3022         struct key_parse key;
3023
3024         err = nl80211_parse_key(info, &key);
3025         if (err)
3026                 return err;
3027
3028         if (info->attrs[NL80211_ATTR_MAC])
3029                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3030
3031         if (key.type == -1) {
3032                 if (mac_addr)
3033                         key.type = NL80211_KEYTYPE_PAIRWISE;
3034                 else
3035                         key.type = NL80211_KEYTYPE_GROUP;
3036         }
3037
3038         /* for now */
3039         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3040             key.type != NL80211_KEYTYPE_GROUP)
3041                 return -EINVAL;
3042
3043         if (!rdev->ops->del_key)
3044                 return -EOPNOTSUPP;
3045
3046         wdev_lock(dev->ieee80211_ptr);
3047         err = nl80211_key_allowed(dev->ieee80211_ptr);
3048
3049         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
3050             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3051                 err = -ENOENT;
3052
3053         if (!err)
3054                 err = rdev_del_key(rdev, dev, key.idx,
3055                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3056                                    mac_addr);
3057
3058 #ifdef CONFIG_CFG80211_WEXT
3059         if (!err) {
3060                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3061                         dev->ieee80211_ptr->wext.default_key = -1;
3062                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3063                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3064         }
3065 #endif
3066         wdev_unlock(dev->ieee80211_ptr);
3067
3068         return err;
3069 }
3070
3071 /* This function returns an error or the number of nested attributes */
3072 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3073 {
3074         struct nlattr *attr;
3075         int n_entries = 0, tmp;
3076
3077         nla_for_each_nested(attr, nl_attr, tmp) {
3078                 if (nla_len(attr) != ETH_ALEN)
3079                         return -EINVAL;
3080
3081                 n_entries++;
3082         }
3083
3084         return n_entries;
3085 }
3086
3087 /*
3088  * This function parses ACL information and allocates memory for ACL data.
3089  * On successful return, the calling function is responsible to free the
3090  * ACL buffer returned by this function.
3091  */
3092 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3093                                                 struct genl_info *info)
3094 {
3095         enum nl80211_acl_policy acl_policy;
3096         struct nlattr *attr;
3097         struct cfg80211_acl_data *acl;
3098         int i = 0, n_entries, tmp;
3099
3100         if (!wiphy->max_acl_mac_addrs)
3101                 return ERR_PTR(-EOPNOTSUPP);
3102
3103         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3104                 return ERR_PTR(-EINVAL);
3105
3106         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3107         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3108             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3109                 return ERR_PTR(-EINVAL);
3110
3111         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3112                 return ERR_PTR(-EINVAL);
3113
3114         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3115         if (n_entries < 0)
3116                 return ERR_PTR(n_entries);
3117
3118         if (n_entries > wiphy->max_acl_mac_addrs)
3119                 return ERR_PTR(-ENOTSUPP);
3120
3121         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3122                       GFP_KERNEL);
3123         if (!acl)
3124                 return ERR_PTR(-ENOMEM);
3125
3126         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3127                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3128                 i++;
3129         }
3130
3131         acl->n_acl_entries = n_entries;
3132         acl->acl_policy = acl_policy;
3133
3134         return acl;
3135 }
3136
3137 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3138 {
3139         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3140         struct net_device *dev = info->user_ptr[1];
3141         struct cfg80211_acl_data *acl;
3142         int err;
3143
3144         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3145             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3146                 return -EOPNOTSUPP;
3147
3148         if (!dev->ieee80211_ptr->beacon_interval)
3149                 return -EINVAL;
3150
3151         acl = parse_acl_data(&rdev->wiphy, info);
3152         if (IS_ERR(acl))
3153                 return PTR_ERR(acl);
3154
3155         err = rdev_set_mac_acl(rdev, dev, acl);
3156
3157         kfree(acl);
3158
3159         return err;
3160 }
3161
3162 static int nl80211_parse_beacon(struct nlattr *attrs[],
3163                                 struct cfg80211_beacon_data *bcn)
3164 {
3165         bool haveinfo = false;
3166
3167         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3168             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3169             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3170             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3171                 return -EINVAL;
3172
3173         memset(bcn, 0, sizeof(*bcn));
3174
3175         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3176                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3177                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3178                 if (!bcn->head_len)
3179                         return -EINVAL;
3180                 haveinfo = true;
3181         }
3182
3183         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3184                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3185                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3186                 haveinfo = true;
3187         }
3188
3189         if (!haveinfo)
3190                 return -EINVAL;
3191
3192         if (attrs[NL80211_ATTR_IE]) {
3193                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3194                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3195         }
3196
3197         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3198                 bcn->proberesp_ies =
3199                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3200                 bcn->proberesp_ies_len =
3201                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3202         }
3203
3204         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3205                 bcn->assocresp_ies =
3206                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3207                 bcn->assocresp_ies_len =
3208                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3209         }
3210
3211         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3212                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3213                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3214         }
3215
3216         return 0;
3217 }
3218
3219 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3220                                    struct cfg80211_ap_settings *params)
3221 {
3222         struct wireless_dev *wdev;
3223         bool ret = false;
3224
3225         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3226                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3227                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3228                         continue;
3229
3230                 if (!wdev->preset_chandef.chan)
3231                         continue;
3232
3233                 params->chandef = wdev->preset_chandef;
3234                 ret = true;
3235                 break;
3236         }
3237
3238         return ret;
3239 }
3240
3241 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3242                                     enum nl80211_auth_type auth_type,
3243                                     enum nl80211_commands cmd)
3244 {
3245         if (auth_type > NL80211_AUTHTYPE_MAX)
3246                 return false;
3247
3248         switch (cmd) {
3249         case NL80211_CMD_AUTHENTICATE:
3250                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3251                     auth_type == NL80211_AUTHTYPE_SAE)
3252                         return false;
3253                 return true;
3254         case NL80211_CMD_CONNECT:
3255         case NL80211_CMD_START_AP:
3256                 /* SAE not supported yet */
3257                 if (auth_type == NL80211_AUTHTYPE_SAE)
3258                         return false;
3259                 return true;
3260         default:
3261                 return false;
3262         }
3263 }
3264
3265 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3266 {
3267         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3268         struct net_device *dev = info->user_ptr[1];
3269         struct wireless_dev *wdev = dev->ieee80211_ptr;
3270         struct cfg80211_ap_settings params;
3271         int err;
3272
3273         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3274             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3275                 return -EOPNOTSUPP;
3276
3277         if (!rdev->ops->start_ap)
3278                 return -EOPNOTSUPP;
3279
3280         if (wdev->beacon_interval)
3281                 return -EALREADY;
3282
3283         memset(&params, 0, sizeof(params));
3284
3285         /* these are required for START_AP */
3286         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3287             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3288             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3289                 return -EINVAL;
3290
3291         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3292         if (err)
3293                 return err;
3294
3295         params.beacon_interval =
3296                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3297         params.dtim_period =
3298                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3299
3300         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3301         if (err)
3302                 return err;
3303
3304         /*
3305          * In theory, some of these attributes should be required here
3306          * but since they were not used when the command was originally
3307          * added, keep them optional for old user space programs to let
3308          * them continue to work with drivers that do not need the
3309          * additional information -- drivers must check!
3310          */
3311         if (info->attrs[NL80211_ATTR_SSID]) {
3312                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3313                 params.ssid_len =
3314                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3315                 if (params.ssid_len == 0 ||
3316                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3317                         return -EINVAL;
3318         }
3319
3320         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3321                 params.hidden_ssid = nla_get_u32(
3322                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3323                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3324                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3325                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3326                         return -EINVAL;
3327         }
3328
3329         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3330
3331         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3332                 params.auth_type = nla_get_u32(
3333                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3334                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3335                                              NL80211_CMD_START_AP))
3336                         return -EINVAL;
3337         } else
3338                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3339
3340         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3341                                       NL80211_MAX_NR_CIPHER_SUITES);
3342         if (err)
3343                 return err;
3344
3345         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3346                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3347                         return -EOPNOTSUPP;
3348                 params.inactivity_timeout = nla_get_u16(
3349                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3350         }
3351
3352         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3353                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3354                         return -EINVAL;
3355                 params.p2p_ctwindow =
3356                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3357                 if (params.p2p_ctwindow > 127)
3358                         return -EINVAL;
3359                 if (params.p2p_ctwindow != 0 &&
3360                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3361                         return -EINVAL;
3362         }
3363
3364         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3365                 u8 tmp;
3366
3367                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3368                         return -EINVAL;
3369                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3370                 if (tmp > 1)
3371                         return -EINVAL;
3372                 params.p2p_opp_ps = tmp;
3373                 if (params.p2p_opp_ps != 0 &&
3374                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3375                         return -EINVAL;
3376         }
3377
3378         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3379                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3380                 if (err)
3381                         return err;
3382         } else if (wdev->preset_chandef.chan) {
3383                 params.chandef = wdev->preset_chandef;
3384         } else if (!nl80211_get_ap_channel(rdev, &params))
3385                 return -EINVAL;
3386
3387         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
3388                                      wdev->iftype))
3389                 return -EINVAL;
3390
3391         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3392                 params.acl = parse_acl_data(&rdev->wiphy, info);
3393                 if (IS_ERR(params.acl))
3394                         return PTR_ERR(params.acl);
3395         }
3396
3397         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3398                 params.smps_mode =
3399                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3400                 switch (params.smps_mode) {
3401                 case NL80211_SMPS_OFF:
3402                         break;
3403                 case NL80211_SMPS_STATIC:
3404                         if (!(rdev->wiphy.features &
3405                               NL80211_FEATURE_STATIC_SMPS))
3406                                 return -EINVAL;
3407                         break;
3408                 case NL80211_SMPS_DYNAMIC:
3409                         if (!(rdev->wiphy.features &
3410                               NL80211_FEATURE_DYNAMIC_SMPS))
3411                                 return -EINVAL;
3412                         break;
3413                 default:
3414                         return -EINVAL;
3415                 }
3416         } else {
3417                 params.smps_mode = NL80211_SMPS_OFF;
3418         }
3419
3420         wdev_lock(wdev);
3421         err = rdev_start_ap(rdev, dev, &params);
3422         if (!err) {
3423                 wdev->preset_chandef = params.chandef;
3424                 wdev->beacon_interval = params.beacon_interval;
3425                 wdev->chandef = params.chandef;
3426                 wdev->ssid_len = params.ssid_len;
3427                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3428         }
3429         wdev_unlock(wdev);
3430
3431         kfree(params.acl);
3432
3433         return err;
3434 }
3435
3436 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3437 {
3438         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3439         struct net_device *dev = info->user_ptr[1];
3440         struct wireless_dev *wdev = dev->ieee80211_ptr;
3441         struct cfg80211_beacon_data params;
3442         int err;
3443
3444         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3445             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3446                 return -EOPNOTSUPP;
3447
3448         if (!rdev->ops->change_beacon)
3449                 return -EOPNOTSUPP;
3450
3451         if (!wdev->beacon_interval)
3452                 return -EINVAL;
3453
3454         err = nl80211_parse_beacon(info->attrs, &params);
3455         if (err)
3456                 return err;
3457
3458         wdev_lock(wdev);
3459         err = rdev_change_beacon(rdev, dev, &params);
3460         wdev_unlock(wdev);
3461
3462         return err;
3463 }
3464
3465 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3466 {
3467         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3468         struct net_device *dev = info->user_ptr[1];
3469
3470         return cfg80211_stop_ap(rdev, dev, false);
3471 }
3472
3473 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3474         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3475         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3476         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3477         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3478         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3479         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3480 };
3481
3482 static int parse_station_flags(struct genl_info *info,
3483                                enum nl80211_iftype iftype,
3484                                struct station_parameters *params)
3485 {
3486         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3487         struct nlattr *nla;
3488         int flag;
3489
3490         /*
3491          * Try parsing the new attribute first so userspace
3492          * can specify both for older kernels.
3493          */
3494         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3495         if (nla) {
3496                 struct nl80211_sta_flag_update *sta_flags;
3497
3498                 sta_flags = nla_data(nla);
3499                 params->sta_flags_mask = sta_flags->mask;
3500                 params->sta_flags_set = sta_flags->set;
3501                 params->sta_flags_set &= params->sta_flags_mask;
3502                 if ((params->sta_flags_mask |
3503                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3504                         return -EINVAL;
3505                 return 0;
3506         }
3507
3508         /* if present, parse the old attribute */
3509
3510         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3511         if (!nla)
3512                 return 0;
3513
3514         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3515                              nla, sta_flags_policy))
3516                 return -EINVAL;
3517
3518         /*
3519          * Only allow certain flags for interface types so that
3520          * other attributes are silently ignored. Remember that
3521          * this is backward compatibility code with old userspace
3522          * and shouldn't be hit in other cases anyway.
3523          */
3524         switch (iftype) {
3525         case NL80211_IFTYPE_AP:
3526         case NL80211_IFTYPE_AP_VLAN:
3527         case NL80211_IFTYPE_P2P_GO:
3528                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3529                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3530                                          BIT(NL80211_STA_FLAG_WME) |
3531                                          BIT(NL80211_STA_FLAG_MFP);
3532                 break;
3533         case NL80211_IFTYPE_P2P_CLIENT:
3534         case NL80211_IFTYPE_STATION:
3535                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3536                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3537                 break;
3538         case NL80211_IFTYPE_MESH_POINT:
3539                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3540                                          BIT(NL80211_STA_FLAG_MFP) |
3541                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3542         default:
3543                 return -EINVAL;
3544         }
3545
3546         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3547                 if (flags[flag]) {
3548                         params->sta_flags_set |= (1<<flag);
3549
3550                         /* no longer support new API additions in old API */
3551                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3552                                 return -EINVAL;
3553                 }
3554         }
3555
3556         return 0;
3557 }
3558
3559 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3560                                  int attr)
3561 {
3562         struct nlattr *rate;
3563         u32 bitrate;
3564         u16 bitrate_compat;
3565
3566         rate = nla_nest_start(msg, attr);
3567         if (!rate)
3568                 return false;
3569
3570         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3571         bitrate = cfg80211_calculate_bitrate(info);
3572         /* report 16-bit bitrate only if we can */
3573         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3574         if (bitrate > 0 &&
3575             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3576                 return false;
3577         if (bitrate_compat > 0 &&
3578             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3579                 return false;
3580
3581         if (info->flags & RATE_INFO_FLAGS_MCS) {
3582                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3583                         return false;
3584                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3585                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3586                         return false;
3587                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3588                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3589                         return false;
3590         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3591                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3592                         return false;
3593                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3594                         return false;
3595                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3596                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3597                         return false;
3598                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3599                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3600                         return false;
3601                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3602                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3603                         return false;
3604                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3605                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3606                         return false;
3607                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3608                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3609                         return false;
3610         }
3611
3612         nla_nest_end(msg, rate);
3613         return true;
3614 }
3615
3616 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3617                                int id)
3618 {
3619         void *attr;
3620         int i = 0;
3621
3622         if (!mask)
3623                 return true;
3624
3625         attr = nla_nest_start(msg, id);
3626         if (!attr)
3627                 return false;
3628
3629         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3630                 if (!(mask & BIT(i)))
3631                         continue;
3632
3633                 if (nla_put_u8(msg, i, signal[i]))
3634                         return false;
3635         }
3636
3637         nla_nest_end(msg, attr);
3638
3639         return true;
3640 }
3641
3642 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3643                                 int flags,
3644                                 struct cfg80211_registered_device *rdev,
3645                                 struct net_device *dev,
3646                                 const u8 *mac_addr, struct station_info *sinfo)
3647 {
3648         void *hdr;
3649         struct nlattr *sinfoattr, *bss_param;
3650
3651         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3652         if (!hdr)
3653                 return -1;
3654
3655         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3656             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3657             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3658                 goto nla_put_failure;
3659
3660         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3661         if (!sinfoattr)
3662                 goto nla_put_failure;
3663         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3664             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3665                         sinfo->connected_time))
3666                 goto nla_put_failure;
3667         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3668             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3669                         sinfo->inactive_time))
3670                 goto nla_put_failure;
3671         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3672                               STATION_INFO_RX_BYTES64)) &&
3673             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3674                         (u32)sinfo->rx_bytes))
3675                 goto nla_put_failure;
3676         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3677                               STATION_INFO_TX_BYTES64)) &&
3678             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3679                         (u32)sinfo->tx_bytes))
3680                 goto nla_put_failure;
3681         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3682             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3683                         sinfo->rx_bytes))
3684                 goto nla_put_failure;
3685         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3686             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3687                         sinfo->tx_bytes))
3688                 goto nla_put_failure;
3689         if ((sinfo->filled & STATION_INFO_LLID) &&
3690             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3691                 goto nla_put_failure;
3692         if ((sinfo->filled & STATION_INFO_PLID) &&
3693             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3694                 goto nla_put_failure;
3695         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3696             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3697                        sinfo->plink_state))
3698                 goto nla_put_failure;
3699         switch (rdev->wiphy.signal_type) {
3700         case CFG80211_SIGNAL_TYPE_MBM:
3701                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3702                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3703                                sinfo->signal))
3704                         goto nla_put_failure;
3705                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3706                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3707                                sinfo->signal_avg))
3708                         goto nla_put_failure;
3709                 break;
3710         default:
3711                 break;
3712         }
3713         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3714                 if (!nl80211_put_signal(msg, sinfo->chains,
3715                                         sinfo->chain_signal,
3716                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3717                         goto nla_put_failure;
3718         }
3719         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3720                 if (!nl80211_put_signal(msg, sinfo->chains,
3721                                         sinfo->chain_signal_avg,
3722                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3723                         goto nla_put_failure;
3724         }
3725         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3726                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3727                                           NL80211_STA_INFO_TX_BITRATE))
3728                         goto nla_put_failure;
3729         }
3730         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3731                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3732                                           NL80211_STA_INFO_RX_BITRATE))
3733                         goto nla_put_failure;
3734         }
3735         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3736             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3737                         sinfo->rx_packets))
3738                 goto nla_put_failure;
3739         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3740             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3741                         sinfo->tx_packets))
3742                 goto nla_put_failure;
3743         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3744             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3745                         sinfo->tx_retries))
3746                 goto nla_put_failure;
3747         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3748             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3749                         sinfo->tx_failed))
3750                 goto nla_put_failure;
3751         if ((sinfo->filled & STATION_INFO_EXPECTED_THROUGHPUT) &&
3752             nla_put_u32(msg, NL80211_STA_INFO_EXPECTED_THROUGHPUT,
3753                         sinfo->expected_throughput))
3754                 goto nla_put_failure;
3755         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3756             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3757                         sinfo->beacon_loss_count))
3758                 goto nla_put_failure;
3759         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3760             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3761                         sinfo->local_pm))
3762                 goto nla_put_failure;
3763         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3764             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3765                         sinfo->peer_pm))
3766                 goto nla_put_failure;
3767         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3768             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3769                         sinfo->nonpeer_pm))
3770                 goto nla_put_failure;
3771         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3772                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3773                 if (!bss_param)
3774                         goto nla_put_failure;
3775
3776                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3777                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3778                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3779                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3780                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3781                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3782                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3783                                sinfo->bss_param.dtim_period) ||
3784                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3785                                 sinfo->bss_param.beacon_interval))
3786                         goto nla_put_failure;
3787
3788                 nla_nest_end(msg, bss_param);
3789         }
3790         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3791             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3792                     sizeof(struct nl80211_sta_flag_update),
3793                     &sinfo->sta_flags))
3794                 goto nla_put_failure;
3795         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3796                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3797                             sinfo->t_offset))
3798                 goto nla_put_failure;
3799         nla_nest_end(msg, sinfoattr);
3800
3801         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3802             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3803                     sinfo->assoc_req_ies))
3804                 goto nla_put_failure;
3805
3806         return genlmsg_end(msg, hdr);
3807
3808  nla_put_failure:
3809         genlmsg_cancel(msg, hdr);
3810         return -EMSGSIZE;
3811 }
3812
3813 static int nl80211_dump_station(struct sk_buff *skb,
3814                                 struct netlink_callback *cb)
3815 {
3816         struct station_info sinfo;
3817         struct cfg80211_registered_device *rdev;
3818         struct wireless_dev *wdev;
3819         u8 mac_addr[ETH_ALEN];
3820         int sta_idx = cb->args[2];
3821         int err;
3822
3823         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3824         if (err)
3825                 return err;
3826
3827         if (!wdev->netdev) {
3828                 err = -EINVAL;
3829                 goto out_err;
3830         }
3831
3832         if (!rdev->ops->dump_station) {
3833                 err = -EOPNOTSUPP;
3834                 goto out_err;
3835         }
3836
3837         while (1) {
3838                 memset(&sinfo, 0, sizeof(sinfo));
3839                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3840                                         mac_addr, &sinfo);
3841                 if (err == -ENOENT)
3842                         break;
3843                 if (err)
3844                         goto out_err;
3845
3846                 if (nl80211_send_station(skb,
3847                                 NETLINK_CB(cb->skb).portid,
3848                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3849                                 rdev, wdev->netdev, mac_addr,
3850                                 &sinfo) < 0)
3851                         goto out;
3852
3853                 sta_idx++;
3854         }
3855
3856
3857  out:
3858         cb->args[2] = sta_idx;
3859         err = skb->len;
3860  out_err:
3861         nl80211_finish_wdev_dump(rdev);
3862
3863         return err;
3864 }
3865
3866 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3867 {
3868         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3869         struct net_device *dev = info->user_ptr[1];
3870         struct station_info sinfo;
3871         struct sk_buff *msg;
3872         u8 *mac_addr = NULL;
3873         int err;
3874
3875         memset(&sinfo, 0, sizeof(sinfo));
3876
3877         if (!info->attrs[NL80211_ATTR_MAC])
3878                 return -EINVAL;
3879
3880         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3881
3882         if (!rdev->ops->get_station)
3883                 return -EOPNOTSUPP;
3884
3885         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3886         if (err)
3887                 return err;
3888
3889         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3890         if (!msg)
3891                 return -ENOMEM;
3892
3893         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3894                                  rdev, dev, mac_addr, &sinfo) < 0) {
3895                 nlmsg_free(msg);
3896                 return -ENOBUFS;
3897         }
3898
3899         return genlmsg_reply(msg, info);
3900 }
3901
3902 int cfg80211_check_station_change(struct wiphy *wiphy,
3903                                   struct station_parameters *params,
3904                                   enum cfg80211_station_type statype)
3905 {
3906         if (params->listen_interval != -1)
3907                 return -EINVAL;
3908         if (params->aid &&
3909             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3910                 return -EINVAL;
3911
3912         /* When you run into this, adjust the code below for the new flag */
3913         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3914
3915         switch (statype) {
3916         case CFG80211_STA_MESH_PEER_KERNEL:
3917         case CFG80211_STA_MESH_PEER_USER:
3918                 /*
3919                  * No ignoring the TDLS flag here -- the userspace mesh
3920                  * code doesn't have the bug of including TDLS in the
3921                  * mask everywhere.
3922                  */
3923                 if (params->sta_flags_mask &
3924                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3925                                   BIT(NL80211_STA_FLAG_MFP) |
3926                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3927                         return -EINVAL;
3928                 break;
3929         case CFG80211_STA_TDLS_PEER_SETUP:
3930         case CFG80211_STA_TDLS_PEER_ACTIVE:
3931                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3932                         return -EINVAL;
3933                 /* ignore since it can't change */
3934                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3935                 break;
3936         default:
3937                 /* disallow mesh-specific things */
3938                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3939                         return -EINVAL;
3940                 if (params->local_pm)
3941                         return -EINVAL;
3942                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3943                         return -EINVAL;
3944         }
3945
3946         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3947             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3948                 /* TDLS can't be set, ... */
3949                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3950                         return -EINVAL;
3951                 /*
3952                  * ... but don't bother the driver with it. This works around
3953                  * a hostapd/wpa_supplicant issue -- it always includes the
3954                  * TLDS_PEER flag in the mask even for AP mode.
3955                  */
3956                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3957         }
3958
3959         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3960                 /* reject other things that can't change */
3961                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3962                         return -EINVAL;
3963                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3964                         return -EINVAL;
3965                 if (params->supported_rates)
3966                         return -EINVAL;
3967                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3968                         return -EINVAL;
3969         }
3970
3971         if (statype != CFG80211_STA_AP_CLIENT) {
3972                 if (params->vlan)
3973                         return -EINVAL;
3974         }
3975
3976         switch (statype) {
3977         case CFG80211_STA_AP_MLME_CLIENT:
3978                 /* Use this only for authorizing/unauthorizing a station */
3979                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3980                         return -EOPNOTSUPP;
3981                 break;
3982         case CFG80211_STA_AP_CLIENT:
3983                 /* accept only the listed bits */
3984                 if (params->sta_flags_mask &
3985                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3986                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3987                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3988                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3989                                   BIT(NL80211_STA_FLAG_WME) |
3990                                   BIT(NL80211_STA_FLAG_MFP)))
3991                         return -EINVAL;
3992
3993                 /* but authenticated/associated only if driver handles it */
3994                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3995                     params->sta_flags_mask &
3996                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3997                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3998                         return -EINVAL;
3999                 break;
4000         case CFG80211_STA_IBSS:
4001         case CFG80211_STA_AP_STA:
4002                 /* reject any changes other than AUTHORIZED */
4003                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4004                         return -EINVAL;
4005                 break;
4006         case CFG80211_STA_TDLS_PEER_SETUP:
4007                 /* reject any changes other than AUTHORIZED or WME */
4008                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4009                                                BIT(NL80211_STA_FLAG_WME)))
4010                         return -EINVAL;
4011                 /* force (at least) rates when authorizing */
4012                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4013                     !params->supported_rates)
4014                         return -EINVAL;
4015                 break;
4016         case CFG80211_STA_TDLS_PEER_ACTIVE:
4017                 /* reject any changes */
4018                 return -EINVAL;
4019         case CFG80211_STA_MESH_PEER_KERNEL:
4020                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4021                         return -EINVAL;
4022                 break;
4023         case CFG80211_STA_MESH_PEER_USER:
4024                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4025                         return -EINVAL;
4026                 break;
4027         }
4028
4029         return 0;
4030 }
4031 EXPORT_SYMBOL(cfg80211_check_station_change);
4032
4033 /*
4034  * Get vlan interface making sure it is running and on the right wiphy.
4035  */
4036 static struct net_device *get_vlan(struct genl_info *info,
4037                                    struct cfg80211_registered_device *rdev)
4038 {
4039         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4040         struct net_device *v;
4041         int ret;
4042
4043         if (!vlanattr)
4044                 return NULL;
4045
4046         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4047         if (!v)
4048                 return ERR_PTR(-ENODEV);
4049
4050         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4051                 ret = -EINVAL;
4052                 goto error;
4053         }
4054
4055         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4056             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4057             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4058                 ret = -EINVAL;
4059                 goto error;
4060         }
4061
4062         if (!netif_running(v)) {
4063                 ret = -ENETDOWN;
4064                 goto error;
4065         }
4066
4067         return v;
4068  error:
4069         dev_put(v);
4070         return ERR_PTR(ret);
4071 }
4072
4073 static const struct nla_policy
4074 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4075         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4076         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4077 };
4078
4079 static int nl80211_parse_sta_wme(struct genl_info *info,
4080                                  struct station_parameters *params)
4081 {
4082         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4083         struct nlattr *nla;
4084         int err;
4085
4086         /* parse WME attributes if present */
4087         if (!info->attrs[NL80211_ATTR_STA_WME])
4088                 return 0;
4089
4090         nla = info->attrs[NL80211_ATTR_STA_WME];
4091         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4092                                nl80211_sta_wme_policy);
4093         if (err)
4094                 return err;
4095
4096         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4097                 params->uapsd_queues = nla_get_u8(
4098                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4099         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4100                 return -EINVAL;
4101
4102         if (tb[NL80211_STA_WME_MAX_SP])
4103                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4104
4105         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4106                 return -EINVAL;
4107
4108         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4109
4110         return 0;
4111 }
4112
4113 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4114                                       struct station_parameters *params)
4115 {
4116         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4117                 params->supported_channels =
4118                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4119                 params->supported_channels_len =
4120                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4121                 /*
4122                  * Need to include at least one (first channel, number of
4123                  * channels) tuple for each subband, and must have proper
4124                  * tuples for the rest of the data as well.
4125                  */
4126                 if (params->supported_channels_len < 2)
4127                         return -EINVAL;
4128                 if (params->supported_channels_len % 2)
4129                         return -EINVAL;
4130         }
4131
4132         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4133                 params->supported_oper_classes =
4134                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4135                 params->supported_oper_classes_len =
4136                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4137                 /*
4138                  * The value of the Length field of the Supported Operating
4139                  * Classes element is between 2 and 253.
4140                  */
4141                 if (params->supported_oper_classes_len < 2 ||
4142                     params->supported_oper_classes_len > 253)
4143                         return -EINVAL;
4144         }
4145         return 0;
4146 }
4147
4148 static int nl80211_set_station_tdls(struct genl_info *info,
4149                                     struct station_parameters *params)
4150 {
4151         int err;
4152         /* Dummy STA entry gets updated once the peer capabilities are known */
4153         if (info->attrs[NL80211_ATTR_PEER_AID])
4154                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4155         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4156                 params->ht_capa =
4157                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4158         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4159                 params->vht_capa =
4160                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4161
4162         err = nl80211_parse_sta_channel_info(info, params);
4163         if (err)
4164                 return err;
4165
4166         return nl80211_parse_sta_wme(info, params);
4167 }
4168
4169 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4170 {
4171         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4172         struct net_device *dev = info->user_ptr[1];
4173         struct station_parameters params;
4174         u8 *mac_addr;
4175         int err;
4176
4177         memset(&params, 0, sizeof(params));
4178
4179         params.listen_interval = -1;
4180
4181         if (!rdev->ops->change_station)
4182                 return -EOPNOTSUPP;
4183
4184         if (info->attrs[NL80211_ATTR_STA_AID])
4185                 return -EINVAL;
4186
4187         if (!info->attrs[NL80211_ATTR_MAC])
4188                 return -EINVAL;
4189
4190         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4191
4192         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4193                 params.supported_rates =
4194                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4195                 params.supported_rates_len =
4196                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4197         }
4198
4199         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4200                 params.capability =
4201                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4202                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4203         }
4204
4205         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4206                 params.ext_capab =
4207                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4208                 params.ext_capab_len =
4209                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4210         }
4211
4212         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4213                 return -EINVAL;
4214
4215         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4216                 return -EINVAL;
4217
4218         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4219                 params.plink_action =
4220                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4221                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4222                         return -EINVAL;
4223         }
4224
4225         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4226                 params.plink_state =
4227                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4228                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4229                         return -EINVAL;
4230                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4231         }
4232
4233         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4234                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4235                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4236
4237                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4238                     pm > NL80211_MESH_POWER_MAX)
4239                         return -EINVAL;
4240
4241                 params.local_pm = pm;
4242         }
4243
4244         /* Include parameters for TDLS peer (will check later) */
4245         err = nl80211_set_station_tdls(info, &params);
4246         if (err)
4247                 return err;
4248
4249         params.vlan = get_vlan(info, rdev);
4250         if (IS_ERR(params.vlan))
4251                 return PTR_ERR(params.vlan);
4252
4253         switch (dev->ieee80211_ptr->iftype) {
4254         case NL80211_IFTYPE_AP:
4255         case NL80211_IFTYPE_AP_VLAN:
4256         case NL80211_IFTYPE_P2P_GO:
4257         case NL80211_IFTYPE_P2P_CLIENT:
4258         case NL80211_IFTYPE_STATION:
4259         case NL80211_IFTYPE_ADHOC:
4260         case NL80211_IFTYPE_MESH_POINT:
4261                 break;
4262         default:
4263                 err = -EOPNOTSUPP;
4264                 goto out_put_vlan;
4265         }
4266
4267         /* driver will call cfg80211_check_station_change() */
4268         err = rdev_change_station(rdev, dev, mac_addr, &params);
4269
4270  out_put_vlan:
4271         if (params.vlan)
4272                 dev_put(params.vlan);
4273
4274         return err;
4275 }
4276
4277 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4278 {
4279         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4280         int err;
4281         struct net_device *dev = info->user_ptr[1];
4282         struct station_parameters params;
4283         u8 *mac_addr = NULL;
4284
4285         memset(&params, 0, sizeof(params));
4286
4287         if (!rdev->ops->add_station)
4288                 return -EOPNOTSUPP;
4289
4290         if (!info->attrs[NL80211_ATTR_MAC])
4291                 return -EINVAL;
4292
4293         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4294                 return -EINVAL;
4295
4296         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4297                 return -EINVAL;
4298
4299         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4300             !info->attrs[NL80211_ATTR_PEER_AID])
4301                 return -EINVAL;
4302
4303         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4304         params.supported_rates =
4305                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4306         params.supported_rates_len =
4307                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4308         params.listen_interval =
4309                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4310
4311         if (info->attrs[NL80211_ATTR_PEER_AID])
4312                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4313         else
4314                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4315         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4316                 return -EINVAL;
4317
4318         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4319                 params.capability =
4320                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4321                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4322         }
4323
4324         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4325                 params.ext_capab =
4326                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4327                 params.ext_capab_len =
4328                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4329         }
4330
4331         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4332                 params.ht_capa =
4333                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4334
4335         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4336                 params.vht_capa =
4337                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4338
4339         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4340                 params.opmode_notif_used = true;
4341                 params.opmode_notif =
4342                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4343         }
4344
4345         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4346                 params.plink_action =
4347                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4348                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4349                         return -EINVAL;
4350         }
4351
4352         err = nl80211_parse_sta_channel_info(info, &params);
4353         if (err)
4354                 return err;
4355
4356         err = nl80211_parse_sta_wme(info, &params);
4357         if (err)
4358                 return err;
4359
4360         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4361                 return -EINVAL;
4362
4363         /* When you run into this, adjust the code below for the new flag */
4364         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4365
4366         switch (dev->ieee80211_ptr->iftype) {
4367         case NL80211_IFTYPE_AP:
4368         case NL80211_IFTYPE_AP_VLAN:
4369         case NL80211_IFTYPE_P2P_GO:
4370                 /* ignore WME attributes if iface/sta is not capable */
4371                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4372                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4373                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4374
4375                 /* TDLS peers cannot be added */
4376                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4377                     info->attrs[NL80211_ATTR_PEER_AID])
4378                         return -EINVAL;
4379                 /* but don't bother the driver with it */
4380                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4381
4382                 /* allow authenticated/associated only if driver handles it */
4383                 if (!(rdev->wiphy.features &
4384                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4385                     params.sta_flags_mask &
4386                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4387                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4388                         return -EINVAL;
4389
4390                 /* must be last in here for error handling */
4391                 params.vlan = get_vlan(info, rdev);
4392                 if (IS_ERR(params.vlan))
4393                         return PTR_ERR(params.vlan);
4394                 break;
4395         case NL80211_IFTYPE_MESH_POINT:
4396                 /* ignore uAPSD data */
4397                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4398
4399                 /* associated is disallowed */
4400                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4401                         return -EINVAL;
4402                 /* TDLS peers cannot be added */
4403                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4404                     info->attrs[NL80211_ATTR_PEER_AID])
4405                         return -EINVAL;
4406                 break;
4407         case NL80211_IFTYPE_STATION:
4408         case NL80211_IFTYPE_P2P_CLIENT:
4409                 /* ignore uAPSD data */
4410                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4411
4412                 /* these are disallowed */
4413                 if (params.sta_flags_mask &
4414                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4415                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4416                         return -EINVAL;
4417                 /* Only TDLS peers can be added */
4418                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4419                         return -EINVAL;
4420                 /* Can only add if TDLS ... */
4421                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4422                         return -EOPNOTSUPP;
4423                 /* ... with external setup is supported */
4424                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4425                         return -EOPNOTSUPP;
4426                 /*
4427                  * Older wpa_supplicant versions always mark the TDLS peer
4428                  * as authorized, but it shouldn't yet be.
4429                  */
4430                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4431                 break;
4432         default:
4433                 return -EOPNOTSUPP;
4434         }
4435
4436         /* be aware of params.vlan when changing code here */
4437
4438         err = rdev_add_station(rdev, dev, mac_addr, &params);
4439
4440         if (params.vlan)
4441                 dev_put(params.vlan);
4442         return err;
4443 }
4444
4445 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4446 {
4447         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4448         struct net_device *dev = info->user_ptr[1];
4449         struct station_del_parameters params;
4450
4451         memset(&params, 0, sizeof(params));
4452
4453         if (info->attrs[NL80211_ATTR_MAC])
4454                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
4455
4456         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4457             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4458             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4459             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4460                 return -EINVAL;
4461
4462         if (!rdev->ops->del_station)
4463                 return -EOPNOTSUPP;
4464
4465         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
4466                 params.subtype =
4467                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
4468                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
4469                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
4470                         return -EINVAL;
4471         } else {
4472                 /* Default to Deauthentication frame */
4473                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
4474         }
4475
4476         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
4477                 params.reason_code =
4478                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4479                 if (params.reason_code == 0)
4480                         return -EINVAL; /* 0 is reserved */
4481         } else {
4482                 /* Default to reason code 2 */
4483                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
4484         }
4485
4486         return rdev_del_station(rdev, dev, &params);
4487 }
4488
4489 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4490                                 int flags, struct net_device *dev,
4491                                 u8 *dst, u8 *next_hop,
4492                                 struct mpath_info *pinfo)
4493 {
4494         void *hdr;
4495         struct nlattr *pinfoattr;
4496
4497         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
4498         if (!hdr)
4499                 return -1;
4500
4501         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4502             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4503             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4504             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4505                 goto nla_put_failure;
4506
4507         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4508         if (!pinfoattr)
4509                 goto nla_put_failure;
4510         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4511             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4512                         pinfo->frame_qlen))
4513                 goto nla_put_failure;
4514         if (((pinfo->filled & MPATH_INFO_SN) &&
4515              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4516             ((pinfo->filled & MPATH_INFO_METRIC) &&
4517              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4518                          pinfo->metric)) ||
4519             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4520              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4521                          pinfo->exptime)) ||
4522             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4523              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4524                         pinfo->flags)) ||
4525             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4526              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4527                          pinfo->discovery_timeout)) ||
4528             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4529              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4530                         pinfo->discovery_retries)))
4531                 goto nla_put_failure;
4532
4533         nla_nest_end(msg, pinfoattr);
4534
4535         return genlmsg_end(msg, hdr);
4536
4537  nla_put_failure:
4538         genlmsg_cancel(msg, hdr);
4539         return -EMSGSIZE;
4540 }
4541
4542 static int nl80211_dump_mpath(struct sk_buff *skb,
4543                               struct netlink_callback *cb)
4544 {
4545         struct mpath_info pinfo;
4546         struct cfg80211_registered_device *rdev;
4547         struct wireless_dev *wdev;
4548         u8 dst[ETH_ALEN];
4549         u8 next_hop[ETH_ALEN];
4550         int path_idx = cb->args[2];
4551         int err;
4552
4553         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4554         if (err)
4555                 return err;
4556
4557         if (!rdev->ops->dump_mpath) {
4558                 err = -EOPNOTSUPP;
4559                 goto out_err;
4560         }
4561
4562         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4563                 err = -EOPNOTSUPP;
4564                 goto out_err;
4565         }
4566
4567         while (1) {
4568                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4569                                       next_hop, &pinfo);
4570                 if (err == -ENOENT)
4571                         break;
4572                 if (err)
4573                         goto out_err;
4574
4575                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4576                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4577                                        wdev->netdev, dst, next_hop,
4578                                        &pinfo) < 0)
4579                         goto out;
4580
4581                 path_idx++;
4582         }
4583
4584
4585  out:
4586         cb->args[2] = path_idx;
4587         err = skb->len;
4588  out_err:
4589         nl80211_finish_wdev_dump(rdev);
4590         return err;
4591 }
4592
4593 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4594 {
4595         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4596         int err;
4597         struct net_device *dev = info->user_ptr[1];
4598         struct mpath_info pinfo;
4599         struct sk_buff *msg;
4600         u8 *dst = NULL;
4601         u8 next_hop[ETH_ALEN];
4602
4603         memset(&pinfo, 0, sizeof(pinfo));
4604
4605         if (!info->attrs[NL80211_ATTR_MAC])
4606                 return -EINVAL;
4607
4608         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4609
4610         if (!rdev->ops->get_mpath)
4611                 return -EOPNOTSUPP;
4612
4613         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4614                 return -EOPNOTSUPP;
4615
4616         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4617         if (err)
4618                 return err;
4619
4620         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4621         if (!msg)
4622                 return -ENOMEM;
4623
4624         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4625                                  dev, dst, next_hop, &pinfo) < 0) {
4626                 nlmsg_free(msg);
4627                 return -ENOBUFS;
4628         }
4629
4630         return genlmsg_reply(msg, info);
4631 }
4632
4633 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4634 {
4635         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4636         struct net_device *dev = info->user_ptr[1];
4637         u8 *dst = NULL;
4638         u8 *next_hop = NULL;
4639
4640         if (!info->attrs[NL80211_ATTR_MAC])
4641                 return -EINVAL;
4642
4643         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4644                 return -EINVAL;
4645
4646         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4647         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4648
4649         if (!rdev->ops->change_mpath)
4650                 return -EOPNOTSUPP;
4651
4652         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4653                 return -EOPNOTSUPP;
4654
4655         return rdev_change_mpath(rdev, dev, dst, next_hop);
4656 }
4657
4658 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4659 {
4660         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4661         struct net_device *dev = info->user_ptr[1];
4662         u8 *dst = NULL;
4663         u8 *next_hop = NULL;
4664
4665         if (!info->attrs[NL80211_ATTR_MAC])
4666                 return -EINVAL;
4667
4668         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4669                 return -EINVAL;
4670
4671         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4672         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4673
4674         if (!rdev->ops->add_mpath)
4675                 return -EOPNOTSUPP;
4676
4677         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4678                 return -EOPNOTSUPP;
4679
4680         return rdev_add_mpath(rdev, dev, dst, next_hop);
4681 }
4682
4683 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4684 {
4685         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4686         struct net_device *dev = info->user_ptr[1];
4687         u8 *dst = NULL;
4688
4689         if (info->attrs[NL80211_ATTR_MAC])
4690                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4691
4692         if (!rdev->ops->del_mpath)
4693                 return -EOPNOTSUPP;
4694
4695         return rdev_del_mpath(rdev, dev, dst);
4696 }
4697
4698 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
4699 {
4700         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4701         int err;
4702         struct net_device *dev = info->user_ptr[1];
4703         struct mpath_info pinfo;
4704         struct sk_buff *msg;
4705         u8 *dst = NULL;
4706         u8 mpp[ETH_ALEN];
4707
4708         memset(&pinfo, 0, sizeof(pinfo));
4709
4710         if (!info->attrs[NL80211_ATTR_MAC])
4711                 return -EINVAL;
4712
4713         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4714
4715         if (!rdev->ops->get_mpp)
4716                 return -EOPNOTSUPP;
4717
4718         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4719                 return -EOPNOTSUPP;
4720
4721         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
4722         if (err)
4723                 return err;
4724
4725         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4726         if (!msg)
4727                 return -ENOMEM;
4728
4729         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4730                                dev, dst, mpp, &pinfo) < 0) {
4731                 nlmsg_free(msg);
4732                 return -ENOBUFS;
4733         }
4734
4735         return genlmsg_reply(msg, info);
4736 }
4737
4738 static int nl80211_dump_mpp(struct sk_buff *skb,
4739                             struct netlink_callback *cb)
4740 {
4741         struct mpath_info pinfo;
4742         struct cfg80211_registered_device *rdev;
4743         struct wireless_dev *wdev;
4744         u8 dst[ETH_ALEN];
4745         u8 mpp[ETH_ALEN];
4746         int path_idx = cb->args[2];
4747         int err;
4748
4749         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4750         if (err)
4751                 return err;
4752
4753         if (!rdev->ops->dump_mpp) {
4754                 err = -EOPNOTSUPP;
4755                 goto out_err;
4756         }
4757
4758         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4759                 err = -EOPNOTSUPP;
4760                 goto out_err;
4761         }
4762
4763         while (1) {
4764                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
4765                                     mpp, &pinfo);
4766                 if (err == -ENOENT)
4767                         break;
4768                 if (err)
4769                         goto out_err;
4770
4771                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4772                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4773                                        wdev->netdev, dst, mpp,
4774                                        &pinfo) < 0)
4775                         goto out;
4776
4777                 path_idx++;
4778         }
4779
4780  out:
4781         cb->args[2] = path_idx;
4782         err = skb->len;
4783  out_err:
4784         nl80211_finish_wdev_dump(rdev);
4785         return err;
4786 }
4787
4788 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4789 {
4790         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4791         struct net_device *dev = info->user_ptr[1];
4792         struct wireless_dev *wdev = dev->ieee80211_ptr;
4793         struct bss_parameters params;
4794         int err;
4795
4796         memset(&params, 0, sizeof(params));
4797         /* default to not changing parameters */
4798         params.use_cts_prot = -1;
4799         params.use_short_preamble = -1;
4800         params.use_short_slot_time = -1;
4801         params.ap_isolate = -1;
4802         params.ht_opmode = -1;
4803         params.p2p_ctwindow = -1;
4804         params.p2p_opp_ps = -1;
4805
4806         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4807                 params.use_cts_prot =
4808                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4809         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4810                 params.use_short_preamble =
4811                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4812         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4813                 params.use_short_slot_time =
4814                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4815         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4816                 params.basic_rates =
4817                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4818                 params.basic_rates_len =
4819                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4820         }
4821         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4822                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4823         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4824                 params.ht_opmode =
4825                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4826
4827         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4828                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4829                         return -EINVAL;
4830                 params.p2p_ctwindow =
4831                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4832                 if (params.p2p_ctwindow < 0)
4833                         return -EINVAL;
4834                 if (params.p2p_ctwindow != 0 &&
4835                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4836                         return -EINVAL;
4837         }
4838
4839         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4840                 u8 tmp;
4841
4842                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4843                         return -EINVAL;
4844                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4845                 if (tmp > 1)
4846                         return -EINVAL;
4847                 params.p2p_opp_ps = tmp;
4848                 if (params.p2p_opp_ps &&
4849                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4850                         return -EINVAL;
4851         }
4852
4853         if (!rdev->ops->change_bss)
4854                 return -EOPNOTSUPP;
4855
4856         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4857             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4858                 return -EOPNOTSUPP;
4859
4860         wdev_lock(wdev);
4861         err = rdev_change_bss(rdev, dev, &params);
4862         wdev_unlock(wdev);
4863
4864         return err;
4865 }
4866
4867 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4868         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4869         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4870         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4871         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4872         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4873         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4874         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
4875 };
4876
4877 static int parse_reg_rule(struct nlattr *tb[],
4878         struct ieee80211_reg_rule *reg_rule)
4879 {
4880         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4881         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4882
4883         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4884                 return -EINVAL;
4885         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4886                 return -EINVAL;
4887         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4888                 return -EINVAL;
4889         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4890                 return -EINVAL;
4891         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4892                 return -EINVAL;
4893
4894         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4895
4896         freq_range->start_freq_khz =
4897                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4898         freq_range->end_freq_khz =
4899                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4900         freq_range->max_bandwidth_khz =
4901                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4902
4903         power_rule->max_eirp =
4904                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4905
4906         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4907                 power_rule->max_antenna_gain =
4908                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4909
4910         if (tb[NL80211_ATTR_DFS_CAC_TIME])
4911                 reg_rule->dfs_cac_ms =
4912                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
4913
4914         return 0;
4915 }
4916
4917 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4918 {
4919         char *data = NULL;
4920         enum nl80211_user_reg_hint_type user_reg_hint_type;
4921
4922         /*
4923          * You should only get this when cfg80211 hasn't yet initialized
4924          * completely when built-in to the kernel right between the time
4925          * window between nl80211_init() and regulatory_init(), if that is
4926          * even possible.
4927          */
4928         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4929                 return -EINPROGRESS;
4930
4931         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4932                 user_reg_hint_type =
4933                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4934         else
4935                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4936
4937         switch (user_reg_hint_type) {
4938         case NL80211_USER_REG_HINT_USER:
4939         case NL80211_USER_REG_HINT_CELL_BASE:
4940                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4941                         return -EINVAL;
4942
4943                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4944                 return regulatory_hint_user(data, user_reg_hint_type);
4945         case NL80211_USER_REG_HINT_INDOOR:
4946                 return regulatory_hint_indoor_user();
4947         default:
4948                 return -EINVAL;
4949         }
4950 }
4951
4952 static int nl80211_get_mesh_config(struct sk_buff *skb,
4953                                    struct genl_info *info)
4954 {
4955         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4956         struct net_device *dev = info->user_ptr[1];
4957         struct wireless_dev *wdev = dev->ieee80211_ptr;
4958         struct mesh_config cur_params;
4959         int err = 0;
4960         void *hdr;
4961         struct nlattr *pinfoattr;
4962         struct sk_buff *msg;
4963
4964         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4965                 return -EOPNOTSUPP;
4966
4967         if (!rdev->ops->get_mesh_config)
4968                 return -EOPNOTSUPP;
4969
4970         wdev_lock(wdev);
4971         /* If not connected, get default parameters */
4972         if (!wdev->mesh_id_len)
4973                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4974         else
4975                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4976         wdev_unlock(wdev);
4977
4978         if (err)
4979                 return err;
4980
4981         /* Draw up a netlink message to send back */
4982         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4983         if (!msg)
4984                 return -ENOMEM;
4985         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4986                              NL80211_CMD_GET_MESH_CONFIG);
4987         if (!hdr)
4988                 goto out;
4989         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4990         if (!pinfoattr)
4991                 goto nla_put_failure;
4992         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4993             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4994                         cur_params.dot11MeshRetryTimeout) ||
4995             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4996                         cur_params.dot11MeshConfirmTimeout) ||
4997             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4998                         cur_params.dot11MeshHoldingTimeout) ||
4999             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5000                         cur_params.dot11MeshMaxPeerLinks) ||
5001             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5002                        cur_params.dot11MeshMaxRetries) ||
5003             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5004                        cur_params.dot11MeshTTL) ||
5005             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5006                        cur_params.element_ttl) ||
5007             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5008                        cur_params.auto_open_plinks) ||
5009             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5010                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5011             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5012                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5013             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5014                         cur_params.path_refresh_time) ||
5015             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5016                         cur_params.min_discovery_timeout) ||
5017             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5018                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5019             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5020                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5021             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5022                         cur_params.dot11MeshHWMPperrMinInterval) ||
5023             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5024                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5025             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5026                        cur_params.dot11MeshHWMPRootMode) ||
5027             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5028                         cur_params.dot11MeshHWMPRannInterval) ||
5029             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5030                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5031             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5032                        cur_params.dot11MeshForwarding) ||
5033             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5034                         cur_params.rssi_threshold) ||
5035             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5036                         cur_params.ht_opmode) ||
5037             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5038                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5039             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5040                         cur_params.dot11MeshHWMProotInterval) ||
5041             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5042                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5043             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5044                         cur_params.power_mode) ||
5045             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5046                         cur_params.dot11MeshAwakeWindowDuration) ||
5047             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5048                         cur_params.plink_timeout))
5049                 goto nla_put_failure;
5050         nla_nest_end(msg, pinfoattr);
5051         genlmsg_end(msg, hdr);
5052         return genlmsg_reply(msg, info);
5053
5054  nla_put_failure:
5055         genlmsg_cancel(msg, hdr);
5056  out:
5057         nlmsg_free(msg);
5058         return -ENOBUFS;
5059 }
5060
5061 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5062         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5063         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5064         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5065         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5066         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5067         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5068         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5069         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5070         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5071         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5072         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5073         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5074         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5075         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5076         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5077         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5078         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5079         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5080         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5081         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5082         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5083         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5084         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5085         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5086         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5087         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5088         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5089         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5090 };
5091
5092 static const struct nla_policy
5093         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5094         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5095         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5096         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5097         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5098         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5099         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5100         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5101                                     .len = IEEE80211_MAX_DATA_LEN },
5102         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5103 };
5104
5105 static int nl80211_parse_mesh_config(struct genl_info *info,
5106                                      struct mesh_config *cfg,
5107                                      u32 *mask_out)
5108 {
5109         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5110         u32 mask = 0;
5111
5112 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5113 do {                                                                        \
5114         if (tb[attr]) {                                                     \
5115                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
5116                         return -EINVAL;                                     \
5117                 cfg->param = fn(tb[attr]);                                  \
5118                 mask |= (1 << (attr - 1));                                  \
5119         }                                                                   \
5120 } while (0)
5121
5122
5123         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5124                 return -EINVAL;
5125         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5126                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5127                              nl80211_meshconf_params_policy))
5128                 return -EINVAL;
5129
5130         /* This makes sure that there aren't more than 32 mesh config
5131          * parameters (otherwise our bitfield scheme would not work.) */
5132         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5133
5134         /* Fill in the params struct */
5135         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5136                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5137                                   nla_get_u16);
5138         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5139                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5140                                   nla_get_u16);
5141         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5142                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5143                                   nla_get_u16);
5144         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5145                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5146                                   nla_get_u16);
5147         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5148                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5149                                   nla_get_u8);
5150         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5151                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
5152         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5153                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5154                                   nla_get_u8);
5155         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5156                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5157                                   nla_get_u8);
5158         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5159                                   1, 255, mask,
5160                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5161                                   nla_get_u32);
5162         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5163                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5164                                   nla_get_u8);
5165         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5166                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5167                                   nla_get_u32);
5168         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5169                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5170                                   nla_get_u16);
5171         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5172                                   1, 65535, mask,
5173                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5174                                   nla_get_u32);
5175         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5176                                   1, 65535, mask,
5177                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5178                                   nla_get_u16);
5179         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5180                                   1, 65535, mask,
5181                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5182                                   nla_get_u16);
5183         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5184                                   dot11MeshHWMPnetDiameterTraversalTime,
5185                                   1, 65535, mask,
5186                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5187                                   nla_get_u16);
5188         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5189                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5190                                   nla_get_u8);
5191         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5192                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5193                                   nla_get_u16);
5194         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5195                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5196                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5197                                   nla_get_u8);
5198         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5199                                   mask, NL80211_MESHCONF_FORWARDING,
5200                                   nla_get_u8);
5201         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5202                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5203                                   nla_get_s32);
5204         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5205                                   mask, NL80211_MESHCONF_HT_OPMODE,
5206                                   nla_get_u16);
5207         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5208                                   1, 65535, mask,
5209                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5210                                   nla_get_u32);
5211         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5212                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5213                                   nla_get_u16);
5214         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5215                                   dot11MeshHWMPconfirmationInterval,
5216                                   1, 65535, mask,
5217                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5218                                   nla_get_u16);
5219         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5220                                   NL80211_MESH_POWER_ACTIVE,
5221                                   NL80211_MESH_POWER_MAX,
5222                                   mask, NL80211_MESHCONF_POWER_MODE,
5223                                   nla_get_u32);
5224         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5225                                   0, 65535, mask,
5226                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5227         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
5228                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5229                                   nla_get_u32);
5230         if (mask_out)
5231                 *mask_out = mask;
5232
5233         return 0;
5234
5235 #undef FILL_IN_MESH_PARAM_IF_SET
5236 }
5237
5238 static int nl80211_parse_mesh_setup(struct genl_info *info,
5239                                      struct mesh_setup *setup)
5240 {
5241         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5242         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5243
5244         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5245                 return -EINVAL;
5246         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5247                              info->attrs[NL80211_ATTR_MESH_SETUP],
5248                              nl80211_mesh_setup_params_policy))
5249                 return -EINVAL;
5250
5251         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5252                 setup->sync_method =
5253                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5254                  IEEE80211_SYNC_METHOD_VENDOR :
5255                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5256
5257         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5258                 setup->path_sel_proto =
5259                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5260                  IEEE80211_PATH_PROTOCOL_VENDOR :
5261                  IEEE80211_PATH_PROTOCOL_HWMP;
5262
5263         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5264                 setup->path_metric =
5265                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5266                  IEEE80211_PATH_METRIC_VENDOR :
5267                  IEEE80211_PATH_METRIC_AIRTIME;
5268
5269
5270         if (tb[NL80211_MESH_SETUP_IE]) {
5271                 struct nlattr *ieattr =
5272                         tb[NL80211_MESH_SETUP_IE];
5273                 if (!is_valid_ie_attr(ieattr))
5274                         return -EINVAL;
5275                 setup->ie = nla_data(ieattr);
5276                 setup->ie_len = nla_len(ieattr);
5277         }
5278         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5279             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5280                 return -EINVAL;
5281         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5282         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5283         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5284         if (setup->is_secure)
5285                 setup->user_mpm = true;
5286
5287         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5288                 if (!setup->user_mpm)
5289                         return -EINVAL;
5290                 setup->auth_id =
5291                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5292         }
5293
5294         return 0;
5295 }
5296
5297 static int nl80211_update_mesh_config(struct sk_buff *skb,
5298                                       struct genl_info *info)
5299 {
5300         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5301         struct net_device *dev = info->user_ptr[1];
5302         struct wireless_dev *wdev = dev->ieee80211_ptr;
5303         struct mesh_config cfg;
5304         u32 mask;
5305         int err;
5306
5307         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5308                 return -EOPNOTSUPP;
5309
5310         if (!rdev->ops->update_mesh_config)
5311                 return -EOPNOTSUPP;
5312
5313         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5314         if (err)
5315                 return err;
5316
5317         wdev_lock(wdev);
5318         if (!wdev->mesh_id_len)
5319                 err = -ENOLINK;
5320
5321         if (!err)
5322                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5323
5324         wdev_unlock(wdev);
5325
5326         return err;
5327 }
5328
5329 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
5330 {
5331         const struct ieee80211_regdomain *regdom;
5332         struct sk_buff *msg;
5333         void *hdr = NULL;
5334         struct nlattr *nl_reg_rules;
5335         unsigned int i;
5336
5337         if (!cfg80211_regdomain)
5338                 return -EINVAL;
5339
5340         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5341         if (!msg)
5342                 return -ENOBUFS;
5343
5344         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5345                              NL80211_CMD_GET_REG);
5346         if (!hdr)
5347                 goto put_failure;
5348
5349         if (reg_last_request_cell_base() &&
5350             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5351                         NL80211_USER_REG_HINT_CELL_BASE))
5352                 goto nla_put_failure;
5353
5354         rcu_read_lock();
5355         regdom = rcu_dereference(cfg80211_regdomain);
5356
5357         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5358             (regdom->dfs_region &&
5359              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5360                 goto nla_put_failure_rcu;
5361
5362         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5363         if (!nl_reg_rules)
5364                 goto nla_put_failure_rcu;
5365
5366         for (i = 0; i < regdom->n_reg_rules; i++) {
5367                 struct nlattr *nl_reg_rule;
5368                 const struct ieee80211_reg_rule *reg_rule;
5369                 const struct ieee80211_freq_range *freq_range;
5370                 const struct ieee80211_power_rule *power_rule;
5371                 unsigned int max_bandwidth_khz;
5372
5373                 reg_rule = &regdom->reg_rules[i];
5374                 freq_range = &reg_rule->freq_range;
5375                 power_rule = &reg_rule->power_rule;
5376
5377                 nl_reg_rule = nla_nest_start(msg, i);
5378                 if (!nl_reg_rule)
5379                         goto nla_put_failure_rcu;
5380
5381                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5382                 if (!max_bandwidth_khz)
5383                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5384                                                                   reg_rule);
5385
5386                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5387                                 reg_rule->flags) ||
5388                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5389                                 freq_range->start_freq_khz) ||
5390                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5391                                 freq_range->end_freq_khz) ||
5392                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5393                                 max_bandwidth_khz) ||
5394                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5395                                 power_rule->max_antenna_gain) ||
5396                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5397                                 power_rule->max_eirp) ||
5398                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5399                                 reg_rule->dfs_cac_ms))
5400                         goto nla_put_failure_rcu;
5401
5402                 nla_nest_end(msg, nl_reg_rule);
5403         }
5404         rcu_read_unlock();
5405
5406         nla_nest_end(msg, nl_reg_rules);
5407
5408         genlmsg_end(msg, hdr);
5409         return genlmsg_reply(msg, info);
5410
5411 nla_put_failure_rcu:
5412         rcu_read_unlock();
5413 nla_put_failure:
5414         genlmsg_cancel(msg, hdr);
5415 put_failure:
5416         nlmsg_free(msg);
5417         return -EMSGSIZE;
5418 }
5419
5420 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5421 {
5422         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5423         struct nlattr *nl_reg_rule;
5424         char *alpha2 = NULL;
5425         int rem_reg_rules = 0, r = 0;
5426         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5427         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5428         struct ieee80211_regdomain *rd = NULL;
5429
5430         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5431                 return -EINVAL;
5432
5433         if (!info->attrs[NL80211_ATTR_REG_RULES])
5434                 return -EINVAL;
5435
5436         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5437
5438         if (info->attrs[NL80211_ATTR_DFS_REGION])
5439                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5440
5441         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5442                             rem_reg_rules) {
5443                 num_rules++;
5444                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5445                         return -EINVAL;
5446         }
5447
5448         if (!reg_is_valid_request(alpha2))
5449                 return -EINVAL;
5450
5451         size_of_regd = sizeof(struct ieee80211_regdomain) +
5452                        num_rules * sizeof(struct ieee80211_reg_rule);
5453
5454         rd = kzalloc(size_of_regd, GFP_KERNEL);
5455         if (!rd)
5456                 return -ENOMEM;
5457
5458         rd->n_reg_rules = num_rules;
5459         rd->alpha2[0] = alpha2[0];
5460         rd->alpha2[1] = alpha2[1];
5461
5462         /*
5463          * Disable DFS master mode if the DFS region was
5464          * not supported or known on this kernel.
5465          */
5466         if (reg_supported_dfs_region(dfs_region))
5467                 rd->dfs_region = dfs_region;
5468
5469         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5470                             rem_reg_rules) {
5471                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5472                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5473                               reg_rule_policy);
5474                 if (r)
5475                         goto bad_reg;
5476                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5477                 if (r)
5478                         goto bad_reg;
5479
5480                 rule_idx++;
5481
5482                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5483                         r = -EINVAL;
5484                         goto bad_reg;
5485                 }
5486         }
5487
5488         r = set_regdom(rd);
5489         /* set_regdom took ownership */
5490         rd = NULL;
5491
5492  bad_reg:
5493         kfree(rd);
5494         return r;
5495 }
5496
5497 static int validate_scan_freqs(struct nlattr *freqs)
5498 {
5499         struct nlattr *attr1, *attr2;
5500         int n_channels = 0, tmp1, tmp2;
5501
5502         nla_for_each_nested(attr1, freqs, tmp1) {
5503                 n_channels++;
5504                 /*
5505                  * Some hardware has a limited channel list for
5506                  * scanning, and it is pretty much nonsensical
5507                  * to scan for a channel twice, so disallow that
5508                  * and don't require drivers to check that the
5509                  * channel list they get isn't longer than what
5510                  * they can scan, as long as they can scan all
5511                  * the channels they registered at once.
5512                  */
5513                 nla_for_each_nested(attr2, freqs, tmp2)
5514                         if (attr1 != attr2 &&
5515                             nla_get_u32(attr1) == nla_get_u32(attr2))
5516                                 return 0;
5517         }
5518
5519         return n_channels;
5520 }
5521
5522 static int nl80211_parse_random_mac(struct nlattr **attrs,
5523                                     u8 *mac_addr, u8 *mac_addr_mask)
5524 {
5525         int i;
5526
5527         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
5528                 memset(mac_addr, 0, ETH_ALEN);
5529                 memset(mac_addr_mask, 0, ETH_ALEN);
5530                 mac_addr[0] = 0x2;
5531                 mac_addr_mask[0] = 0x3;
5532
5533                 return 0;
5534         }
5535
5536         /* need both or none */
5537         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
5538                 return -EINVAL;
5539
5540         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
5541         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
5542
5543         /* don't allow or configure an mcast address */
5544         if (!is_multicast_ether_addr(mac_addr_mask) ||
5545             is_multicast_ether_addr(mac_addr))
5546                 return -EINVAL;
5547
5548         /*
5549          * allow users to pass a MAC address that has bits set outside
5550          * of the mask, but don't bother drivers with having to deal
5551          * with such bits
5552          */
5553         for (i = 0; i < ETH_ALEN; i++)
5554                 mac_addr[i] &= mac_addr_mask[i];
5555
5556         return 0;
5557 }
5558
5559 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5560 {
5561         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5562         struct wireless_dev *wdev = info->user_ptr[1];
5563         struct cfg80211_scan_request *request;
5564         struct nlattr *attr;
5565         struct wiphy *wiphy;
5566         int err, tmp, n_ssids = 0, n_channels, i;
5567         size_t ie_len;
5568
5569         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5570                 return -EINVAL;
5571
5572         wiphy = &rdev->wiphy;
5573
5574         if (!rdev->ops->scan)
5575                 return -EOPNOTSUPP;
5576
5577         if (rdev->scan_req || rdev->scan_msg) {
5578                 err = -EBUSY;
5579                 goto unlock;
5580         }
5581
5582         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5583                 n_channels = validate_scan_freqs(
5584                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5585                 if (!n_channels) {
5586                         err = -EINVAL;
5587                         goto unlock;
5588                 }
5589         } else {
5590                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5591         }
5592
5593         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5594                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5595                         n_ssids++;
5596
5597         if (n_ssids > wiphy->max_scan_ssids) {
5598                 err = -EINVAL;
5599                 goto unlock;
5600         }
5601
5602         if (info->attrs[NL80211_ATTR_IE])
5603                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5604         else
5605                 ie_len = 0;
5606
5607         if (ie_len > wiphy->max_scan_ie_len) {
5608                 err = -EINVAL;
5609                 goto unlock;
5610         }
5611
5612         request = kzalloc(sizeof(*request)
5613                         + sizeof(*request->ssids) * n_ssids
5614                         + sizeof(*request->channels) * n_channels
5615                         + ie_len, GFP_KERNEL);
5616         if (!request) {
5617                 err = -ENOMEM;
5618                 goto unlock;
5619         }
5620
5621         if (n_ssids)
5622                 request->ssids = (void *)&request->channels[n_channels];
5623         request->n_ssids = n_ssids;
5624         if (ie_len) {
5625                 if (request->ssids)
5626                         request->ie = (void *)(request->ssids + n_ssids);
5627                 else
5628                         request->ie = (void *)(request->channels + n_channels);
5629         }
5630
5631         i = 0;
5632         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5633                 /* user specified, bail out if channel not found */
5634                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5635                         struct ieee80211_channel *chan;
5636
5637                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5638
5639                         if (!chan) {
5640                                 err = -EINVAL;
5641                                 goto out_free;
5642                         }
5643
5644                         /* ignore disabled channels */
5645                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5646                                 continue;
5647
5648                         request->channels[i] = chan;
5649                         i++;
5650                 }
5651         } else {
5652                 enum ieee80211_band band;
5653
5654                 /* all channels */
5655                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5656                         int j;
5657                         if (!wiphy->bands[band])
5658                                 continue;
5659                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5660                                 struct ieee80211_channel *chan;
5661
5662                                 chan = &wiphy->bands[band]->channels[j];
5663
5664                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5665                                         continue;
5666
5667                                 request->channels[i] = chan;
5668                                 i++;
5669                         }
5670                 }
5671         }
5672
5673         if (!i) {
5674                 err = -EINVAL;
5675                 goto out_free;
5676         }
5677
5678         request->n_channels = i;
5679
5680         i = 0;
5681         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5682                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5683                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5684                                 err = -EINVAL;
5685                                 goto out_free;
5686                         }
5687                         request->ssids[i].ssid_len = nla_len(attr);
5688                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5689                         i++;
5690                 }
5691         }
5692
5693         if (info->attrs[NL80211_ATTR_IE]) {
5694                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5695                 memcpy((void *)request->ie,
5696                        nla_data(info->attrs[NL80211_ATTR_IE]),
5697                        request->ie_len);
5698         }
5699
5700         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5701                 if (wiphy->bands[i])
5702                         request->rates[i] =
5703                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5704
5705         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5706                 nla_for_each_nested(attr,
5707                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5708                                     tmp) {
5709                         enum ieee80211_band band = nla_type(attr);
5710
5711                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5712                                 err = -EINVAL;
5713                                 goto out_free;
5714                         }
5715
5716                         if (!wiphy->bands[band])
5717                                 continue;
5718
5719                         err = ieee80211_get_ratemask(wiphy->bands[band],
5720                                                      nla_data(attr),
5721                                                      nla_len(attr),
5722                                                      &request->rates[band]);
5723                         if (err)
5724                                 goto out_free;
5725                 }
5726         }
5727
5728         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5729                 request->flags = nla_get_u32(
5730                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5731                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5732                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5733                         err = -EOPNOTSUPP;
5734                         goto out_free;
5735                 }
5736
5737                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
5738                         if (!(wiphy->features &
5739                                         NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
5740                                 err = -EOPNOTSUPP;
5741                                 goto out_free;
5742                         }
5743
5744                         if (wdev->current_bss) {
5745                                 err = -EOPNOTSUPP;
5746                                 goto out_free;
5747                         }
5748
5749                         err = nl80211_parse_random_mac(info->attrs,
5750                                                        request->mac_addr,
5751                                                        request->mac_addr_mask);
5752                         if (err)
5753                                 goto out_free;
5754                 }
5755         }
5756
5757         request->no_cck =
5758                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5759
5760         request->wdev = wdev;
5761         request->wiphy = &rdev->wiphy;
5762         request->scan_start = jiffies;
5763
5764         rdev->scan_req = request;
5765         err = rdev_scan(rdev, request);
5766
5767         if (!err) {
5768                 nl80211_send_scan_start(rdev, wdev);
5769                 if (wdev->netdev)
5770                         dev_hold(wdev->netdev);
5771         } else {
5772  out_free:
5773                 rdev->scan_req = NULL;
5774                 kfree(request);
5775         }
5776
5777  unlock:
5778         return err;
5779 }
5780
5781 static struct cfg80211_sched_scan_request *
5782 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
5783                          struct nlattr **attrs)
5784 {
5785         struct cfg80211_sched_scan_request *request;
5786         struct nlattr *attr;
5787         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5788         u32 interval;
5789         enum ieee80211_band band;
5790         size_t ie_len;
5791         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5792         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
5793
5794         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
5795                 return ERR_PTR(-EINVAL);
5796
5797         if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5798                 return ERR_PTR(-EINVAL);
5799
5800         interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5801         if (interval == 0)
5802                 return ERR_PTR(-EINVAL);
5803
5804         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5805                 n_channels = validate_scan_freqs(
5806                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5807                 if (!n_channels)
5808                         return ERR_PTR(-EINVAL);
5809         } else {
5810                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5811         }
5812
5813         if (attrs[NL80211_ATTR_SCAN_SSIDS])
5814                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
5815                                     tmp)
5816                         n_ssids++;
5817
5818         if (n_ssids > wiphy->max_sched_scan_ssids)
5819                 return ERR_PTR(-EINVAL);
5820
5821         /*
5822          * First, count the number of 'real' matchsets. Due to an issue with
5823          * the old implementation, matchsets containing only the RSSI attribute
5824          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
5825          * RSSI for all matchsets, rather than their own matchset for reporting
5826          * all APs with a strong RSSI. This is needed to be compatible with
5827          * older userspace that treated a matchset with only the RSSI as the
5828          * global RSSI for all other matchsets - if there are other matchsets.
5829          */
5830         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5831                 nla_for_each_nested(attr,
5832                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5833                                     tmp) {
5834                         struct nlattr *rssi;
5835
5836                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5837                                         nla_data(attr), nla_len(attr),
5838                                         nl80211_match_policy);
5839                         if (err)
5840                                 return ERR_PTR(err);
5841                         /* add other standalone attributes here */
5842                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
5843                                 n_match_sets++;
5844                                 continue;
5845                         }
5846                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5847                         if (rssi)
5848                                 default_match_rssi = nla_get_s32(rssi);
5849                 }
5850         }
5851
5852         /* However, if there's no other matchset, add the RSSI one */
5853         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
5854                 n_match_sets = 1;
5855
5856         if (n_match_sets > wiphy->max_match_sets)
5857                 return ERR_PTR(-EINVAL);
5858
5859         if (attrs[NL80211_ATTR_IE])
5860                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
5861         else
5862                 ie_len = 0;
5863
5864         if (ie_len > wiphy->max_sched_scan_ie_len)
5865                 return ERR_PTR(-EINVAL);
5866
5867         request = kzalloc(sizeof(*request)
5868                         + sizeof(*request->ssids) * n_ssids
5869                         + sizeof(*request->match_sets) * n_match_sets
5870                         + sizeof(*request->channels) * n_channels
5871                         + ie_len, GFP_KERNEL);
5872         if (!request)
5873                 return ERR_PTR(-ENOMEM);
5874
5875         if (n_ssids)
5876                 request->ssids = (void *)&request->channels[n_channels];
5877         request->n_ssids = n_ssids;
5878         if (ie_len) {
5879                 if (request->ssids)
5880                         request->ie = (void *)(request->ssids + n_ssids);
5881                 else
5882                         request->ie = (void *)(request->channels + n_channels);
5883         }
5884
5885         if (n_match_sets) {
5886                 if (request->ie)
5887                         request->match_sets = (void *)(request->ie + ie_len);
5888                 else if (request->ssids)
5889                         request->match_sets =
5890                                 (void *)(request->ssids + n_ssids);
5891                 else
5892                         request->match_sets =
5893                                 (void *)(request->channels + n_channels);
5894         }
5895         request->n_match_sets = n_match_sets;
5896
5897         i = 0;
5898         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5899                 /* user specified, bail out if channel not found */
5900                 nla_for_each_nested(attr,
5901                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5902                                     tmp) {
5903                         struct ieee80211_channel *chan;
5904
5905                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5906
5907                         if (!chan) {
5908                                 err = -EINVAL;
5909                                 goto out_free;
5910                         }
5911
5912                         /* ignore disabled channels */
5913                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5914                                 continue;
5915
5916                         request->channels[i] = chan;
5917                         i++;
5918                 }
5919         } else {
5920                 /* all channels */
5921                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5922                         int j;
5923                         if (!wiphy->bands[band])
5924                                 continue;
5925                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5926                                 struct ieee80211_channel *chan;
5927
5928                                 chan = &wiphy->bands[band]->channels[j];
5929
5930                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5931                                         continue;
5932
5933                                 request->channels[i] = chan;
5934                                 i++;
5935                         }
5936                 }
5937         }
5938
5939         if (!i) {
5940                 err = -EINVAL;
5941                 goto out_free;
5942         }
5943
5944         request->n_channels = i;
5945
5946         i = 0;
5947         if (attrs[NL80211_ATTR_SCAN_SSIDS]) {
5948                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
5949                                     tmp) {
5950                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5951                                 err = -EINVAL;
5952                                 goto out_free;
5953                         }
5954                         request->ssids[i].ssid_len = nla_len(attr);
5955                         memcpy(request->ssids[i].ssid, nla_data(attr),
5956                                nla_len(attr));
5957                         i++;
5958                 }
5959         }
5960
5961         i = 0;
5962         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5963                 nla_for_each_nested(attr,
5964                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5965                                     tmp) {
5966                         struct nlattr *ssid, *rssi;
5967
5968                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5969                                         nla_data(attr), nla_len(attr),
5970                                         nl80211_match_policy);
5971                         if (err)
5972                                 goto out_free;
5973                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5974                         if (ssid) {
5975                                 if (WARN_ON(i >= n_match_sets)) {
5976                                         /* this indicates a programming error,
5977                                          * the loop above should have verified
5978                                          * things properly
5979                                          */
5980                                         err = -EINVAL;
5981                                         goto out_free;
5982                                 }
5983
5984                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5985                                         err = -EINVAL;
5986                                         goto out_free;
5987                                 }
5988                                 memcpy(request->match_sets[i].ssid.ssid,
5989                                        nla_data(ssid), nla_len(ssid));
5990                                 request->match_sets[i].ssid.ssid_len =
5991                                         nla_len(ssid);
5992                                 /* special attribute - old implemenation w/a */
5993                                 request->match_sets[i].rssi_thold =
5994                                         default_match_rssi;
5995                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5996                                 if (rssi)
5997                                         request->match_sets[i].rssi_thold =
5998                                                 nla_get_s32(rssi);
5999                         }
6000                         i++;
6001                 }
6002
6003                 /* there was no other matchset, so the RSSI one is alone */
6004                 if (i == 0)
6005                         request->match_sets[0].rssi_thold = default_match_rssi;
6006
6007                 request->min_rssi_thold = INT_MAX;
6008                 for (i = 0; i < n_match_sets; i++)
6009                         request->min_rssi_thold =
6010                                 min(request->match_sets[i].rssi_thold,
6011                                     request->min_rssi_thold);
6012         } else {
6013                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
6014         }
6015
6016         if (ie_len) {
6017                 request->ie_len = ie_len;
6018                 memcpy((void *)request->ie,
6019                        nla_data(attrs[NL80211_ATTR_IE]),
6020                        request->ie_len);
6021         }
6022
6023         if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
6024                 request->flags = nla_get_u32(
6025                         attrs[NL80211_ATTR_SCAN_FLAGS]);
6026                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6027                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6028                         err = -EOPNOTSUPP;
6029                         goto out_free;
6030                 }
6031
6032                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6033                         u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6034
6035                         if (!wdev) /* must be net-detect */
6036                                 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6037
6038                         if (!(wiphy->features & flg)) {
6039                                 err = -EOPNOTSUPP;
6040                                 goto out_free;
6041                         }
6042
6043                         if (wdev && wdev->current_bss) {
6044                                 err = -EOPNOTSUPP;
6045                                 goto out_free;
6046                         }
6047
6048                         err = nl80211_parse_random_mac(attrs, request->mac_addr,
6049                                                        request->mac_addr_mask);
6050                         if (err)
6051                                 goto out_free;
6052                 }
6053         }
6054
6055         request->interval = interval;
6056         request->scan_start = jiffies;
6057
6058         return request;
6059
6060 out_free:
6061         kfree(request);
6062         return ERR_PTR(err);
6063 }
6064
6065 static int nl80211_start_sched_scan(struct sk_buff *skb,
6066                                     struct genl_info *info)
6067 {
6068         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6069         struct net_device *dev = info->user_ptr[1];
6070         struct wireless_dev *wdev = dev->ieee80211_ptr;
6071         int err;
6072
6073         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6074             !rdev->ops->sched_scan_start)
6075                 return -EOPNOTSUPP;
6076
6077         if (rdev->sched_scan_req)
6078                 return -EINPROGRESS;
6079
6080         rdev->sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
6081                                                         info->attrs);
6082         err = PTR_ERR_OR_ZERO(rdev->sched_scan_req);
6083         if (err)
6084                 goto out_err;
6085
6086         err = rdev_sched_scan_start(rdev, dev, rdev->sched_scan_req);
6087         if (err)
6088                 goto out_free;
6089
6090         rdev->sched_scan_req->dev = dev;
6091         rdev->sched_scan_req->wiphy = &rdev->wiphy;
6092
6093         nl80211_send_sched_scan(rdev, dev,
6094                                 NL80211_CMD_START_SCHED_SCAN);
6095         return 0;
6096
6097 out_free:
6098         kfree(rdev->sched_scan_req);
6099 out_err:
6100         rdev->sched_scan_req = NULL;
6101         return err;
6102 }
6103
6104 static int nl80211_stop_sched_scan(struct sk_buff *skb,
6105                                    struct genl_info *info)
6106 {
6107         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6108
6109         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6110             !rdev->ops->sched_scan_stop)
6111                 return -EOPNOTSUPP;
6112
6113         return __cfg80211_stop_sched_scan(rdev, false);
6114 }
6115
6116 static int nl80211_start_radar_detection(struct sk_buff *skb,
6117                                          struct genl_info *info)
6118 {
6119         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6120         struct net_device *dev = info->user_ptr[1];
6121         struct wireless_dev *wdev = dev->ieee80211_ptr;
6122         struct cfg80211_chan_def chandef;
6123         enum nl80211_dfs_regions dfs_region;
6124         unsigned int cac_time_ms;
6125         int err;
6126
6127         dfs_region = reg_get_dfs_region(wdev->wiphy);
6128         if (dfs_region == NL80211_DFS_UNSET)
6129                 return -EINVAL;
6130
6131         err = nl80211_parse_chandef(rdev, info, &chandef);
6132         if (err)
6133                 return err;
6134
6135         if (netif_carrier_ok(dev))
6136                 return -EBUSY;
6137
6138         if (wdev->cac_started)
6139                 return -EBUSY;
6140
6141         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
6142                                             wdev->iftype);
6143         if (err < 0)
6144                 return err;
6145
6146         if (err == 0)
6147                 return -EINVAL;
6148
6149         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
6150                 return -EINVAL;
6151
6152         if (!rdev->ops->start_radar_detection)
6153                 return -EOPNOTSUPP;
6154
6155         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
6156         if (WARN_ON(!cac_time_ms))
6157                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
6158
6159         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
6160                                                cac_time_ms);
6161         if (!err) {
6162                 wdev->chandef = chandef;
6163                 wdev->cac_started = true;
6164                 wdev->cac_start_time = jiffies;
6165                 wdev->cac_time_ms = cac_time_ms;
6166         }
6167         return err;
6168 }
6169
6170 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
6171 {
6172         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6173         struct net_device *dev = info->user_ptr[1];
6174         struct wireless_dev *wdev = dev->ieee80211_ptr;
6175         struct cfg80211_csa_settings params;
6176         /* csa_attrs is defined static to avoid waste of stack size - this
6177          * function is called under RTNL lock, so this should not be a problem.
6178          */
6179         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
6180         int err;
6181         bool need_new_beacon = false;
6182         int len, i;
6183         u32 cs_count;
6184
6185         if (!rdev->ops->channel_switch ||
6186             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
6187                 return -EOPNOTSUPP;
6188
6189         switch (dev->ieee80211_ptr->iftype) {
6190         case NL80211_IFTYPE_AP:
6191         case NL80211_IFTYPE_P2P_GO:
6192                 need_new_beacon = true;
6193
6194                 /* useless if AP is not running */
6195                 if (!wdev->beacon_interval)
6196                         return -ENOTCONN;
6197                 break;
6198         case NL80211_IFTYPE_ADHOC:
6199                 if (!wdev->ssid_len)
6200                         return -ENOTCONN;
6201                 break;
6202         case NL80211_IFTYPE_MESH_POINT:
6203                 if (!wdev->mesh_id_len)
6204                         return -ENOTCONN;
6205                 break;
6206         default:
6207                 return -EOPNOTSUPP;
6208         }
6209
6210         memset(&params, 0, sizeof(params));
6211
6212         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6213             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
6214                 return -EINVAL;
6215
6216         /* only important for AP, IBSS and mesh create IEs internally */
6217         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
6218                 return -EINVAL;
6219
6220         /* Even though the attribute is u32, the specification says
6221          * u8, so let's make sure we don't overflow.
6222          */
6223         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
6224         if (cs_count > 255)
6225                 return -EINVAL;
6226
6227         params.count = cs_count;
6228
6229         if (!need_new_beacon)
6230                 goto skip_beacons;
6231
6232         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
6233         if (err)
6234                 return err;
6235
6236         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
6237                                info->attrs[NL80211_ATTR_CSA_IES],
6238                                nl80211_policy);
6239         if (err)
6240                 return err;
6241
6242         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
6243         if (err)
6244                 return err;
6245
6246         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
6247                 return -EINVAL;
6248
6249         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6250         if (!len || (len % sizeof(u16)))
6251                 return -EINVAL;
6252
6253         params.n_counter_offsets_beacon = len / sizeof(u16);
6254         if (rdev->wiphy.max_num_csa_counters &&
6255             (params.n_counter_offsets_beacon >
6256              rdev->wiphy.max_num_csa_counters))
6257                 return -EINVAL;
6258
6259         params.counter_offsets_beacon =
6260                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
6261
6262         /* sanity checks - counters should fit and be the same */
6263         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
6264                 u16 offset = params.counter_offsets_beacon[i];
6265
6266                 if (offset >= params.beacon_csa.tail_len)
6267                         return -EINVAL;
6268
6269                 if (params.beacon_csa.tail[offset] != params.count)
6270                         return -EINVAL;
6271         }
6272
6273         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
6274                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6275                 if (!len || (len % sizeof(u16)))
6276                         return -EINVAL;
6277
6278                 params.n_counter_offsets_presp = len / sizeof(u16);
6279                 if (rdev->wiphy.max_num_csa_counters &&
6280                     (params.n_counter_offsets_beacon >
6281                      rdev->wiphy.max_num_csa_counters))
6282                         return -EINVAL;
6283
6284                 params.counter_offsets_presp =
6285                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
6286
6287                 /* sanity checks - counters should fit and be the same */
6288                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
6289                         u16 offset = params.counter_offsets_presp[i];
6290
6291                         if (offset >= params.beacon_csa.probe_resp_len)
6292                                 return -EINVAL;
6293
6294                         if (params.beacon_csa.probe_resp[offset] !=
6295                             params.count)
6296                                 return -EINVAL;
6297                 }
6298         }
6299
6300 skip_beacons:
6301         err = nl80211_parse_chandef(rdev, info, &params.chandef);
6302         if (err)
6303                 return err;
6304
6305         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
6306                                      wdev->iftype))
6307                 return -EINVAL;
6308
6309         err = cfg80211_chandef_dfs_required(wdev->wiphy,
6310                                             &params.chandef,
6311                                             wdev->iftype);
6312         if (err < 0)
6313                 return err;
6314
6315         if (err > 0)
6316                 params.radar_required = true;
6317
6318         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
6319                 params.block_tx = true;
6320
6321         wdev_lock(wdev);
6322         err = rdev_channel_switch(rdev, dev, &params);
6323         wdev_unlock(wdev);
6324
6325         return err;
6326 }
6327
6328 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
6329                             u32 seq, int flags,
6330                             struct cfg80211_registered_device *rdev,
6331                             struct wireless_dev *wdev,
6332                             struct cfg80211_internal_bss *intbss)
6333 {
6334         struct cfg80211_bss *res = &intbss->pub;
6335         const struct cfg80211_bss_ies *ies;
6336         void *hdr;
6337         struct nlattr *bss;
6338
6339         ASSERT_WDEV_LOCK(wdev);
6340
6341         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6342                              NL80211_CMD_NEW_SCAN_RESULTS);
6343         if (!hdr)
6344                 return -1;
6345
6346         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6347
6348         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6349                 goto nla_put_failure;
6350         if (wdev->netdev &&
6351             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6352                 goto nla_put_failure;
6353         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
6354                 goto nla_put_failure;
6355
6356         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6357         if (!bss)
6358                 goto nla_put_failure;
6359         if ((!is_zero_ether_addr(res->bssid) &&
6360              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6361                 goto nla_put_failure;
6362
6363         rcu_read_lock();
6364         /* indicate whether we have probe response data or not */
6365         if (rcu_access_pointer(res->proberesp_ies) &&
6366             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
6367                 goto fail_unlock_rcu;
6368
6369         /* this pointer prefers to be pointed to probe response data
6370          * but is always valid
6371          */
6372         ies = rcu_dereference(res->ies);
6373         if (ies) {
6374                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6375                         goto fail_unlock_rcu;
6376                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6377                                         ies->len, ies->data))
6378                         goto fail_unlock_rcu;
6379         }
6380
6381         /* and this pointer is always (unless driver didn't know) beacon data */
6382         ies = rcu_dereference(res->beacon_ies);
6383         if (ies && ies->from_beacon) {
6384                 if (nla_put_u64(msg, NL80211_BSS_BEACON_TSF, ies->tsf))
6385                         goto fail_unlock_rcu;
6386                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6387                                         ies->len, ies->data))
6388                         goto fail_unlock_rcu;
6389         }
6390         rcu_read_unlock();
6391
6392         if (res->beacon_interval &&
6393             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6394                 goto nla_put_failure;
6395         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6396             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6397             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6398             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6399                         jiffies_to_msecs(jiffies - intbss->ts)))
6400                 goto nla_put_failure;
6401
6402         switch (rdev->wiphy.signal_type) {
6403         case CFG80211_SIGNAL_TYPE_MBM:
6404                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6405                         goto nla_put_failure;
6406                 break;
6407         case CFG80211_SIGNAL_TYPE_UNSPEC:
6408                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6409                         goto nla_put_failure;
6410                 break;
6411         default:
6412                 break;
6413         }
6414
6415         switch (wdev->iftype) {
6416         case NL80211_IFTYPE_P2P_CLIENT:
6417         case NL80211_IFTYPE_STATION:
6418                 if (intbss == wdev->current_bss &&
6419                     nla_put_u32(msg, NL80211_BSS_STATUS,
6420                                 NL80211_BSS_STATUS_ASSOCIATED))
6421                         goto nla_put_failure;
6422                 break;
6423         case NL80211_IFTYPE_ADHOC:
6424                 if (intbss == wdev->current_bss &&
6425                     nla_put_u32(msg, NL80211_BSS_STATUS,
6426                                 NL80211_BSS_STATUS_IBSS_JOINED))
6427                         goto nla_put_failure;
6428                 break;
6429         default:
6430                 break;
6431         }
6432
6433         nla_nest_end(msg, bss);
6434
6435         return genlmsg_end(msg, hdr);
6436
6437  fail_unlock_rcu:
6438         rcu_read_unlock();
6439  nla_put_failure:
6440         genlmsg_cancel(msg, hdr);
6441         return -EMSGSIZE;
6442 }
6443
6444 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6445 {
6446         struct cfg80211_registered_device *rdev;
6447         struct cfg80211_internal_bss *scan;
6448         struct wireless_dev *wdev;
6449         int start = cb->args[2], idx = 0;
6450         int err;
6451
6452         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6453         if (err)
6454                 return err;
6455
6456         wdev_lock(wdev);
6457         spin_lock_bh(&rdev->bss_lock);
6458         cfg80211_bss_expire(rdev);
6459
6460         cb->seq = rdev->bss_generation;
6461
6462         list_for_each_entry(scan, &rdev->bss_list, list) {
6463                 if (++idx <= start)
6464                         continue;
6465                 if (nl80211_send_bss(skb, cb,
6466                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6467                                 rdev, wdev, scan) < 0) {
6468                         idx--;
6469                         break;
6470                 }
6471         }
6472
6473         spin_unlock_bh(&rdev->bss_lock);
6474         wdev_unlock(wdev);
6475
6476         cb->args[2] = idx;
6477         nl80211_finish_wdev_dump(rdev);
6478
6479         return skb->len;
6480 }
6481
6482 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6483                                 int flags, struct net_device *dev,
6484                                 struct survey_info *survey)
6485 {
6486         void *hdr;
6487         struct nlattr *infoattr;
6488
6489         hdr = nl80211hdr_put(msg, portid, seq, flags,
6490                              NL80211_CMD_NEW_SURVEY_RESULTS);
6491         if (!hdr)
6492                 return -ENOMEM;
6493
6494         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6495                 goto nla_put_failure;
6496
6497         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6498         if (!infoattr)
6499                 goto nla_put_failure;
6500
6501         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6502                         survey->channel->center_freq))
6503                 goto nla_put_failure;
6504
6505         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6506             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6507                 goto nla_put_failure;
6508         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6509             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6510                 goto nla_put_failure;
6511         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
6512             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
6513                         survey->channel_time))
6514                 goto nla_put_failure;
6515         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
6516             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
6517                         survey->channel_time_busy))
6518                 goto nla_put_failure;
6519         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
6520             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
6521                         survey->channel_time_ext_busy))
6522                 goto nla_put_failure;
6523         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
6524             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
6525                         survey->channel_time_rx))
6526                 goto nla_put_failure;
6527         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
6528             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
6529                         survey->channel_time_tx))
6530                 goto nla_put_failure;
6531
6532         nla_nest_end(msg, infoattr);
6533
6534         return genlmsg_end(msg, hdr);
6535
6536  nla_put_failure:
6537         genlmsg_cancel(msg, hdr);
6538         return -EMSGSIZE;
6539 }
6540
6541 static int nl80211_dump_survey(struct sk_buff *skb,
6542                         struct netlink_callback *cb)
6543 {
6544         struct survey_info survey;
6545         struct cfg80211_registered_device *rdev;
6546         struct wireless_dev *wdev;
6547         int survey_idx = cb->args[2];
6548         int res;
6549
6550         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6551         if (res)
6552                 return res;
6553
6554         if (!wdev->netdev) {
6555                 res = -EINVAL;
6556                 goto out_err;
6557         }
6558
6559         if (!rdev->ops->dump_survey) {
6560                 res = -EOPNOTSUPP;
6561                 goto out_err;
6562         }
6563
6564         while (1) {
6565                 struct ieee80211_channel *chan;
6566
6567                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6568                 if (res == -ENOENT)
6569                         break;
6570                 if (res)
6571                         goto out_err;
6572
6573                 /* Survey without a channel doesn't make sense */
6574                 if (!survey.channel) {
6575                         res = -EINVAL;
6576                         goto out;
6577                 }
6578
6579                 chan = ieee80211_get_channel(&rdev->wiphy,
6580                                              survey.channel->center_freq);
6581                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
6582                         survey_idx++;
6583                         continue;
6584                 }
6585
6586                 if (nl80211_send_survey(skb,
6587                                 NETLINK_CB(cb->skb).portid,
6588                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6589                                 wdev->netdev, &survey) < 0)
6590                         goto out;
6591                 survey_idx++;
6592         }
6593
6594  out:
6595         cb->args[2] = survey_idx;
6596         res = skb->len;
6597  out_err:
6598         nl80211_finish_wdev_dump(rdev);
6599         return res;
6600 }
6601
6602 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6603 {
6604         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6605                                   NL80211_WPA_VERSION_2));
6606 }
6607
6608 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6609 {
6610         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6611         struct net_device *dev = info->user_ptr[1];
6612         struct ieee80211_channel *chan;
6613         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6614         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6615         enum nl80211_auth_type auth_type;
6616         struct key_parse key;
6617         bool local_state_change;
6618
6619         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6620                 return -EINVAL;
6621
6622         if (!info->attrs[NL80211_ATTR_MAC])
6623                 return -EINVAL;
6624
6625         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6626                 return -EINVAL;
6627
6628         if (!info->attrs[NL80211_ATTR_SSID])
6629                 return -EINVAL;
6630
6631         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6632                 return -EINVAL;
6633
6634         err = nl80211_parse_key(info, &key);
6635         if (err)
6636                 return err;
6637
6638         if (key.idx >= 0) {
6639                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6640                         return -EINVAL;
6641                 if (!key.p.key || !key.p.key_len)
6642                         return -EINVAL;
6643                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6644                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6645                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6646                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6647                         return -EINVAL;
6648                 if (key.idx > 4)
6649                         return -EINVAL;
6650         } else {
6651                 key.p.key_len = 0;
6652                 key.p.key = NULL;
6653         }
6654
6655         if (key.idx >= 0) {
6656                 int i;
6657                 bool ok = false;
6658                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6659                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6660                                 ok = true;
6661                                 break;
6662                         }
6663                 }
6664                 if (!ok)
6665                         return -EINVAL;
6666         }
6667
6668         if (!rdev->ops->auth)
6669                 return -EOPNOTSUPP;
6670
6671         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6672             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6673                 return -EOPNOTSUPP;
6674
6675         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6676         chan = nl80211_get_valid_chan(&rdev->wiphy,
6677                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6678         if (!chan)
6679                 return -EINVAL;
6680
6681         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6682         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6683
6684         if (info->attrs[NL80211_ATTR_IE]) {
6685                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6686                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6687         }
6688
6689         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6690         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6691                 return -EINVAL;
6692
6693         if (auth_type == NL80211_AUTHTYPE_SAE &&
6694             !info->attrs[NL80211_ATTR_SAE_DATA])
6695                 return -EINVAL;
6696
6697         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6698                 if (auth_type != NL80211_AUTHTYPE_SAE)
6699                         return -EINVAL;
6700                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6701                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6702                 /* need to include at least Auth Transaction and Status Code */
6703                 if (sae_data_len < 4)
6704                         return -EINVAL;
6705         }
6706
6707         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6708
6709         /*
6710          * Since we no longer track auth state, ignore
6711          * requests to only change local state.
6712          */
6713         if (local_state_change)
6714                 return 0;
6715
6716         wdev_lock(dev->ieee80211_ptr);
6717         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6718                                  ssid, ssid_len, ie, ie_len,
6719                                  key.p.key, key.p.key_len, key.idx,
6720                                  sae_data, sae_data_len);
6721         wdev_unlock(dev->ieee80211_ptr);
6722         return err;
6723 }
6724
6725 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6726                                    struct genl_info *info,
6727                                    struct cfg80211_crypto_settings *settings,
6728                                    int cipher_limit)
6729 {
6730         memset(settings, 0, sizeof(*settings));
6731
6732         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6733
6734         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6735                 u16 proto;
6736                 proto = nla_get_u16(
6737                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6738                 settings->control_port_ethertype = cpu_to_be16(proto);
6739                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6740                     proto != ETH_P_PAE)
6741                         return -EINVAL;
6742                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6743                         settings->control_port_no_encrypt = true;
6744         } else
6745                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6746
6747         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6748                 void *data;
6749                 int len, i;
6750
6751                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6752                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6753                 settings->n_ciphers_pairwise = len / sizeof(u32);
6754
6755                 if (len % sizeof(u32))
6756                         return -EINVAL;
6757
6758                 if (settings->n_ciphers_pairwise > cipher_limit)
6759                         return -EINVAL;
6760
6761                 memcpy(settings->ciphers_pairwise, data, len);
6762
6763                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6764                         if (!cfg80211_supported_cipher_suite(
6765                                         &rdev->wiphy,
6766                                         settings->ciphers_pairwise[i]))
6767                                 return -EINVAL;
6768         }
6769
6770         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6771                 settings->cipher_group =
6772                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6773                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6774                                                      settings->cipher_group))
6775                         return -EINVAL;
6776         }
6777
6778         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6779                 settings->wpa_versions =
6780                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6781                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6782                         return -EINVAL;
6783         }
6784
6785         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6786                 void *data;
6787                 int len;
6788
6789                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6790                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6791                 settings->n_akm_suites = len / sizeof(u32);
6792
6793                 if (len % sizeof(u32))
6794                         return -EINVAL;
6795
6796                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6797                         return -EINVAL;
6798
6799                 memcpy(settings->akm_suites, data, len);
6800         }
6801
6802         return 0;
6803 }
6804
6805 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6806 {
6807         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6808         struct net_device *dev = info->user_ptr[1];
6809         struct ieee80211_channel *chan;
6810         struct cfg80211_assoc_request req = {};
6811         const u8 *bssid, *ssid;
6812         int err, ssid_len = 0;
6813
6814         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6815                 return -EINVAL;
6816
6817         if (!info->attrs[NL80211_ATTR_MAC] ||
6818             !info->attrs[NL80211_ATTR_SSID] ||
6819             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6820                 return -EINVAL;
6821
6822         if (!rdev->ops->assoc)
6823                 return -EOPNOTSUPP;
6824
6825         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6826             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6827                 return -EOPNOTSUPP;
6828
6829         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6830
6831         chan = nl80211_get_valid_chan(&rdev->wiphy,
6832                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6833         if (!chan)
6834                 return -EINVAL;
6835
6836         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6837         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6838
6839         if (info->attrs[NL80211_ATTR_IE]) {
6840                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6841                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6842         }
6843
6844         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6845                 enum nl80211_mfp mfp =
6846                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6847                 if (mfp == NL80211_MFP_REQUIRED)
6848                         req.use_mfp = true;
6849                 else if (mfp != NL80211_MFP_NO)
6850                         return -EINVAL;
6851         }
6852
6853         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6854                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6855
6856         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6857                 req.flags |= ASSOC_REQ_DISABLE_HT;
6858
6859         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6860                 memcpy(&req.ht_capa_mask,
6861                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6862                        sizeof(req.ht_capa_mask));
6863
6864         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6865                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6866                         return -EINVAL;
6867                 memcpy(&req.ht_capa,
6868                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6869                        sizeof(req.ht_capa));
6870         }
6871
6872         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6873                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6874
6875         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6876                 memcpy(&req.vht_capa_mask,
6877                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6878                        sizeof(req.vht_capa_mask));
6879
6880         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6881                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6882                         return -EINVAL;
6883                 memcpy(&req.vht_capa,
6884                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6885                        sizeof(req.vht_capa));
6886         }
6887
6888         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
6889                 if (!(rdev->wiphy.features &
6890                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
6891                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
6892                         return -EINVAL;
6893                 req.flags |= ASSOC_REQ_USE_RRM;
6894         }
6895
6896         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6897         if (!err) {
6898                 wdev_lock(dev->ieee80211_ptr);
6899                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6900                                           ssid, ssid_len, &req);
6901                 wdev_unlock(dev->ieee80211_ptr);
6902         }
6903
6904         return err;
6905 }
6906
6907 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6908 {
6909         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6910         struct net_device *dev = info->user_ptr[1];
6911         const u8 *ie = NULL, *bssid;
6912         int ie_len = 0, err;
6913         u16 reason_code;
6914         bool local_state_change;
6915
6916         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6917                 return -EINVAL;
6918
6919         if (!info->attrs[NL80211_ATTR_MAC])
6920                 return -EINVAL;
6921
6922         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6923                 return -EINVAL;
6924
6925         if (!rdev->ops->deauth)
6926                 return -EOPNOTSUPP;
6927
6928         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6929             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6930                 return -EOPNOTSUPP;
6931
6932         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6933
6934         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6935         if (reason_code == 0) {
6936                 /* Reason Code 0 is reserved */
6937                 return -EINVAL;
6938         }
6939
6940         if (info->attrs[NL80211_ATTR_IE]) {
6941                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6942                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6943         }
6944
6945         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6946
6947         wdev_lock(dev->ieee80211_ptr);
6948         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6949                                    local_state_change);
6950         wdev_unlock(dev->ieee80211_ptr);
6951         return err;
6952 }
6953
6954 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6955 {
6956         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6957         struct net_device *dev = info->user_ptr[1];
6958         const u8 *ie = NULL, *bssid;
6959         int ie_len = 0, err;
6960         u16 reason_code;
6961         bool local_state_change;
6962
6963         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6964                 return -EINVAL;
6965
6966         if (!info->attrs[NL80211_ATTR_MAC])
6967                 return -EINVAL;
6968
6969         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6970                 return -EINVAL;
6971
6972         if (!rdev->ops->disassoc)
6973                 return -EOPNOTSUPP;
6974
6975         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6976             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6977                 return -EOPNOTSUPP;
6978
6979         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6980
6981         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6982         if (reason_code == 0) {
6983                 /* Reason Code 0 is reserved */
6984                 return -EINVAL;
6985         }
6986
6987         if (info->attrs[NL80211_ATTR_IE]) {
6988                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6989                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6990         }
6991
6992         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6993
6994         wdev_lock(dev->ieee80211_ptr);
6995         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6996                                      local_state_change);
6997         wdev_unlock(dev->ieee80211_ptr);
6998         return err;
6999 }
7000
7001 static bool
7002 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
7003                          int mcast_rate[IEEE80211_NUM_BANDS],
7004                          int rateval)
7005 {
7006         struct wiphy *wiphy = &rdev->wiphy;
7007         bool found = false;
7008         int band, i;
7009
7010         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
7011                 struct ieee80211_supported_band *sband;
7012
7013                 sband = wiphy->bands[band];
7014                 if (!sband)
7015                         continue;
7016
7017                 for (i = 0; i < sband->n_bitrates; i++) {
7018                         if (sband->bitrates[i].bitrate == rateval) {
7019                                 mcast_rate[band] = i + 1;
7020                                 found = true;
7021                                 break;
7022                         }
7023                 }
7024         }
7025
7026         return found;
7027 }
7028
7029 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
7030 {
7031         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7032         struct net_device *dev = info->user_ptr[1];
7033         struct cfg80211_ibss_params ibss;
7034         struct wiphy *wiphy;
7035         struct cfg80211_cached_keys *connkeys = NULL;
7036         int err;
7037
7038         memset(&ibss, 0, sizeof(ibss));
7039
7040         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7041                 return -EINVAL;
7042
7043         if (!info->attrs[NL80211_ATTR_SSID] ||
7044             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7045                 return -EINVAL;
7046
7047         ibss.beacon_interval = 100;
7048
7049         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7050                 ibss.beacon_interval =
7051                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7052                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
7053                         return -EINVAL;
7054         }
7055
7056         if (!rdev->ops->join_ibss)
7057                 return -EOPNOTSUPP;
7058
7059         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7060                 return -EOPNOTSUPP;
7061
7062         wiphy = &rdev->wiphy;
7063
7064         if (info->attrs[NL80211_ATTR_MAC]) {
7065                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7066
7067                 if (!is_valid_ether_addr(ibss.bssid))
7068                         return -EINVAL;
7069         }
7070         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7071         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7072
7073         if (info->attrs[NL80211_ATTR_IE]) {
7074                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7075                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7076         }
7077
7078         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
7079         if (err)
7080                 return err;
7081
7082         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
7083                                      NL80211_IFTYPE_ADHOC))
7084                 return -EINVAL;
7085
7086         switch (ibss.chandef.width) {
7087         case NL80211_CHAN_WIDTH_5:
7088         case NL80211_CHAN_WIDTH_10:
7089         case NL80211_CHAN_WIDTH_20_NOHT:
7090                 break;
7091         case NL80211_CHAN_WIDTH_20:
7092         case NL80211_CHAN_WIDTH_40:
7093                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
7094                         break;
7095         default:
7096                 return -EINVAL;
7097         }
7098
7099         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
7100         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
7101
7102         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7103                 u8 *rates =
7104                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7105                 int n_rates =
7106                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7107                 struct ieee80211_supported_band *sband =
7108                         wiphy->bands[ibss.chandef.chan->band];
7109
7110                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7111                                              &ibss.basic_rates);
7112                 if (err)
7113                         return err;
7114         }
7115
7116         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7117                 memcpy(&ibss.ht_capa_mask,
7118                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7119                        sizeof(ibss.ht_capa_mask));
7120
7121         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7122                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7123                         return -EINVAL;
7124                 memcpy(&ibss.ht_capa,
7125                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7126                        sizeof(ibss.ht_capa));
7127         }
7128
7129         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7130             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
7131                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7132                 return -EINVAL;
7133
7134         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7135                 bool no_ht = false;
7136
7137                 connkeys = nl80211_parse_connkeys(rdev,
7138                                           info->attrs[NL80211_ATTR_KEYS],
7139                                           &no_ht);
7140                 if (IS_ERR(connkeys))
7141                         return PTR_ERR(connkeys);
7142
7143                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
7144                     no_ht) {
7145                         kfree(connkeys);
7146                         return -EINVAL;
7147                 }
7148         }
7149
7150         ibss.control_port =
7151                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
7152
7153         ibss.userspace_handles_dfs =
7154                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
7155
7156         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
7157         if (err)
7158                 kzfree(connkeys);
7159         return err;
7160 }
7161
7162 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
7163 {
7164         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7165         struct net_device *dev = info->user_ptr[1];
7166
7167         if (!rdev->ops->leave_ibss)
7168                 return -EOPNOTSUPP;
7169
7170         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
7171                 return -EOPNOTSUPP;
7172
7173         return cfg80211_leave_ibss(rdev, dev, false);
7174 }
7175
7176 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
7177 {
7178         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7179         struct net_device *dev = info->user_ptr[1];
7180         int mcast_rate[IEEE80211_NUM_BANDS];
7181         u32 nla_rate;
7182         int err;
7183
7184         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
7185             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7186                 return -EOPNOTSUPP;
7187
7188         if (!rdev->ops->set_mcast_rate)
7189                 return -EOPNOTSUPP;
7190
7191         memset(mcast_rate, 0, sizeof(mcast_rate));
7192
7193         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
7194                 return -EINVAL;
7195
7196         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
7197         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
7198                 return -EINVAL;
7199
7200         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
7201
7202         return err;
7203 }
7204
7205 static struct sk_buff *
7206 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
7207                             int approxlen, u32 portid, u32 seq,
7208                             enum nl80211_commands cmd,
7209                             enum nl80211_attrs attr,
7210                             const struct nl80211_vendor_cmd_info *info,
7211                             gfp_t gfp)
7212 {
7213         struct sk_buff *skb;
7214         void *hdr;
7215         struct nlattr *data;
7216
7217         skb = nlmsg_new(approxlen + 100, gfp);
7218         if (!skb)
7219                 return NULL;
7220
7221         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
7222         if (!hdr) {
7223                 kfree_skb(skb);
7224                 return NULL;
7225         }
7226
7227         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
7228                 goto nla_put_failure;
7229
7230         if (info) {
7231                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
7232                                 info->vendor_id))
7233                         goto nla_put_failure;
7234                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
7235                                 info->subcmd))
7236                         goto nla_put_failure;
7237         }
7238
7239         data = nla_nest_start(skb, attr);
7240
7241         ((void **)skb->cb)[0] = rdev;
7242         ((void **)skb->cb)[1] = hdr;
7243         ((void **)skb->cb)[2] = data;
7244
7245         return skb;
7246
7247  nla_put_failure:
7248         kfree_skb(skb);
7249         return NULL;
7250 }
7251
7252 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
7253                                            enum nl80211_commands cmd,
7254                                            enum nl80211_attrs attr,
7255                                            int vendor_event_idx,
7256                                            int approxlen, gfp_t gfp)
7257 {
7258         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
7259         const struct nl80211_vendor_cmd_info *info;
7260
7261         switch (cmd) {
7262         case NL80211_CMD_TESTMODE:
7263                 if (WARN_ON(vendor_event_idx != -1))
7264                         return NULL;
7265                 info = NULL;
7266                 break;
7267         case NL80211_CMD_VENDOR:
7268                 if (WARN_ON(vendor_event_idx < 0 ||
7269                             vendor_event_idx >= wiphy->n_vendor_events))
7270                         return NULL;
7271                 info = &wiphy->vendor_events[vendor_event_idx];
7272                 break;
7273         default:
7274                 WARN_ON(1);
7275                 return NULL;
7276         }
7277
7278         return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
7279                                            cmd, attr, info, gfp);
7280 }
7281 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
7282
7283 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
7284 {
7285         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
7286         void *hdr = ((void **)skb->cb)[1];
7287         struct nlattr *data = ((void **)skb->cb)[2];
7288         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
7289
7290         /* clear CB data for netlink core to own from now on */
7291         memset(skb->cb, 0, sizeof(skb->cb));
7292
7293         nla_nest_end(skb, data);
7294         genlmsg_end(skb, hdr);
7295
7296         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
7297                 mcgrp = NL80211_MCGRP_VENDOR;
7298
7299         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
7300                                 mcgrp, gfp);
7301 }
7302 EXPORT_SYMBOL(__cfg80211_send_event_skb);
7303
7304 #ifdef CONFIG_NL80211_TESTMODE
7305 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
7306 {
7307         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7308         struct wireless_dev *wdev =
7309                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
7310         int err;
7311
7312         if (!rdev->ops->testmode_cmd)
7313                 return -EOPNOTSUPP;
7314
7315         if (IS_ERR(wdev)) {
7316                 err = PTR_ERR(wdev);
7317                 if (err != -EINVAL)
7318                         return err;
7319                 wdev = NULL;
7320         } else if (wdev->wiphy != &rdev->wiphy) {
7321                 return -EINVAL;
7322         }
7323
7324         if (!info->attrs[NL80211_ATTR_TESTDATA])
7325                 return -EINVAL;
7326
7327         rdev->cur_cmd_info = info;
7328         err = rdev_testmode_cmd(rdev, wdev,
7329                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
7330                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
7331         rdev->cur_cmd_info = NULL;
7332
7333         return err;
7334 }
7335
7336 static int nl80211_testmode_dump(struct sk_buff *skb,
7337                                  struct netlink_callback *cb)
7338 {
7339         struct cfg80211_registered_device *rdev;
7340         int err;
7341         long phy_idx;
7342         void *data = NULL;
7343         int data_len = 0;
7344
7345         rtnl_lock();
7346
7347         if (cb->args[0]) {
7348                 /*
7349                  * 0 is a valid index, but not valid for args[0],
7350                  * so we need to offset by 1.
7351                  */
7352                 phy_idx = cb->args[0] - 1;
7353         } else {
7354                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
7355                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
7356                                   nl80211_policy);
7357                 if (err)
7358                         goto out_err;
7359
7360                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7361                                                   nl80211_fam.attrbuf);
7362                 if (IS_ERR(rdev)) {
7363                         err = PTR_ERR(rdev);
7364                         goto out_err;
7365                 }
7366                 phy_idx = rdev->wiphy_idx;
7367                 rdev = NULL;
7368
7369                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7370                         cb->args[1] =
7371                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7372         }
7373
7374         if (cb->args[1]) {
7375                 data = nla_data((void *)cb->args[1]);
7376                 data_len = nla_len((void *)cb->args[1]);
7377         }
7378
7379         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7380         if (!rdev) {
7381                 err = -ENOENT;
7382                 goto out_err;
7383         }
7384
7385         if (!rdev->ops->testmode_dump) {
7386                 err = -EOPNOTSUPP;
7387                 goto out_err;
7388         }
7389
7390         while (1) {
7391                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7392                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7393                                            NL80211_CMD_TESTMODE);
7394                 struct nlattr *tmdata;
7395
7396                 if (!hdr)
7397                         break;
7398
7399                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7400                         genlmsg_cancel(skb, hdr);
7401                         break;
7402                 }
7403
7404                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7405                 if (!tmdata) {
7406                         genlmsg_cancel(skb, hdr);
7407                         break;
7408                 }
7409                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7410                 nla_nest_end(skb, tmdata);
7411
7412                 if (err == -ENOBUFS || err == -ENOENT) {
7413                         genlmsg_cancel(skb, hdr);
7414                         break;
7415                 } else if (err) {
7416                         genlmsg_cancel(skb, hdr);
7417                         goto out_err;
7418                 }
7419
7420                 genlmsg_end(skb, hdr);
7421         }
7422
7423         err = skb->len;
7424         /* see above */
7425         cb->args[0] = phy_idx + 1;
7426  out_err:
7427         rtnl_unlock();
7428         return err;
7429 }
7430 #endif
7431
7432 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7433 {
7434         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7435         struct net_device *dev = info->user_ptr[1];
7436         struct cfg80211_connect_params connect;
7437         struct wiphy *wiphy;
7438         struct cfg80211_cached_keys *connkeys = NULL;
7439         int err;
7440
7441         memset(&connect, 0, sizeof(connect));
7442
7443         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7444                 return -EINVAL;
7445
7446         if (!info->attrs[NL80211_ATTR_SSID] ||
7447             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7448                 return -EINVAL;
7449
7450         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
7451                 connect.auth_type =
7452                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7453                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
7454                                              NL80211_CMD_CONNECT))
7455                         return -EINVAL;
7456         } else
7457                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7458
7459         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7460
7461         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7462                                       NL80211_MAX_NR_CIPHER_SUITES);
7463         if (err)
7464                 return err;
7465
7466         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7467             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7468                 return -EOPNOTSUPP;
7469
7470         wiphy = &rdev->wiphy;
7471
7472         connect.bg_scan_period = -1;
7473         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7474                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7475                 connect.bg_scan_period =
7476                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7477         }
7478
7479         if (info->attrs[NL80211_ATTR_MAC])
7480                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7481         else if (info->attrs[NL80211_ATTR_MAC_HINT])
7482                 connect.bssid_hint =
7483                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7484         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7485         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7486
7487         if (info->attrs[NL80211_ATTR_IE]) {
7488                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7489                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7490         }
7491
7492         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7493                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7494                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7495                     connect.mfp != NL80211_MFP_NO)
7496                         return -EINVAL;
7497         } else {
7498                 connect.mfp = NL80211_MFP_NO;
7499         }
7500
7501         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7502                 connect.channel = nl80211_get_valid_chan(
7503                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7504                 if (!connect.channel)
7505                         return -EINVAL;
7506         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7507                 connect.channel_hint = nl80211_get_valid_chan(
7508                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
7509                 if (!connect.channel_hint)
7510                         return -EINVAL;
7511         }
7512
7513         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7514                 connkeys = nl80211_parse_connkeys(rdev,
7515                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7516                 if (IS_ERR(connkeys))
7517                         return PTR_ERR(connkeys);
7518         }
7519
7520         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7521                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7522
7523         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7524                 memcpy(&connect.ht_capa_mask,
7525                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7526                        sizeof(connect.ht_capa_mask));
7527
7528         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7529                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7530                         kzfree(connkeys);
7531                         return -EINVAL;
7532                 }
7533                 memcpy(&connect.ht_capa,
7534                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7535                        sizeof(connect.ht_capa));
7536         }
7537
7538         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7539                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7540
7541         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7542                 memcpy(&connect.vht_capa_mask,
7543                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7544                        sizeof(connect.vht_capa_mask));
7545
7546         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7547                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7548                         kzfree(connkeys);
7549                         return -EINVAL;
7550                 }
7551                 memcpy(&connect.vht_capa,
7552                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7553                        sizeof(connect.vht_capa));
7554         }
7555
7556         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7557                 if (!(rdev->wiphy.features &
7558                       NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7559                     !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7560                         return -EINVAL;
7561                 connect.flags |= ASSOC_REQ_USE_RRM;
7562         }
7563
7564         wdev_lock(dev->ieee80211_ptr);
7565         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7566         wdev_unlock(dev->ieee80211_ptr);
7567         if (err)
7568                 kzfree(connkeys);
7569         return err;
7570 }
7571
7572 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7573 {
7574         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7575         struct net_device *dev = info->user_ptr[1];
7576         u16 reason;
7577         int ret;
7578
7579         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7580                 reason = WLAN_REASON_DEAUTH_LEAVING;
7581         else
7582                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7583
7584         if (reason == 0)
7585                 return -EINVAL;
7586
7587         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7588             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7589                 return -EOPNOTSUPP;
7590
7591         wdev_lock(dev->ieee80211_ptr);
7592         ret = cfg80211_disconnect(rdev, dev, reason, true);
7593         wdev_unlock(dev->ieee80211_ptr);
7594         return ret;
7595 }
7596
7597 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7598 {
7599         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7600         struct net *net;
7601         int err;
7602         u32 pid;
7603
7604         if (!info->attrs[NL80211_ATTR_PID])
7605                 return -EINVAL;
7606
7607         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7608
7609         net = get_net_ns_by_pid(pid);
7610         if (IS_ERR(net))
7611                 return PTR_ERR(net);
7612
7613         err = 0;
7614
7615         /* check if anything to do */
7616         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7617                 err = cfg80211_switch_netns(rdev, net);
7618
7619         put_net(net);
7620         return err;
7621 }
7622
7623 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7624 {
7625         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7626         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7627                         struct cfg80211_pmksa *pmksa) = NULL;
7628         struct net_device *dev = info->user_ptr[1];
7629         struct cfg80211_pmksa pmksa;
7630
7631         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7632
7633         if (!info->attrs[NL80211_ATTR_MAC])
7634                 return -EINVAL;
7635
7636         if (!info->attrs[NL80211_ATTR_PMKID])
7637                 return -EINVAL;
7638
7639         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7640         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7641
7642         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7643             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7644                 return -EOPNOTSUPP;
7645
7646         switch (info->genlhdr->cmd) {
7647         case NL80211_CMD_SET_PMKSA:
7648                 rdev_ops = rdev->ops->set_pmksa;
7649                 break;
7650         case NL80211_CMD_DEL_PMKSA:
7651                 rdev_ops = rdev->ops->del_pmksa;
7652                 break;
7653         default:
7654                 WARN_ON(1);
7655                 break;
7656         }
7657
7658         if (!rdev_ops)
7659                 return -EOPNOTSUPP;
7660
7661         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7662 }
7663
7664 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7665 {
7666         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7667         struct net_device *dev = info->user_ptr[1];
7668
7669         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7670             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7671                 return -EOPNOTSUPP;
7672
7673         if (!rdev->ops->flush_pmksa)
7674                 return -EOPNOTSUPP;
7675
7676         return rdev_flush_pmksa(rdev, dev);
7677 }
7678
7679 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7680 {
7681         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7682         struct net_device *dev = info->user_ptr[1];
7683         u8 action_code, dialog_token;
7684         u32 peer_capability = 0;
7685         u16 status_code;
7686         u8 *peer;
7687         bool initiator;
7688
7689         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7690             !rdev->ops->tdls_mgmt)
7691                 return -EOPNOTSUPP;
7692
7693         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7694             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7695             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7696             !info->attrs[NL80211_ATTR_IE] ||
7697             !info->attrs[NL80211_ATTR_MAC])
7698                 return -EINVAL;
7699
7700         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7701         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7702         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7703         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7704         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
7705         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
7706                 peer_capability =
7707                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
7708
7709         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7710                               dialog_token, status_code, peer_capability,
7711                               initiator,
7712                               nla_data(info->attrs[NL80211_ATTR_IE]),
7713                               nla_len(info->attrs[NL80211_ATTR_IE]));
7714 }
7715
7716 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7717 {
7718         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7719         struct net_device *dev = info->user_ptr[1];
7720         enum nl80211_tdls_operation operation;
7721         u8 *peer;
7722
7723         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7724             !rdev->ops->tdls_oper)
7725                 return -EOPNOTSUPP;
7726
7727         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7728             !info->attrs[NL80211_ATTR_MAC])
7729                 return -EINVAL;
7730
7731         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7732         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7733
7734         return rdev_tdls_oper(rdev, dev, peer, operation);
7735 }
7736
7737 static int nl80211_remain_on_channel(struct sk_buff *skb,
7738                                      struct genl_info *info)
7739 {
7740         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7741         struct wireless_dev *wdev = info->user_ptr[1];
7742         struct cfg80211_chan_def chandef;
7743         struct sk_buff *msg;
7744         void *hdr;
7745         u64 cookie;
7746         u32 duration;
7747         int err;
7748
7749         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7750             !info->attrs[NL80211_ATTR_DURATION])
7751                 return -EINVAL;
7752
7753         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7754
7755         if (!rdev->ops->remain_on_channel ||
7756             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7757                 return -EOPNOTSUPP;
7758
7759         /*
7760          * We should be on that channel for at least a minimum amount of
7761          * time (10ms) but no longer than the driver supports.
7762          */
7763         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7764             duration > rdev->wiphy.max_remain_on_channel_duration)
7765                 return -EINVAL;
7766
7767         err = nl80211_parse_chandef(rdev, info, &chandef);
7768         if (err)
7769                 return err;
7770
7771         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7772         if (!msg)
7773                 return -ENOMEM;
7774
7775         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7776                              NL80211_CMD_REMAIN_ON_CHANNEL);
7777         if (!hdr) {
7778                 err = -ENOBUFS;
7779                 goto free_msg;
7780         }
7781
7782         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7783                                      duration, &cookie);
7784
7785         if (err)
7786                 goto free_msg;
7787
7788         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7789                 goto nla_put_failure;
7790
7791         genlmsg_end(msg, hdr);
7792
7793         return genlmsg_reply(msg, info);
7794
7795  nla_put_failure:
7796         err = -ENOBUFS;
7797  free_msg:
7798         nlmsg_free(msg);
7799         return err;
7800 }
7801
7802 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7803                                             struct genl_info *info)
7804 {
7805         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7806         struct wireless_dev *wdev = info->user_ptr[1];
7807         u64 cookie;
7808
7809         if (!info->attrs[NL80211_ATTR_COOKIE])
7810                 return -EINVAL;
7811
7812         if (!rdev->ops->cancel_remain_on_channel)
7813                 return -EOPNOTSUPP;
7814
7815         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7816
7817         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7818 }
7819
7820 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7821                            u8 *rates, u8 rates_len)
7822 {
7823         u8 i;
7824         u32 mask = 0;
7825
7826         for (i = 0; i < rates_len; i++) {
7827                 int rate = (rates[i] & 0x7f) * 5;
7828                 int ridx;
7829                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7830                         struct ieee80211_rate *srate =
7831                                 &sband->bitrates[ridx];
7832                         if (rate == srate->bitrate) {
7833                                 mask |= 1 << ridx;
7834                                 break;
7835                         }
7836                 }
7837                 if (ridx == sband->n_bitrates)
7838                         return 0; /* rate not found */
7839         }
7840
7841         return mask;
7842 }
7843
7844 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7845                                u8 *rates, u8 rates_len,
7846                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7847 {
7848         u8 i;
7849
7850         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7851
7852         for (i = 0; i < rates_len; i++) {
7853                 int ridx, rbit;
7854
7855                 ridx = rates[i] / 8;
7856                 rbit = BIT(rates[i] % 8);
7857
7858                 /* check validity */
7859                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7860                         return false;
7861
7862                 /* check availability */
7863                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7864                         mcs[ridx] |= rbit;
7865                 else
7866                         return false;
7867         }
7868
7869         return true;
7870 }
7871
7872 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
7873 {
7874         u16 mcs_mask = 0;
7875
7876         switch (vht_mcs_map) {
7877         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
7878                 break;
7879         case IEEE80211_VHT_MCS_SUPPORT_0_7:
7880                 mcs_mask = 0x00FF;
7881                 break;
7882         case IEEE80211_VHT_MCS_SUPPORT_0_8:
7883                 mcs_mask = 0x01FF;
7884                 break;
7885         case IEEE80211_VHT_MCS_SUPPORT_0_9:
7886                 mcs_mask = 0x03FF;
7887                 break;
7888         default:
7889                 break;
7890         }
7891
7892         return mcs_mask;
7893 }
7894
7895 static void vht_build_mcs_mask(u16 vht_mcs_map,
7896                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
7897 {
7898         u8 nss;
7899
7900         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
7901                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
7902                 vht_mcs_map >>= 2;
7903         }
7904 }
7905
7906 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
7907                              struct nl80211_txrate_vht *txrate,
7908                              u16 mcs[NL80211_VHT_NSS_MAX])
7909 {
7910         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7911         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
7912         u8 i;
7913
7914         if (!sband->vht_cap.vht_supported)
7915                 return false;
7916
7917         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
7918
7919         /* Build vht_mcs_mask from VHT capabilities */
7920         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
7921
7922         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
7923                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
7924                         mcs[i] = txrate->mcs[i];
7925                 else
7926                         return false;
7927         }
7928
7929         return true;
7930 }
7931
7932 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7933         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7934                                     .len = NL80211_MAX_SUPP_RATES },
7935         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
7936                                 .len = NL80211_MAX_SUPP_HT_RATES },
7937         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
7938         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
7939 };
7940
7941 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7942                                        struct genl_info *info)
7943 {
7944         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7945         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7946         struct cfg80211_bitrate_mask mask;
7947         int rem, i;
7948         struct net_device *dev = info->user_ptr[1];
7949         struct nlattr *tx_rates;
7950         struct ieee80211_supported_band *sband;
7951         u16 vht_tx_mcs_map;
7952
7953         if (!rdev->ops->set_bitrate_mask)
7954                 return -EOPNOTSUPP;
7955
7956         memset(&mask, 0, sizeof(mask));
7957         /* Default to all rates enabled */
7958         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7959                 sband = rdev->wiphy.bands[i];
7960
7961                 if (!sband)
7962                         continue;
7963
7964                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
7965                 memcpy(mask.control[i].ht_mcs,
7966                        sband->ht_cap.mcs.rx_mask,
7967                        sizeof(mask.control[i].ht_mcs));
7968
7969                 if (!sband->vht_cap.vht_supported)
7970                         continue;
7971
7972                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7973                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
7974         }
7975
7976         /* if no rates are given set it back to the defaults */
7977         if (!info->attrs[NL80211_ATTR_TX_RATES])
7978                 goto out;
7979
7980         /*
7981          * The nested attribute uses enum nl80211_band as the index. This maps
7982          * directly to the enum ieee80211_band values used in cfg80211.
7983          */
7984         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7985         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
7986                 enum ieee80211_band band = nla_type(tx_rates);
7987                 int err;
7988
7989                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7990                         return -EINVAL;
7991                 sband = rdev->wiphy.bands[band];
7992                 if (sband == NULL)
7993                         return -EINVAL;
7994                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7995                                 nla_len(tx_rates), nl80211_txattr_policy);
7996                 if (err)
7997                         return err;
7998                 if (tb[NL80211_TXRATE_LEGACY]) {
7999                         mask.control[band].legacy = rateset_to_mask(
8000                                 sband,
8001                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
8002                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
8003                         if ((mask.control[band].legacy == 0) &&
8004                             nla_len(tb[NL80211_TXRATE_LEGACY]))
8005                                 return -EINVAL;
8006                 }
8007                 if (tb[NL80211_TXRATE_HT]) {
8008                         if (!ht_rateset_to_mask(
8009                                         sband,
8010                                         nla_data(tb[NL80211_TXRATE_HT]),
8011                                         nla_len(tb[NL80211_TXRATE_HT]),
8012                                         mask.control[band].ht_mcs))
8013                                 return -EINVAL;
8014                 }
8015                 if (tb[NL80211_TXRATE_VHT]) {
8016                         if (!vht_set_mcs_mask(
8017                                         sband,
8018                                         nla_data(tb[NL80211_TXRATE_VHT]),
8019                                         mask.control[band].vht_mcs))
8020                                 return -EINVAL;
8021                 }
8022                 if (tb[NL80211_TXRATE_GI]) {
8023                         mask.control[band].gi =
8024                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
8025                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
8026                                 return -EINVAL;
8027                 }
8028
8029                 if (mask.control[band].legacy == 0) {
8030                         /* don't allow empty legacy rates if HT or VHT
8031                          * are not even supported.
8032                          */
8033                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
8034                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
8035                                 return -EINVAL;
8036
8037                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
8038                                 if (mask.control[band].ht_mcs[i])
8039                                         goto out;
8040
8041                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
8042                                 if (mask.control[band].vht_mcs[i])
8043                                         goto out;
8044
8045                         /* legacy and mcs rates may not be both empty */
8046                         return -EINVAL;
8047                 }
8048         }
8049
8050 out:
8051         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
8052 }
8053
8054 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
8055 {
8056         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8057         struct wireless_dev *wdev = info->user_ptr[1];
8058         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
8059
8060         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
8061                 return -EINVAL;
8062
8063         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
8064                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
8065
8066         switch (wdev->iftype) {
8067         case NL80211_IFTYPE_STATION:
8068         case NL80211_IFTYPE_ADHOC:
8069         case NL80211_IFTYPE_P2P_CLIENT:
8070         case NL80211_IFTYPE_AP:
8071         case NL80211_IFTYPE_AP_VLAN:
8072         case NL80211_IFTYPE_MESH_POINT:
8073         case NL80211_IFTYPE_P2P_GO:
8074         case NL80211_IFTYPE_P2P_DEVICE:
8075                 break;
8076         default:
8077                 return -EOPNOTSUPP;
8078         }
8079
8080         /* not much point in registering if we can't reply */
8081         if (!rdev->ops->mgmt_tx)
8082                 return -EOPNOTSUPP;
8083
8084         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
8085                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
8086                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
8087 }
8088
8089 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
8090 {
8091         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8092         struct wireless_dev *wdev = info->user_ptr[1];
8093         struct cfg80211_chan_def chandef;
8094         int err;
8095         void *hdr = NULL;
8096         u64 cookie;
8097         struct sk_buff *msg = NULL;
8098         struct cfg80211_mgmt_tx_params params = {
8099                 .dont_wait_for_ack =
8100                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
8101         };
8102
8103         if (!info->attrs[NL80211_ATTR_FRAME])
8104                 return -EINVAL;
8105
8106         if (!rdev->ops->mgmt_tx)
8107                 return -EOPNOTSUPP;
8108
8109         switch (wdev->iftype) {
8110         case NL80211_IFTYPE_P2P_DEVICE:
8111                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8112                         return -EINVAL;
8113         case NL80211_IFTYPE_STATION:
8114         case NL80211_IFTYPE_ADHOC:
8115         case NL80211_IFTYPE_P2P_CLIENT:
8116         case NL80211_IFTYPE_AP:
8117         case NL80211_IFTYPE_AP_VLAN:
8118         case NL80211_IFTYPE_MESH_POINT:
8119         case NL80211_IFTYPE_P2P_GO:
8120                 break;
8121         default:
8122                 return -EOPNOTSUPP;
8123         }
8124
8125         if (info->attrs[NL80211_ATTR_DURATION]) {
8126                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8127                         return -EINVAL;
8128                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8129
8130                 /*
8131                  * We should wait on the channel for at least a minimum amount
8132                  * of time (10ms) but no longer than the driver supports.
8133                  */
8134                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8135                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
8136                         return -EINVAL;
8137
8138         }
8139
8140         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
8141
8142         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
8143                 return -EINVAL;
8144
8145         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8146
8147         /* get the channel if any has been specified, otherwise pass NULL to
8148          * the driver. The latter will use the current one
8149          */
8150         chandef.chan = NULL;
8151         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8152                 err = nl80211_parse_chandef(rdev, info, &chandef);
8153                 if (err)
8154                         return err;
8155         }
8156
8157         if (!chandef.chan && params.offchan)
8158                 return -EINVAL;
8159
8160         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
8161         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
8162
8163         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
8164                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8165                 int i;
8166
8167                 if (len % sizeof(u16))
8168                         return -EINVAL;
8169
8170                 params.n_csa_offsets = len / sizeof(u16);
8171                 params.csa_offsets =
8172                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
8173
8174                 /* check that all the offsets fit the frame */
8175                 for (i = 0; i < params.n_csa_offsets; i++) {
8176                         if (params.csa_offsets[i] >= params.len)
8177                                 return -EINVAL;
8178                 }
8179         }
8180
8181         if (!params.dont_wait_for_ack) {
8182                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8183                 if (!msg)
8184                         return -ENOMEM;
8185
8186                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8187                                      NL80211_CMD_FRAME);
8188                 if (!hdr) {
8189                         err = -ENOBUFS;
8190                         goto free_msg;
8191                 }
8192         }
8193
8194         params.chan = chandef.chan;
8195         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
8196         if (err)
8197                 goto free_msg;
8198
8199         if (msg) {
8200                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8201                         goto nla_put_failure;
8202
8203                 genlmsg_end(msg, hdr);
8204                 return genlmsg_reply(msg, info);
8205         }
8206
8207         return 0;
8208
8209  nla_put_failure:
8210         err = -ENOBUFS;
8211  free_msg:
8212         nlmsg_free(msg);
8213         return err;
8214 }
8215
8216 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
8217 {
8218         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8219         struct wireless_dev *wdev = info->user_ptr[1];
8220         u64 cookie;
8221
8222         if (!info->attrs[NL80211_ATTR_COOKIE])
8223                 return -EINVAL;
8224
8225         if (!rdev->ops->mgmt_tx_cancel_wait)
8226                 return -EOPNOTSUPP;
8227
8228         switch (wdev->iftype) {
8229         case NL80211_IFTYPE_STATION:
8230         case NL80211_IFTYPE_ADHOC:
8231         case NL80211_IFTYPE_P2P_CLIENT:
8232         case NL80211_IFTYPE_AP:
8233         case NL80211_IFTYPE_AP_VLAN:
8234         case NL80211_IFTYPE_P2P_GO:
8235         case NL80211_IFTYPE_P2P_DEVICE:
8236                 break;
8237         default:
8238                 return -EOPNOTSUPP;
8239         }
8240
8241         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8242
8243         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
8244 }
8245
8246 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
8247 {
8248         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8249         struct wireless_dev *wdev;
8250         struct net_device *dev = info->user_ptr[1];
8251         u8 ps_state;
8252         bool state;
8253         int err;
8254
8255         if (!info->attrs[NL80211_ATTR_PS_STATE])
8256                 return -EINVAL;
8257
8258         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
8259
8260         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
8261                 return -EINVAL;
8262
8263         wdev = dev->ieee80211_ptr;
8264
8265         if (!rdev->ops->set_power_mgmt)
8266                 return -EOPNOTSUPP;
8267
8268         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
8269
8270         if (state == wdev->ps)
8271                 return 0;
8272
8273         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
8274         if (!err)
8275                 wdev->ps = state;
8276         return err;
8277 }
8278
8279 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
8280 {
8281         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8282         enum nl80211_ps_state ps_state;
8283         struct wireless_dev *wdev;
8284         struct net_device *dev = info->user_ptr[1];
8285         struct sk_buff *msg;
8286         void *hdr;
8287         int err;
8288
8289         wdev = dev->ieee80211_ptr;
8290
8291         if (!rdev->ops->set_power_mgmt)
8292                 return -EOPNOTSUPP;
8293
8294         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8295         if (!msg)
8296                 return -ENOMEM;
8297
8298         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8299                              NL80211_CMD_GET_POWER_SAVE);
8300         if (!hdr) {
8301                 err = -ENOBUFS;
8302                 goto free_msg;
8303         }
8304
8305         if (wdev->ps)
8306                 ps_state = NL80211_PS_ENABLED;
8307         else
8308                 ps_state = NL80211_PS_DISABLED;
8309
8310         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
8311                 goto nla_put_failure;
8312
8313         genlmsg_end(msg, hdr);
8314         return genlmsg_reply(msg, info);
8315
8316  nla_put_failure:
8317         err = -ENOBUFS;
8318  free_msg:
8319         nlmsg_free(msg);
8320         return err;
8321 }
8322
8323 static const struct nla_policy
8324 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
8325         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
8326         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
8327         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
8328         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
8329         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
8330         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
8331 };
8332
8333 static int nl80211_set_cqm_txe(struct genl_info *info,
8334                                u32 rate, u32 pkts, u32 intvl)
8335 {
8336         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8337         struct net_device *dev = info->user_ptr[1];
8338         struct wireless_dev *wdev = dev->ieee80211_ptr;
8339
8340         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
8341                 return -EINVAL;
8342
8343         if (!rdev->ops->set_cqm_txe_config)
8344                 return -EOPNOTSUPP;
8345
8346         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8347             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8348                 return -EOPNOTSUPP;
8349
8350         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
8351 }
8352
8353 static int nl80211_set_cqm_rssi(struct genl_info *info,
8354                                 s32 threshold, u32 hysteresis)
8355 {
8356         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8357         struct net_device *dev = info->user_ptr[1];
8358         struct wireless_dev *wdev = dev->ieee80211_ptr;
8359
8360         if (threshold > 0)
8361                 return -EINVAL;
8362
8363         /* disabling - hysteresis should also be zero then */
8364         if (threshold == 0)
8365                 hysteresis = 0;
8366
8367         if (!rdev->ops->set_cqm_rssi_config)
8368                 return -EOPNOTSUPP;
8369
8370         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8371             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8372                 return -EOPNOTSUPP;
8373
8374         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
8375 }
8376
8377 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
8378 {
8379         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
8380         struct nlattr *cqm;
8381         int err;
8382
8383         cqm = info->attrs[NL80211_ATTR_CQM];
8384         if (!cqm)
8385                 return -EINVAL;
8386
8387         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
8388                                nl80211_attr_cqm_policy);
8389         if (err)
8390                 return err;
8391
8392         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
8393             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8394                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
8395                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8396
8397                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
8398         }
8399
8400         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
8401             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
8402             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
8403                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
8404                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
8405                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
8406
8407                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
8408         }
8409
8410         return -EINVAL;
8411 }
8412
8413 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
8414 {
8415         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8416         struct net_device *dev = info->user_ptr[1];
8417         struct ocb_setup setup = {};
8418         int err;
8419
8420         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8421         if (err)
8422                 return err;
8423
8424         return cfg80211_join_ocb(rdev, dev, &setup);
8425 }
8426
8427 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
8428 {
8429         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8430         struct net_device *dev = info->user_ptr[1];
8431
8432         return cfg80211_leave_ocb(rdev, dev);
8433 }
8434
8435 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
8436 {
8437         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8438         struct net_device *dev = info->user_ptr[1];
8439         struct mesh_config cfg;
8440         struct mesh_setup setup;
8441         int err;
8442
8443         /* start with default */
8444         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8445         memcpy(&setup, &default_mesh_setup, sizeof(setup));
8446
8447         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8448                 /* and parse parameters if given */
8449                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
8450                 if (err)
8451                         return err;
8452         }
8453
8454         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
8455             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
8456                 return -EINVAL;
8457
8458         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
8459         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
8460
8461         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8462             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
8463                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8464                         return -EINVAL;
8465
8466         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
8467                 setup.beacon_interval =
8468                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8469                 if (setup.beacon_interval < 10 ||
8470                     setup.beacon_interval > 10000)
8471                         return -EINVAL;
8472         }
8473
8474         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
8475                 setup.dtim_period =
8476                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
8477                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
8478                         return -EINVAL;
8479         }
8480
8481         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
8482                 /* parse additional setup parameters if given */
8483                 err = nl80211_parse_mesh_setup(info, &setup);
8484                 if (err)
8485                         return err;
8486         }
8487
8488         if (setup.user_mpm)
8489                 cfg.auto_open_plinks = false;
8490
8491         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8492                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8493                 if (err)
8494                         return err;
8495         } else {
8496                 /* cfg80211_join_mesh() will sort it out */
8497                 setup.chandef.chan = NULL;
8498         }
8499
8500         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8501                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8502                 int n_rates =
8503                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8504                 struct ieee80211_supported_band *sband;
8505
8506                 if (!setup.chandef.chan)
8507                         return -EINVAL;
8508
8509                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
8510
8511                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8512                                              &setup.basic_rates);
8513                 if (err)
8514                         return err;
8515         }
8516
8517         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8518 }
8519
8520 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
8521 {
8522         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8523         struct net_device *dev = info->user_ptr[1];
8524
8525         return cfg80211_leave_mesh(rdev, dev);
8526 }
8527
8528 #ifdef CONFIG_PM
8529 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8530                                         struct cfg80211_registered_device *rdev)
8531 {
8532         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8533         struct nlattr *nl_pats, *nl_pat;
8534         int i, pat_len;
8535
8536         if (!wowlan->n_patterns)
8537                 return 0;
8538
8539         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8540         if (!nl_pats)
8541                 return -ENOBUFS;
8542
8543         for (i = 0; i < wowlan->n_patterns; i++) {
8544                 nl_pat = nla_nest_start(msg, i + 1);
8545                 if (!nl_pat)
8546                         return -ENOBUFS;
8547                 pat_len = wowlan->patterns[i].pattern_len;
8548                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8549                             wowlan->patterns[i].mask) ||
8550                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8551                             wowlan->patterns[i].pattern) ||
8552                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8553                                 wowlan->patterns[i].pkt_offset))
8554                         return -ENOBUFS;
8555                 nla_nest_end(msg, nl_pat);
8556         }
8557         nla_nest_end(msg, nl_pats);
8558
8559         return 0;
8560 }
8561
8562 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8563                                    struct cfg80211_wowlan_tcp *tcp)
8564 {
8565         struct nlattr *nl_tcp;
8566
8567         if (!tcp)
8568                 return 0;
8569
8570         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8571         if (!nl_tcp)
8572                 return -ENOBUFS;
8573
8574         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8575             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8576             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8577             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8578             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8579             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8580                     tcp->payload_len, tcp->payload) ||
8581             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8582                         tcp->data_interval) ||
8583             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8584                     tcp->wake_len, tcp->wake_data) ||
8585             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8586                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8587                 return -ENOBUFS;
8588
8589         if (tcp->payload_seq.len &&
8590             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8591                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8592                 return -ENOBUFS;
8593
8594         if (tcp->payload_tok.len &&
8595             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8596                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8597                     &tcp->payload_tok))
8598                 return -ENOBUFS;
8599
8600         nla_nest_end(msg, nl_tcp);
8601
8602         return 0;
8603 }
8604
8605 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8606 {
8607         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8608         struct sk_buff *msg;
8609         void *hdr;
8610         u32 size = NLMSG_DEFAULT_SIZE;
8611
8612         if (!rdev->wiphy.wowlan)
8613                 return -EOPNOTSUPP;
8614
8615         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8616                 /* adjust size to have room for all the data */
8617                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8618                         rdev->wiphy.wowlan_config->tcp->payload_len +
8619                         rdev->wiphy.wowlan_config->tcp->wake_len +
8620                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8621         }
8622
8623         msg = nlmsg_new(size, GFP_KERNEL);
8624         if (!msg)
8625                 return -ENOMEM;
8626
8627         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8628                              NL80211_CMD_GET_WOWLAN);
8629         if (!hdr)
8630                 goto nla_put_failure;
8631
8632         if (rdev->wiphy.wowlan_config) {
8633                 struct nlattr *nl_wowlan;
8634
8635                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8636                 if (!nl_wowlan)
8637                         goto nla_put_failure;
8638
8639                 if ((rdev->wiphy.wowlan_config->any &&
8640                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8641                     (rdev->wiphy.wowlan_config->disconnect &&
8642                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8643                     (rdev->wiphy.wowlan_config->magic_pkt &&
8644                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8645                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8646                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8647                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8648                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8649                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8650                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8651                     (rdev->wiphy.wowlan_config->rfkill_release &&
8652                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8653                         goto nla_put_failure;
8654
8655                 if (nl80211_send_wowlan_patterns(msg, rdev))
8656                         goto nla_put_failure;
8657
8658                 if (nl80211_send_wowlan_tcp(msg,
8659                                             rdev->wiphy.wowlan_config->tcp))
8660                         goto nla_put_failure;
8661
8662                 nla_nest_end(msg, nl_wowlan);
8663         }
8664
8665         genlmsg_end(msg, hdr);
8666         return genlmsg_reply(msg, info);
8667
8668 nla_put_failure:
8669         nlmsg_free(msg);
8670         return -ENOBUFS;
8671 }
8672
8673 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8674                                     struct nlattr *attr,
8675                                     struct cfg80211_wowlan *trig)
8676 {
8677         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8678         struct cfg80211_wowlan_tcp *cfg;
8679         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8680         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8681         u32 size;
8682         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8683         int err, port;
8684
8685         if (!rdev->wiphy.wowlan->tcp)
8686                 return -EINVAL;
8687
8688         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8689                         nla_data(attr), nla_len(attr),
8690                         nl80211_wowlan_tcp_policy);
8691         if (err)
8692                 return err;
8693
8694         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8695             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8696             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8697             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8698             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8699             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8700             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8701             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8702                 return -EINVAL;
8703
8704         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8705         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8706                 return -EINVAL;
8707
8708         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8709                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8710             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8711                 return -EINVAL;
8712
8713         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8714         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8715                 return -EINVAL;
8716
8717         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8718         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8719                 return -EINVAL;
8720
8721         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8722                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8723
8724                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8725                 tokens_size = tokln - sizeof(*tok);
8726
8727                 if (!tok->len || tokens_size % tok->len)
8728                         return -EINVAL;
8729                 if (!rdev->wiphy.wowlan->tcp->tok)
8730                         return -EINVAL;
8731                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8732                         return -EINVAL;
8733                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8734                         return -EINVAL;
8735                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8736                         return -EINVAL;
8737                 if (tok->offset + tok->len > data_size)
8738                         return -EINVAL;
8739         }
8740
8741         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8742                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8743                 if (!rdev->wiphy.wowlan->tcp->seq)
8744                         return -EINVAL;
8745                 if (seq->len == 0 || seq->len > 4)
8746                         return -EINVAL;
8747                 if (seq->len + seq->offset > data_size)
8748                         return -EINVAL;
8749         }
8750
8751         size = sizeof(*cfg);
8752         size += data_size;
8753         size += wake_size + wake_mask_size;
8754         size += tokens_size;
8755
8756         cfg = kzalloc(size, GFP_KERNEL);
8757         if (!cfg)
8758                 return -ENOMEM;
8759         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8760         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8761         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8762                ETH_ALEN);
8763         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8764                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8765         else
8766                 port = 0;
8767 #ifdef CONFIG_INET
8768         /* allocate a socket and port for it and use it */
8769         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8770                             IPPROTO_TCP, &cfg->sock, 1);
8771         if (err) {
8772                 kfree(cfg);
8773                 return err;
8774         }
8775         if (inet_csk_get_port(cfg->sock->sk, port)) {
8776                 sock_release(cfg->sock);
8777                 kfree(cfg);
8778                 return -EADDRINUSE;
8779         }
8780         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8781 #else
8782         if (!port) {
8783                 kfree(cfg);
8784                 return -EINVAL;
8785         }
8786         cfg->src_port = port;
8787 #endif
8788
8789         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
8790         cfg->payload_len = data_size;
8791         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
8792         memcpy((void *)cfg->payload,
8793                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
8794                data_size);
8795         if (seq)
8796                 cfg->payload_seq = *seq;
8797         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
8798         cfg->wake_len = wake_size;
8799         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
8800         memcpy((void *)cfg->wake_data,
8801                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
8802                wake_size);
8803         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
8804                          data_size + wake_size;
8805         memcpy((void *)cfg->wake_mask,
8806                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
8807                wake_mask_size);
8808         if (tok) {
8809                 cfg->tokens_size = tokens_size;
8810                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
8811         }
8812
8813         trig->tcp = cfg;
8814
8815         return 0;
8816 }
8817
8818 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
8819                                    const struct wiphy_wowlan_support *wowlan,
8820                                    struct nlattr *attr,
8821                                    struct cfg80211_wowlan *trig)
8822 {
8823         struct nlattr **tb;
8824         int err;
8825
8826         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
8827         if (!tb)
8828                 return -ENOMEM;
8829
8830         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
8831                 err = -EOPNOTSUPP;
8832                 goto out;
8833         }
8834
8835         err = nla_parse(tb, NL80211_ATTR_MAX,
8836                         nla_data(attr), nla_len(attr),
8837                         nl80211_policy);
8838         if (err)
8839                 goto out;
8840
8841         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
8842         err = PTR_ERR_OR_ZERO(trig->nd_config);
8843         if (err)
8844                 trig->nd_config = NULL;
8845
8846 out:
8847         kfree(tb);
8848         return err;
8849 }
8850
8851 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
8852 {
8853         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8854         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
8855         struct cfg80211_wowlan new_triggers = {};
8856         struct cfg80211_wowlan *ntrig;
8857         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8858         int err, i;
8859         bool prev_enabled = rdev->wiphy.wowlan_config;
8860
8861         if (!wowlan)
8862                 return -EOPNOTSUPP;
8863
8864         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
8865                 cfg80211_rdev_free_wowlan(rdev);
8866                 rdev->wiphy.wowlan_config = NULL;
8867                 goto set_wakeup;
8868         }
8869
8870         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
8871                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8872                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8873                         nl80211_wowlan_policy);
8874         if (err)
8875                 return err;
8876
8877         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
8878                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
8879                         return -EINVAL;
8880                 new_triggers.any = true;
8881         }
8882
8883         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
8884                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
8885                         return -EINVAL;
8886                 new_triggers.disconnect = true;
8887         }
8888
8889         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
8890                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
8891                         return -EINVAL;
8892                 new_triggers.magic_pkt = true;
8893         }
8894
8895         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
8896                 return -EINVAL;
8897
8898         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
8899                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
8900                         return -EINVAL;
8901                 new_triggers.gtk_rekey_failure = true;
8902         }
8903
8904         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
8905                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
8906                         return -EINVAL;
8907                 new_triggers.eap_identity_req = true;
8908         }
8909
8910         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
8911                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
8912                         return -EINVAL;
8913                 new_triggers.four_way_handshake = true;
8914         }
8915
8916         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
8917                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
8918                         return -EINVAL;
8919                 new_triggers.rfkill_release = true;
8920         }
8921
8922         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
8923                 struct nlattr *pat;
8924                 int n_patterns = 0;
8925                 int rem, pat_len, mask_len, pkt_offset;
8926                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8927
8928                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8929                                     rem)
8930                         n_patterns++;
8931                 if (n_patterns > wowlan->n_patterns)
8932                         return -EINVAL;
8933
8934                 new_triggers.patterns = kcalloc(n_patterns,
8935                                                 sizeof(new_triggers.patterns[0]),
8936                                                 GFP_KERNEL);
8937                 if (!new_triggers.patterns)
8938                         return -ENOMEM;
8939
8940                 new_triggers.n_patterns = n_patterns;
8941                 i = 0;
8942
8943                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8944                                     rem) {
8945                         u8 *mask_pat;
8946
8947                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8948                                   nla_len(pat), NULL);
8949                         err = -EINVAL;
8950                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8951                             !pat_tb[NL80211_PKTPAT_PATTERN])
8952                                 goto error;
8953                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8954                         mask_len = DIV_ROUND_UP(pat_len, 8);
8955                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8956                                 goto error;
8957                         if (pat_len > wowlan->pattern_max_len ||
8958                             pat_len < wowlan->pattern_min_len)
8959                                 goto error;
8960
8961                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8962                                 pkt_offset = 0;
8963                         else
8964                                 pkt_offset = nla_get_u32(
8965                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8966                         if (pkt_offset > wowlan->max_pkt_offset)
8967                                 goto error;
8968                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8969
8970                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
8971                         if (!mask_pat) {
8972                                 err = -ENOMEM;
8973                                 goto error;
8974                         }
8975                         new_triggers.patterns[i].mask = mask_pat;
8976                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8977                                mask_len);
8978                         mask_pat += mask_len;
8979                         new_triggers.patterns[i].pattern = mask_pat;
8980                         new_triggers.patterns[i].pattern_len = pat_len;
8981                         memcpy(mask_pat,
8982                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8983                                pat_len);
8984                         i++;
8985                 }
8986         }
8987
8988         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8989                 err = nl80211_parse_wowlan_tcp(
8990                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8991                         &new_triggers);
8992                 if (err)
8993                         goto error;
8994         }
8995
8996         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
8997                 err = nl80211_parse_wowlan_nd(
8998                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
8999                         &new_triggers);
9000                 if (err)
9001                         goto error;
9002         }
9003
9004         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
9005         if (!ntrig) {
9006                 err = -ENOMEM;
9007                 goto error;
9008         }
9009         cfg80211_rdev_free_wowlan(rdev);
9010         rdev->wiphy.wowlan_config = ntrig;
9011
9012  set_wakeup:
9013         if (rdev->ops->set_wakeup &&
9014             prev_enabled != !!rdev->wiphy.wowlan_config)
9015                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
9016
9017         return 0;
9018  error:
9019         for (i = 0; i < new_triggers.n_patterns; i++)
9020                 kfree(new_triggers.patterns[i].mask);
9021         kfree(new_triggers.patterns);
9022         if (new_triggers.tcp && new_triggers.tcp->sock)
9023                 sock_release(new_triggers.tcp->sock);
9024         kfree(new_triggers.tcp);
9025         return err;
9026 }
9027 #endif
9028
9029 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
9030                                        struct cfg80211_registered_device *rdev)
9031 {
9032         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
9033         int i, j, pat_len;
9034         struct cfg80211_coalesce_rules *rule;
9035
9036         if (!rdev->coalesce->n_rules)
9037                 return 0;
9038
9039         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
9040         if (!nl_rules)
9041                 return -ENOBUFS;
9042
9043         for (i = 0; i < rdev->coalesce->n_rules; i++) {
9044                 nl_rule = nla_nest_start(msg, i + 1);
9045                 if (!nl_rule)
9046                         return -ENOBUFS;
9047
9048                 rule = &rdev->coalesce->rules[i];
9049                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
9050                                 rule->delay))
9051                         return -ENOBUFS;
9052
9053                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
9054                                 rule->condition))
9055                         return -ENOBUFS;
9056
9057                 nl_pats = nla_nest_start(msg,
9058                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
9059                 if (!nl_pats)
9060                         return -ENOBUFS;
9061
9062                 for (j = 0; j < rule->n_patterns; j++) {
9063                         nl_pat = nla_nest_start(msg, j + 1);
9064                         if (!nl_pat)
9065                                 return -ENOBUFS;
9066                         pat_len = rule->patterns[j].pattern_len;
9067                         if (nla_put(msg, NL80211_PKTPAT_MASK,
9068                                     DIV_ROUND_UP(pat_len, 8),
9069                                     rule->patterns[j].mask) ||
9070                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9071                                     rule->patterns[j].pattern) ||
9072                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9073                                         rule->patterns[j].pkt_offset))
9074                                 return -ENOBUFS;
9075                         nla_nest_end(msg, nl_pat);
9076                 }
9077                 nla_nest_end(msg, nl_pats);
9078                 nla_nest_end(msg, nl_rule);
9079         }
9080         nla_nest_end(msg, nl_rules);
9081
9082         return 0;
9083 }
9084
9085 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
9086 {
9087         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9088         struct sk_buff *msg;
9089         void *hdr;
9090
9091         if (!rdev->wiphy.coalesce)
9092                 return -EOPNOTSUPP;
9093
9094         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9095         if (!msg)
9096                 return -ENOMEM;
9097
9098         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9099                              NL80211_CMD_GET_COALESCE);
9100         if (!hdr)
9101                 goto nla_put_failure;
9102
9103         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
9104                 goto nla_put_failure;
9105
9106         genlmsg_end(msg, hdr);
9107         return genlmsg_reply(msg, info);
9108
9109 nla_put_failure:
9110         nlmsg_free(msg);
9111         return -ENOBUFS;
9112 }
9113
9114 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
9115 {
9116         struct cfg80211_coalesce *coalesce = rdev->coalesce;
9117         int i, j;
9118         struct cfg80211_coalesce_rules *rule;
9119
9120         if (!coalesce)
9121                 return;
9122
9123         for (i = 0; i < coalesce->n_rules; i++) {
9124                 rule = &coalesce->rules[i];
9125                 for (j = 0; j < rule->n_patterns; j++)
9126                         kfree(rule->patterns[j].mask);
9127                 kfree(rule->patterns);
9128         }
9129         kfree(coalesce->rules);
9130         kfree(coalesce);
9131         rdev->coalesce = NULL;
9132 }
9133
9134 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
9135                                        struct nlattr *rule,
9136                                        struct cfg80211_coalesce_rules *new_rule)
9137 {
9138         int err, i;
9139         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9140         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
9141         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
9142         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9143
9144         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
9145                         nla_len(rule), nl80211_coalesce_policy);
9146         if (err)
9147                 return err;
9148
9149         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
9150                 new_rule->delay =
9151                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
9152         if (new_rule->delay > coalesce->max_delay)
9153                 return -EINVAL;
9154
9155         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
9156                 new_rule->condition =
9157                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
9158         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
9159             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
9160                 return -EINVAL;
9161
9162         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
9163                 return -EINVAL;
9164
9165         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9166                             rem)
9167                 n_patterns++;
9168         if (n_patterns > coalesce->n_patterns)
9169                 return -EINVAL;
9170
9171         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
9172                                      GFP_KERNEL);
9173         if (!new_rule->patterns)
9174                 return -ENOMEM;
9175
9176         new_rule->n_patterns = n_patterns;
9177         i = 0;
9178
9179         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
9180                             rem) {
9181                 u8 *mask_pat;
9182
9183                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9184                           nla_len(pat), NULL);
9185                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
9186                     !pat_tb[NL80211_PKTPAT_PATTERN])
9187                         return -EINVAL;
9188                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9189                 mask_len = DIV_ROUND_UP(pat_len, 8);
9190                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9191                         return -EINVAL;
9192                 if (pat_len > coalesce->pattern_max_len ||
9193                     pat_len < coalesce->pattern_min_len)
9194                         return -EINVAL;
9195
9196                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
9197                         pkt_offset = 0;
9198                 else
9199                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
9200                 if (pkt_offset > coalesce->max_pkt_offset)
9201                         return -EINVAL;
9202                 new_rule->patterns[i].pkt_offset = pkt_offset;
9203
9204                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
9205                 if (!mask_pat)
9206                         return -ENOMEM;
9207
9208                 new_rule->patterns[i].mask = mask_pat;
9209                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
9210                        mask_len);
9211
9212                 mask_pat += mask_len;
9213                 new_rule->patterns[i].pattern = mask_pat;
9214                 new_rule->patterns[i].pattern_len = pat_len;
9215                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
9216                        pat_len);
9217                 i++;
9218         }
9219
9220         return 0;
9221 }
9222
9223 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
9224 {
9225         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9226         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
9227         struct cfg80211_coalesce new_coalesce = {};
9228         struct cfg80211_coalesce *n_coalesce;
9229         int err, rem_rule, n_rules = 0, i, j;
9230         struct nlattr *rule;
9231         struct cfg80211_coalesce_rules *tmp_rule;
9232
9233         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
9234                 return -EOPNOTSUPP;
9235
9236         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
9237                 cfg80211_rdev_free_coalesce(rdev);
9238                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
9239                 return 0;
9240         }
9241
9242         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9243                             rem_rule)
9244                 n_rules++;
9245         if (n_rules > coalesce->n_rules)
9246                 return -EINVAL;
9247
9248         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
9249                                      GFP_KERNEL);
9250         if (!new_coalesce.rules)
9251                 return -ENOMEM;
9252
9253         new_coalesce.n_rules = n_rules;
9254         i = 0;
9255
9256         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
9257                             rem_rule) {
9258                 err = nl80211_parse_coalesce_rule(rdev, rule,
9259                                                   &new_coalesce.rules[i]);
9260                 if (err)
9261                         goto error;
9262
9263                 i++;
9264         }
9265
9266         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
9267         if (err)
9268                 goto error;
9269
9270         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
9271         if (!n_coalesce) {
9272                 err = -ENOMEM;
9273                 goto error;
9274         }
9275         cfg80211_rdev_free_coalesce(rdev);
9276         rdev->coalesce = n_coalesce;
9277
9278         return 0;
9279 error:
9280         for (i = 0; i < new_coalesce.n_rules; i++) {
9281                 tmp_rule = &new_coalesce.rules[i];
9282                 for (j = 0; j < tmp_rule->n_patterns; j++)
9283                         kfree(tmp_rule->patterns[j].mask);
9284                 kfree(tmp_rule->patterns);
9285         }
9286         kfree(new_coalesce.rules);
9287
9288         return err;
9289 }
9290
9291 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
9292 {
9293         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9294         struct net_device *dev = info->user_ptr[1];
9295         struct wireless_dev *wdev = dev->ieee80211_ptr;
9296         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
9297         struct cfg80211_gtk_rekey_data rekey_data;
9298         int err;
9299
9300         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
9301                 return -EINVAL;
9302
9303         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
9304                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
9305                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
9306                         nl80211_rekey_policy);
9307         if (err)
9308                 return err;
9309
9310         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
9311                 return -ERANGE;
9312         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
9313                 return -ERANGE;
9314         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
9315                 return -ERANGE;
9316
9317         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
9318         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
9319         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
9320
9321         wdev_lock(wdev);
9322         if (!wdev->current_bss) {
9323                 err = -ENOTCONN;
9324                 goto out;
9325         }
9326
9327         if (!rdev->ops->set_rekey_data) {
9328                 err = -EOPNOTSUPP;
9329                 goto out;
9330         }
9331
9332         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
9333  out:
9334         wdev_unlock(wdev);
9335         return err;
9336 }
9337
9338 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
9339                                              struct genl_info *info)
9340 {
9341         struct net_device *dev = info->user_ptr[1];
9342         struct wireless_dev *wdev = dev->ieee80211_ptr;
9343
9344         if (wdev->iftype != NL80211_IFTYPE_AP &&
9345             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9346                 return -EINVAL;
9347
9348         if (wdev->ap_unexpected_nlportid)
9349                 return -EBUSY;
9350
9351         wdev->ap_unexpected_nlportid = info->snd_portid;
9352         return 0;
9353 }
9354
9355 static int nl80211_probe_client(struct sk_buff *skb,
9356                                 struct genl_info *info)
9357 {
9358         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9359         struct net_device *dev = info->user_ptr[1];
9360         struct wireless_dev *wdev = dev->ieee80211_ptr;
9361         struct sk_buff *msg;
9362         void *hdr;
9363         const u8 *addr;
9364         u64 cookie;
9365         int err;
9366
9367         if (wdev->iftype != NL80211_IFTYPE_AP &&
9368             wdev->iftype != NL80211_IFTYPE_P2P_GO)
9369                 return -EOPNOTSUPP;
9370
9371         if (!info->attrs[NL80211_ATTR_MAC])
9372                 return -EINVAL;
9373
9374         if (!rdev->ops->probe_client)
9375                 return -EOPNOTSUPP;
9376
9377         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9378         if (!msg)
9379                 return -ENOMEM;
9380
9381         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9382                              NL80211_CMD_PROBE_CLIENT);
9383         if (!hdr) {
9384                 err = -ENOBUFS;
9385                 goto free_msg;
9386         }
9387
9388         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
9389
9390         err = rdev_probe_client(rdev, dev, addr, &cookie);
9391         if (err)
9392                 goto free_msg;
9393
9394         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9395                 goto nla_put_failure;
9396
9397         genlmsg_end(msg, hdr);
9398
9399         return genlmsg_reply(msg, info);
9400
9401  nla_put_failure:
9402         err = -ENOBUFS;
9403  free_msg:
9404         nlmsg_free(msg);
9405         return err;
9406 }
9407
9408 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
9409 {
9410         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9411         struct cfg80211_beacon_registration *reg, *nreg;
9412         int rv;
9413
9414         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
9415                 return -EOPNOTSUPP;
9416
9417         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
9418         if (!nreg)
9419                 return -ENOMEM;
9420
9421         /* First, check if already registered. */
9422         spin_lock_bh(&rdev->beacon_registrations_lock);
9423         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9424                 if (reg->nlportid == info->snd_portid) {
9425                         rv = -EALREADY;
9426                         goto out_err;
9427                 }
9428         }
9429         /* Add it to the list */
9430         nreg->nlportid = info->snd_portid;
9431         list_add(&nreg->list, &rdev->beacon_registrations);
9432
9433         spin_unlock_bh(&rdev->beacon_registrations_lock);
9434
9435         return 0;
9436 out_err:
9437         spin_unlock_bh(&rdev->beacon_registrations_lock);
9438         kfree(nreg);
9439         return rv;
9440 }
9441
9442 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
9443 {
9444         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9445         struct wireless_dev *wdev = info->user_ptr[1];
9446         int err;
9447
9448         if (!rdev->ops->start_p2p_device)
9449                 return -EOPNOTSUPP;
9450
9451         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9452                 return -EOPNOTSUPP;
9453
9454         if (wdev->p2p_started)
9455                 return 0;
9456
9457         if (rfkill_blocked(rdev->rfkill))
9458                 return -ERFKILL;
9459
9460         err = rdev_start_p2p_device(rdev, wdev);
9461         if (err)
9462                 return err;
9463
9464         wdev->p2p_started = true;
9465         rdev->opencount++;
9466
9467         return 0;
9468 }
9469
9470 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
9471 {
9472         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9473         struct wireless_dev *wdev = info->user_ptr[1];
9474
9475         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9476                 return -EOPNOTSUPP;
9477
9478         if (!rdev->ops->stop_p2p_device)
9479                 return -EOPNOTSUPP;
9480
9481         cfg80211_stop_p2p_device(rdev, wdev);
9482
9483         return 0;
9484 }
9485
9486 static int nl80211_get_protocol_features(struct sk_buff *skb,
9487                                          struct genl_info *info)
9488 {
9489         void *hdr;
9490         struct sk_buff *msg;
9491
9492         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9493         if (!msg)
9494                 return -ENOMEM;
9495
9496         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9497                              NL80211_CMD_GET_PROTOCOL_FEATURES);
9498         if (!hdr)
9499                 goto nla_put_failure;
9500
9501         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
9502                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
9503                 goto nla_put_failure;
9504
9505         genlmsg_end(msg, hdr);
9506         return genlmsg_reply(msg, info);
9507
9508  nla_put_failure:
9509         kfree_skb(msg);
9510         return -ENOBUFS;
9511 }
9512
9513 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
9514 {
9515         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9516         struct cfg80211_update_ft_ies_params ft_params;
9517         struct net_device *dev = info->user_ptr[1];
9518
9519         if (!rdev->ops->update_ft_ies)
9520                 return -EOPNOTSUPP;
9521
9522         if (!info->attrs[NL80211_ATTR_MDID] ||
9523             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9524                 return -EINVAL;
9525
9526         memset(&ft_params, 0, sizeof(ft_params));
9527         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
9528         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9529         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9530
9531         return rdev_update_ft_ies(rdev, dev, &ft_params);
9532 }
9533
9534 static int nl80211_crit_protocol_start(struct sk_buff *skb,
9535                                        struct genl_info *info)
9536 {
9537         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9538         struct wireless_dev *wdev = info->user_ptr[1];
9539         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
9540         u16 duration;
9541         int ret;
9542
9543         if (!rdev->ops->crit_proto_start)
9544                 return -EOPNOTSUPP;
9545
9546         if (WARN_ON(!rdev->ops->crit_proto_stop))
9547                 return -EINVAL;
9548
9549         if (rdev->crit_proto_nlportid)
9550                 return -EBUSY;
9551
9552         /* determine protocol if provided */
9553         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
9554                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
9555
9556         if (proto >= NUM_NL80211_CRIT_PROTO)
9557                 return -EINVAL;
9558
9559         /* timeout must be provided */
9560         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
9561                 return -EINVAL;
9562
9563         duration =
9564                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
9565
9566         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
9567                 return -ERANGE;
9568
9569         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
9570         if (!ret)
9571                 rdev->crit_proto_nlportid = info->snd_portid;
9572
9573         return ret;
9574 }
9575
9576 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
9577                                       struct genl_info *info)
9578 {
9579         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9580         struct wireless_dev *wdev = info->user_ptr[1];
9581
9582         if (!rdev->ops->crit_proto_stop)
9583                 return -EOPNOTSUPP;
9584
9585         if (rdev->crit_proto_nlportid) {
9586                 rdev->crit_proto_nlportid = 0;
9587                 rdev_crit_proto_stop(rdev, wdev);
9588         }
9589         return 0;
9590 }
9591
9592 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
9593 {
9594         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9595         struct wireless_dev *wdev =
9596                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9597         int i, err;
9598         u32 vid, subcmd;
9599
9600         if (!rdev->wiphy.vendor_commands)
9601                 return -EOPNOTSUPP;
9602
9603         if (IS_ERR(wdev)) {
9604                 err = PTR_ERR(wdev);
9605                 if (err != -EINVAL)
9606                         return err;
9607                 wdev = NULL;
9608         } else if (wdev->wiphy != &rdev->wiphy) {
9609                 return -EINVAL;
9610         }
9611
9612         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9613             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9614                 return -EINVAL;
9615
9616         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9617         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9618         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9619                 const struct wiphy_vendor_command *vcmd;
9620                 void *data = NULL;
9621                 int len = 0;
9622
9623                 vcmd = &rdev->wiphy.vendor_commands[i];
9624
9625                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9626                         continue;
9627
9628                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9629                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9630                         if (!wdev)
9631                                 return -EINVAL;
9632                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9633                             !wdev->netdev)
9634                                 return -EINVAL;
9635
9636                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9637                                 if (wdev->netdev &&
9638                                     !netif_running(wdev->netdev))
9639                                         return -ENETDOWN;
9640                                 if (!wdev->netdev && !wdev->p2p_started)
9641                                         return -ENETDOWN;
9642                         }
9643                 } else {
9644                         wdev = NULL;
9645                 }
9646
9647                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9648                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9649                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9650                 }
9651
9652                 rdev->cur_cmd_info = info;
9653                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9654                                                           data, len);
9655                 rdev->cur_cmd_info = NULL;
9656                 return err;
9657         }
9658
9659         return -EOPNOTSUPP;
9660 }
9661
9662 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
9663                                            enum nl80211_commands cmd,
9664                                            enum nl80211_attrs attr,
9665                                            int approxlen)
9666 {
9667         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9668
9669         if (WARN_ON(!rdev->cur_cmd_info))
9670                 return NULL;
9671
9672         return __cfg80211_alloc_vendor_skb(rdev, approxlen,
9673                                            rdev->cur_cmd_info->snd_portid,
9674                                            rdev->cur_cmd_info->snd_seq,
9675                                            cmd, attr, NULL, GFP_KERNEL);
9676 }
9677 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
9678
9679 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
9680 {
9681         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9682         void *hdr = ((void **)skb->cb)[1];
9683         struct nlattr *data = ((void **)skb->cb)[2];
9684
9685         /* clear CB data for netlink core to own from now on */
9686         memset(skb->cb, 0, sizeof(skb->cb));
9687
9688         if (WARN_ON(!rdev->cur_cmd_info)) {
9689                 kfree_skb(skb);
9690                 return -EINVAL;
9691         }
9692
9693         nla_nest_end(skb, data);
9694         genlmsg_end(skb, hdr);
9695         return genlmsg_reply(skb, rdev->cur_cmd_info);
9696 }
9697 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
9698
9699
9700 static int nl80211_set_qos_map(struct sk_buff *skb,
9701                                struct genl_info *info)
9702 {
9703         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9704         struct cfg80211_qos_map *qos_map = NULL;
9705         struct net_device *dev = info->user_ptr[1];
9706         u8 *pos, len, num_des, des_len, des;
9707         int ret;
9708
9709         if (!rdev->ops->set_qos_map)
9710                 return -EOPNOTSUPP;
9711
9712         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
9713                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
9714                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
9715
9716                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
9717                     len > IEEE80211_QOS_MAP_LEN_MAX)
9718                         return -EINVAL;
9719
9720                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
9721                 if (!qos_map)
9722                         return -ENOMEM;
9723
9724                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
9725                 if (num_des) {
9726                         des_len = num_des *
9727                                 sizeof(struct cfg80211_dscp_exception);
9728                         memcpy(qos_map->dscp_exception, pos, des_len);
9729                         qos_map->num_des = num_des;
9730                         for (des = 0; des < num_des; des++) {
9731                                 if (qos_map->dscp_exception[des].up > 7) {
9732                                         kfree(qos_map);
9733                                         return -EINVAL;
9734                                 }
9735                         }
9736                         pos += des_len;
9737                 }
9738                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
9739         }
9740
9741         wdev_lock(dev->ieee80211_ptr);
9742         ret = nl80211_key_allowed(dev->ieee80211_ptr);
9743         if (!ret)
9744                 ret = rdev_set_qos_map(rdev, dev, qos_map);
9745         wdev_unlock(dev->ieee80211_ptr);
9746
9747         kfree(qos_map);
9748         return ret;
9749 }
9750
9751 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
9752 {
9753         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9754         struct net_device *dev = info->user_ptr[1];
9755         struct wireless_dev *wdev = dev->ieee80211_ptr;
9756         const u8 *peer;
9757         u8 tsid, up;
9758         u16 admitted_time = 0;
9759         int err;
9760
9761         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
9762                 return -EOPNOTSUPP;
9763
9764         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
9765             !info->attrs[NL80211_ATTR_USER_PRIO])
9766                 return -EINVAL;
9767
9768         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
9769         if (tsid >= IEEE80211_NUM_TIDS)
9770                 return -EINVAL;
9771
9772         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
9773         if (up >= IEEE80211_NUM_UPS)
9774                 return -EINVAL;
9775
9776         /* WMM uses TIDs 0-7 even for TSPEC */
9777         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
9778                 /* TODO: handle 802.11 TSPEC/admission control
9779                  * need more attributes for that (e.g. BA session requirement);
9780                  * change the WMM adminssion test above to allow both then
9781                  */
9782                 return -EINVAL;
9783         }
9784
9785         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9786
9787         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
9788                 admitted_time =
9789                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
9790                 if (!admitted_time)
9791                         return -EINVAL;
9792         }
9793
9794         wdev_lock(wdev);
9795         switch (wdev->iftype) {
9796         case NL80211_IFTYPE_STATION:
9797         case NL80211_IFTYPE_P2P_CLIENT:
9798                 if (wdev->current_bss)
9799                         break;
9800                 err = -ENOTCONN;
9801                 goto out;
9802         default:
9803                 err = -EOPNOTSUPP;
9804                 goto out;
9805         }
9806
9807         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
9808
9809  out:
9810         wdev_unlock(wdev);
9811         return err;
9812 }
9813
9814 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
9815 {
9816         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9817         struct net_device *dev = info->user_ptr[1];
9818         struct wireless_dev *wdev = dev->ieee80211_ptr;
9819         const u8 *peer;
9820         u8 tsid;
9821         int err;
9822
9823         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
9824                 return -EINVAL;
9825
9826         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
9827         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9828
9829         wdev_lock(wdev);
9830         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
9831         wdev_unlock(wdev);
9832
9833         return err;
9834 }
9835
9836 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
9837                                        struct genl_info *info)
9838 {
9839         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9840         struct net_device *dev = info->user_ptr[1];
9841         struct wireless_dev *wdev = dev->ieee80211_ptr;
9842         struct cfg80211_chan_def chandef = {};
9843         const u8 *addr;
9844         u8 oper_class;
9845         int err;
9846
9847         if (!rdev->ops->tdls_channel_switch ||
9848             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
9849                 return -EOPNOTSUPP;
9850
9851         switch (dev->ieee80211_ptr->iftype) {
9852         case NL80211_IFTYPE_STATION:
9853         case NL80211_IFTYPE_P2P_CLIENT:
9854                 break;
9855         default:
9856                 return -EOPNOTSUPP;
9857         }
9858
9859         if (!info->attrs[NL80211_ATTR_MAC] ||
9860             !info->attrs[NL80211_ATTR_OPER_CLASS])
9861                 return -EINVAL;
9862
9863         err = nl80211_parse_chandef(rdev, info, &chandef);
9864         if (err)
9865                 return err;
9866
9867         /*
9868          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
9869          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
9870          * specification is not defined for them.
9871          */
9872         if (chandef.chan->band == IEEE80211_BAND_2GHZ &&
9873             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
9874             chandef.width != NL80211_CHAN_WIDTH_20)
9875                 return -EINVAL;
9876
9877         /* we will be active on the TDLS link */
9878         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, wdev->iftype))
9879                 return -EINVAL;
9880
9881         /* don't allow switching to DFS channels */
9882         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
9883                 return -EINVAL;
9884
9885         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
9886         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
9887
9888         wdev_lock(wdev);
9889         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
9890         wdev_unlock(wdev);
9891
9892         return err;
9893 }
9894
9895 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
9896                                               struct genl_info *info)
9897 {
9898         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9899         struct net_device *dev = info->user_ptr[1];
9900         struct wireless_dev *wdev = dev->ieee80211_ptr;
9901         const u8 *addr;
9902
9903         if (!rdev->ops->tdls_channel_switch ||
9904             !rdev->ops->tdls_cancel_channel_switch ||
9905             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
9906                 return -EOPNOTSUPP;
9907
9908         switch (dev->ieee80211_ptr->iftype) {
9909         case NL80211_IFTYPE_STATION:
9910         case NL80211_IFTYPE_P2P_CLIENT:
9911                 break;
9912         default:
9913                 return -EOPNOTSUPP;
9914         }
9915
9916         if (!info->attrs[NL80211_ATTR_MAC])
9917                 return -EINVAL;
9918
9919         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
9920
9921         wdev_lock(wdev);
9922         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
9923         wdev_unlock(wdev);
9924
9925         return 0;
9926 }
9927
9928 #define NL80211_FLAG_NEED_WIPHY         0x01
9929 #define NL80211_FLAG_NEED_NETDEV        0x02
9930 #define NL80211_FLAG_NEED_RTNL          0x04
9931 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
9932 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
9933                                          NL80211_FLAG_CHECK_NETDEV_UP)
9934 #define NL80211_FLAG_NEED_WDEV          0x10
9935 /* If a netdev is associated, it must be UP, P2P must be started */
9936 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
9937                                          NL80211_FLAG_CHECK_NETDEV_UP)
9938 #define NL80211_FLAG_CLEAR_SKB          0x20
9939
9940 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
9941                             struct genl_info *info)
9942 {
9943         struct cfg80211_registered_device *rdev;
9944         struct wireless_dev *wdev;
9945         struct net_device *dev;
9946         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
9947
9948         if (rtnl)
9949                 rtnl_lock();
9950
9951         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
9952                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9953                 if (IS_ERR(rdev)) {
9954                         if (rtnl)
9955                                 rtnl_unlock();
9956                         return PTR_ERR(rdev);
9957                 }
9958                 info->user_ptr[0] = rdev;
9959         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
9960                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9961                 ASSERT_RTNL();
9962
9963                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
9964                                                   info->attrs);
9965                 if (IS_ERR(wdev)) {
9966                         if (rtnl)
9967                                 rtnl_unlock();
9968                         return PTR_ERR(wdev);
9969                 }
9970
9971                 dev = wdev->netdev;
9972                 rdev = wiphy_to_rdev(wdev->wiphy);
9973
9974                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
9975                         if (!dev) {
9976                                 if (rtnl)
9977                                         rtnl_unlock();
9978                                 return -EINVAL;
9979                         }
9980
9981                         info->user_ptr[1] = dev;
9982                 } else {
9983                         info->user_ptr[1] = wdev;
9984                 }
9985
9986                 if (dev) {
9987                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
9988                             !netif_running(dev)) {
9989                                 if (rtnl)
9990                                         rtnl_unlock();
9991                                 return -ENETDOWN;
9992                         }
9993
9994                         dev_hold(dev);
9995                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
9996                         if (!wdev->p2p_started) {
9997                                 if (rtnl)
9998                                         rtnl_unlock();
9999                                 return -ENETDOWN;
10000                         }
10001                 }
10002
10003                 info->user_ptr[0] = rdev;
10004         }
10005
10006         return 0;
10007 }
10008
10009 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
10010                               struct genl_info *info)
10011 {
10012         if (info->user_ptr[1]) {
10013                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
10014                         struct wireless_dev *wdev = info->user_ptr[1];
10015
10016                         if (wdev->netdev)
10017                                 dev_put(wdev->netdev);
10018                 } else {
10019                         dev_put(info->user_ptr[1]);
10020                 }
10021         }
10022
10023         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
10024                 rtnl_unlock();
10025
10026         /* If needed, clear the netlink message payload from the SKB
10027          * as it might contain key data that shouldn't stick around on
10028          * the heap after the SKB is freed. The netlink message header
10029          * is still needed for further processing, so leave it intact.
10030          */
10031         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
10032                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
10033
10034                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
10035         }
10036 }
10037
10038 static const struct genl_ops nl80211_ops[] = {
10039         {
10040                 .cmd = NL80211_CMD_GET_WIPHY,
10041                 .doit = nl80211_get_wiphy,
10042                 .dumpit = nl80211_dump_wiphy,
10043                 .done = nl80211_dump_wiphy_done,
10044                 .policy = nl80211_policy,
10045                 /* can be retrieved by unprivileged users */
10046                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10047                                   NL80211_FLAG_NEED_RTNL,
10048         },
10049         {
10050                 .cmd = NL80211_CMD_SET_WIPHY,
10051                 .doit = nl80211_set_wiphy,
10052                 .policy = nl80211_policy,
10053                 .flags = GENL_ADMIN_PERM,
10054                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10055         },
10056         {
10057                 .cmd = NL80211_CMD_GET_INTERFACE,
10058                 .doit = nl80211_get_interface,
10059                 .dumpit = nl80211_dump_interface,
10060                 .policy = nl80211_policy,
10061                 /* can be retrieved by unprivileged users */
10062                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10063                                   NL80211_FLAG_NEED_RTNL,
10064         },
10065         {
10066                 .cmd = NL80211_CMD_SET_INTERFACE,
10067                 .doit = nl80211_set_interface,
10068                 .policy = nl80211_policy,
10069                 .flags = GENL_ADMIN_PERM,
10070                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10071                                   NL80211_FLAG_NEED_RTNL,
10072         },
10073         {
10074                 .cmd = NL80211_CMD_NEW_INTERFACE,
10075                 .doit = nl80211_new_interface,
10076                 .policy = nl80211_policy,
10077                 .flags = GENL_ADMIN_PERM,
10078                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10079                                   NL80211_FLAG_NEED_RTNL,
10080         },
10081         {
10082                 .cmd = NL80211_CMD_DEL_INTERFACE,
10083                 .doit = nl80211_del_interface,
10084                 .policy = nl80211_policy,
10085                 .flags = GENL_ADMIN_PERM,
10086                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10087                                   NL80211_FLAG_NEED_RTNL,
10088         },
10089         {
10090                 .cmd = NL80211_CMD_GET_KEY,
10091                 .doit = nl80211_get_key,
10092                 .policy = nl80211_policy,
10093                 .flags = GENL_ADMIN_PERM,
10094                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10095                                   NL80211_FLAG_NEED_RTNL,
10096         },
10097         {
10098                 .cmd = NL80211_CMD_SET_KEY,
10099                 .doit = nl80211_set_key,
10100                 .policy = nl80211_policy,
10101                 .flags = GENL_ADMIN_PERM,
10102                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10103                                   NL80211_FLAG_NEED_RTNL |
10104                                   NL80211_FLAG_CLEAR_SKB,
10105         },
10106         {
10107                 .cmd = NL80211_CMD_NEW_KEY,
10108                 .doit = nl80211_new_key,
10109                 .policy = nl80211_policy,
10110                 .flags = GENL_ADMIN_PERM,
10111                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10112                                   NL80211_FLAG_NEED_RTNL |
10113                                   NL80211_FLAG_CLEAR_SKB,
10114         },
10115         {
10116                 .cmd = NL80211_CMD_DEL_KEY,
10117                 .doit = nl80211_del_key,
10118                 .policy = nl80211_policy,
10119                 .flags = GENL_ADMIN_PERM,
10120                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10121                                   NL80211_FLAG_NEED_RTNL,
10122         },
10123         {
10124                 .cmd = NL80211_CMD_SET_BEACON,
10125                 .policy = nl80211_policy,
10126                 .flags = GENL_ADMIN_PERM,
10127                 .doit = nl80211_set_beacon,
10128                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10129                                   NL80211_FLAG_NEED_RTNL,
10130         },
10131         {
10132                 .cmd = NL80211_CMD_START_AP,
10133                 .policy = nl80211_policy,
10134                 .flags = GENL_ADMIN_PERM,
10135                 .doit = nl80211_start_ap,
10136                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10137                                   NL80211_FLAG_NEED_RTNL,
10138         },
10139         {
10140                 .cmd = NL80211_CMD_STOP_AP,
10141                 .policy = nl80211_policy,
10142                 .flags = GENL_ADMIN_PERM,
10143                 .doit = nl80211_stop_ap,
10144                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10145                                   NL80211_FLAG_NEED_RTNL,
10146         },
10147         {
10148                 .cmd = NL80211_CMD_GET_STATION,
10149                 .doit = nl80211_get_station,
10150                 .dumpit = nl80211_dump_station,
10151                 .policy = nl80211_policy,
10152                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10153                                   NL80211_FLAG_NEED_RTNL,
10154         },
10155         {
10156                 .cmd = NL80211_CMD_SET_STATION,
10157                 .doit = nl80211_set_station,
10158                 .policy = nl80211_policy,
10159                 .flags = GENL_ADMIN_PERM,
10160                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10161                                   NL80211_FLAG_NEED_RTNL,
10162         },
10163         {
10164                 .cmd = NL80211_CMD_NEW_STATION,
10165                 .doit = nl80211_new_station,
10166                 .policy = nl80211_policy,
10167                 .flags = GENL_ADMIN_PERM,
10168                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10169                                   NL80211_FLAG_NEED_RTNL,
10170         },
10171         {
10172                 .cmd = NL80211_CMD_DEL_STATION,
10173                 .doit = nl80211_del_station,
10174                 .policy = nl80211_policy,
10175                 .flags = GENL_ADMIN_PERM,
10176                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10177                                   NL80211_FLAG_NEED_RTNL,
10178         },
10179         {
10180                 .cmd = NL80211_CMD_GET_MPATH,
10181                 .doit = nl80211_get_mpath,
10182                 .dumpit = nl80211_dump_mpath,
10183                 .policy = nl80211_policy,
10184                 .flags = GENL_ADMIN_PERM,
10185                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10186                                   NL80211_FLAG_NEED_RTNL,
10187         },
10188         {
10189                 .cmd = NL80211_CMD_GET_MPP,
10190                 .doit = nl80211_get_mpp,
10191                 .dumpit = nl80211_dump_mpp,
10192                 .policy = nl80211_policy,
10193                 .flags = GENL_ADMIN_PERM,
10194                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10195                                   NL80211_FLAG_NEED_RTNL,
10196         },
10197         {
10198                 .cmd = NL80211_CMD_SET_MPATH,
10199                 .doit = nl80211_set_mpath,
10200                 .policy = nl80211_policy,
10201                 .flags = GENL_ADMIN_PERM,
10202                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10203                                   NL80211_FLAG_NEED_RTNL,
10204         },
10205         {
10206                 .cmd = NL80211_CMD_NEW_MPATH,
10207                 .doit = nl80211_new_mpath,
10208                 .policy = nl80211_policy,
10209                 .flags = GENL_ADMIN_PERM,
10210                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10211                                   NL80211_FLAG_NEED_RTNL,
10212         },
10213         {
10214                 .cmd = NL80211_CMD_DEL_MPATH,
10215                 .doit = nl80211_del_mpath,
10216                 .policy = nl80211_policy,
10217                 .flags = GENL_ADMIN_PERM,
10218                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10219                                   NL80211_FLAG_NEED_RTNL,
10220         },
10221         {
10222                 .cmd = NL80211_CMD_SET_BSS,
10223                 .doit = nl80211_set_bss,
10224                 .policy = nl80211_policy,
10225                 .flags = GENL_ADMIN_PERM,
10226                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10227                                   NL80211_FLAG_NEED_RTNL,
10228         },
10229         {
10230                 .cmd = NL80211_CMD_GET_REG,
10231                 .doit = nl80211_get_reg,
10232                 .policy = nl80211_policy,
10233                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10234                 /* can be retrieved by unprivileged users */
10235         },
10236         {
10237                 .cmd = NL80211_CMD_SET_REG,
10238                 .doit = nl80211_set_reg,
10239                 .policy = nl80211_policy,
10240                 .flags = GENL_ADMIN_PERM,
10241                 .internal_flags = NL80211_FLAG_NEED_RTNL,
10242         },
10243         {
10244                 .cmd = NL80211_CMD_REQ_SET_REG,
10245                 .doit = nl80211_req_set_reg,
10246                 .policy = nl80211_policy,
10247                 .flags = GENL_ADMIN_PERM,
10248         },
10249         {
10250                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
10251                 .doit = nl80211_get_mesh_config,
10252                 .policy = nl80211_policy,
10253                 /* can be retrieved by unprivileged users */
10254                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10255                                   NL80211_FLAG_NEED_RTNL,
10256         },
10257         {
10258                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
10259                 .doit = nl80211_update_mesh_config,
10260                 .policy = nl80211_policy,
10261                 .flags = GENL_ADMIN_PERM,
10262                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10263                                   NL80211_FLAG_NEED_RTNL,
10264         },
10265         {
10266                 .cmd = NL80211_CMD_TRIGGER_SCAN,
10267                 .doit = nl80211_trigger_scan,
10268                 .policy = nl80211_policy,
10269                 .flags = GENL_ADMIN_PERM,
10270                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10271                                   NL80211_FLAG_NEED_RTNL,
10272         },
10273         {
10274                 .cmd = NL80211_CMD_GET_SCAN,
10275                 .policy = nl80211_policy,
10276                 .dumpit = nl80211_dump_scan,
10277         },
10278         {
10279                 .cmd = NL80211_CMD_START_SCHED_SCAN,
10280                 .doit = nl80211_start_sched_scan,
10281                 .policy = nl80211_policy,
10282                 .flags = GENL_ADMIN_PERM,
10283                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10284                                   NL80211_FLAG_NEED_RTNL,
10285         },
10286         {
10287                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
10288                 .doit = nl80211_stop_sched_scan,
10289                 .policy = nl80211_policy,
10290                 .flags = GENL_ADMIN_PERM,
10291                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10292                                   NL80211_FLAG_NEED_RTNL,
10293         },
10294         {
10295                 .cmd = NL80211_CMD_AUTHENTICATE,
10296                 .doit = nl80211_authenticate,
10297                 .policy = nl80211_policy,
10298                 .flags = GENL_ADMIN_PERM,
10299                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10300                                   NL80211_FLAG_NEED_RTNL |
10301                                   NL80211_FLAG_CLEAR_SKB,
10302         },
10303         {
10304                 .cmd = NL80211_CMD_ASSOCIATE,
10305                 .doit = nl80211_associate,
10306                 .policy = nl80211_policy,
10307                 .flags = GENL_ADMIN_PERM,
10308                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10309                                   NL80211_FLAG_NEED_RTNL,
10310         },
10311         {
10312                 .cmd = NL80211_CMD_DEAUTHENTICATE,
10313                 .doit = nl80211_deauthenticate,
10314                 .policy = nl80211_policy,
10315                 .flags = GENL_ADMIN_PERM,
10316                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10317                                   NL80211_FLAG_NEED_RTNL,
10318         },
10319         {
10320                 .cmd = NL80211_CMD_DISASSOCIATE,
10321                 .doit = nl80211_disassociate,
10322                 .policy = nl80211_policy,
10323                 .flags = GENL_ADMIN_PERM,
10324                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10325                                   NL80211_FLAG_NEED_RTNL,
10326         },
10327         {
10328                 .cmd = NL80211_CMD_JOIN_IBSS,
10329                 .doit = nl80211_join_ibss,
10330                 .policy = nl80211_policy,
10331                 .flags = GENL_ADMIN_PERM,
10332                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10333                                   NL80211_FLAG_NEED_RTNL,
10334         },
10335         {
10336                 .cmd = NL80211_CMD_LEAVE_IBSS,
10337                 .doit = nl80211_leave_ibss,
10338                 .policy = nl80211_policy,
10339                 .flags = GENL_ADMIN_PERM,
10340                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10341                                   NL80211_FLAG_NEED_RTNL,
10342         },
10343 #ifdef CONFIG_NL80211_TESTMODE
10344         {
10345                 .cmd = NL80211_CMD_TESTMODE,
10346                 .doit = nl80211_testmode_do,
10347                 .dumpit = nl80211_testmode_dump,
10348                 .policy = nl80211_policy,
10349                 .flags = GENL_ADMIN_PERM,
10350                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10351                                   NL80211_FLAG_NEED_RTNL,
10352         },
10353 #endif
10354         {
10355                 .cmd = NL80211_CMD_CONNECT,
10356                 .doit = nl80211_connect,
10357                 .policy = nl80211_policy,
10358                 .flags = GENL_ADMIN_PERM,
10359                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10360                                   NL80211_FLAG_NEED_RTNL,
10361         },
10362         {
10363                 .cmd = NL80211_CMD_DISCONNECT,
10364                 .doit = nl80211_disconnect,
10365                 .policy = nl80211_policy,
10366                 .flags = GENL_ADMIN_PERM,
10367                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10368                                   NL80211_FLAG_NEED_RTNL,
10369         },
10370         {
10371                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
10372                 .doit = nl80211_wiphy_netns,
10373                 .policy = nl80211_policy,
10374                 .flags = GENL_ADMIN_PERM,
10375                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10376                                   NL80211_FLAG_NEED_RTNL,
10377         },
10378         {
10379                 .cmd = NL80211_CMD_GET_SURVEY,
10380                 .policy = nl80211_policy,
10381                 .dumpit = nl80211_dump_survey,
10382         },
10383         {
10384                 .cmd = NL80211_CMD_SET_PMKSA,
10385                 .doit = nl80211_setdel_pmksa,
10386                 .policy = nl80211_policy,
10387                 .flags = GENL_ADMIN_PERM,
10388                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10389                                   NL80211_FLAG_NEED_RTNL,
10390         },
10391         {
10392                 .cmd = NL80211_CMD_DEL_PMKSA,
10393                 .doit = nl80211_setdel_pmksa,
10394                 .policy = nl80211_policy,
10395                 .flags = GENL_ADMIN_PERM,
10396                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10397                                   NL80211_FLAG_NEED_RTNL,
10398         },
10399         {
10400                 .cmd = NL80211_CMD_FLUSH_PMKSA,
10401                 .doit = nl80211_flush_pmksa,
10402                 .policy = nl80211_policy,
10403                 .flags = GENL_ADMIN_PERM,
10404                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10405                                   NL80211_FLAG_NEED_RTNL,
10406         },
10407         {
10408                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
10409                 .doit = nl80211_remain_on_channel,
10410                 .policy = nl80211_policy,
10411                 .flags = GENL_ADMIN_PERM,
10412                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10413                                   NL80211_FLAG_NEED_RTNL,
10414         },
10415         {
10416                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10417                 .doit = nl80211_cancel_remain_on_channel,
10418                 .policy = nl80211_policy,
10419                 .flags = GENL_ADMIN_PERM,
10420                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10421                                   NL80211_FLAG_NEED_RTNL,
10422         },
10423         {
10424                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
10425                 .doit = nl80211_set_tx_bitrate_mask,
10426                 .policy = nl80211_policy,
10427                 .flags = GENL_ADMIN_PERM,
10428                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10429                                   NL80211_FLAG_NEED_RTNL,
10430         },
10431         {
10432                 .cmd = NL80211_CMD_REGISTER_FRAME,
10433                 .doit = nl80211_register_mgmt,
10434                 .policy = nl80211_policy,
10435                 .flags = GENL_ADMIN_PERM,
10436                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10437                                   NL80211_FLAG_NEED_RTNL,
10438         },
10439         {
10440                 .cmd = NL80211_CMD_FRAME,
10441                 .doit = nl80211_tx_mgmt,
10442                 .policy = nl80211_policy,
10443                 .flags = GENL_ADMIN_PERM,
10444                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10445                                   NL80211_FLAG_NEED_RTNL,
10446         },
10447         {
10448                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
10449                 .doit = nl80211_tx_mgmt_cancel_wait,
10450                 .policy = nl80211_policy,
10451                 .flags = GENL_ADMIN_PERM,
10452                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10453                                   NL80211_FLAG_NEED_RTNL,
10454         },
10455         {
10456                 .cmd = NL80211_CMD_SET_POWER_SAVE,
10457                 .doit = nl80211_set_power_save,
10458                 .policy = nl80211_policy,
10459                 .flags = GENL_ADMIN_PERM,
10460                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10461                                   NL80211_FLAG_NEED_RTNL,
10462         },
10463         {
10464                 .cmd = NL80211_CMD_GET_POWER_SAVE,
10465                 .doit = nl80211_get_power_save,
10466                 .policy = nl80211_policy,
10467                 /* can be retrieved by unprivileged users */
10468                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10469                                   NL80211_FLAG_NEED_RTNL,
10470         },
10471         {
10472                 .cmd = NL80211_CMD_SET_CQM,
10473                 .doit = nl80211_set_cqm,
10474                 .policy = nl80211_policy,
10475                 .flags = GENL_ADMIN_PERM,
10476                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10477                                   NL80211_FLAG_NEED_RTNL,
10478         },
10479         {
10480                 .cmd = NL80211_CMD_SET_CHANNEL,
10481                 .doit = nl80211_set_channel,
10482                 .policy = nl80211_policy,
10483                 .flags = GENL_ADMIN_PERM,
10484                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10485                                   NL80211_FLAG_NEED_RTNL,
10486         },
10487         {
10488                 .cmd = NL80211_CMD_SET_WDS_PEER,
10489                 .doit = nl80211_set_wds_peer,
10490                 .policy = nl80211_policy,
10491                 .flags = GENL_ADMIN_PERM,
10492                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10493                                   NL80211_FLAG_NEED_RTNL,
10494         },
10495         {
10496                 .cmd = NL80211_CMD_JOIN_MESH,
10497                 .doit = nl80211_join_mesh,
10498                 .policy = nl80211_policy,
10499                 .flags = GENL_ADMIN_PERM,
10500                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10501                                   NL80211_FLAG_NEED_RTNL,
10502         },
10503         {
10504                 .cmd = NL80211_CMD_LEAVE_MESH,
10505                 .doit = nl80211_leave_mesh,
10506                 .policy = nl80211_policy,
10507                 .flags = GENL_ADMIN_PERM,
10508                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10509                                   NL80211_FLAG_NEED_RTNL,
10510         },
10511         {
10512                 .cmd = NL80211_CMD_JOIN_OCB,
10513                 .doit = nl80211_join_ocb,
10514                 .policy = nl80211_policy,
10515                 .flags = GENL_ADMIN_PERM,
10516                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10517                                   NL80211_FLAG_NEED_RTNL,
10518         },
10519         {
10520                 .cmd = NL80211_CMD_LEAVE_OCB,
10521                 .doit = nl80211_leave_ocb,
10522                 .policy = nl80211_policy,
10523                 .flags = GENL_ADMIN_PERM,
10524                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10525                                   NL80211_FLAG_NEED_RTNL,
10526         },
10527 #ifdef CONFIG_PM
10528         {
10529                 .cmd = NL80211_CMD_GET_WOWLAN,
10530                 .doit = nl80211_get_wowlan,
10531                 .policy = nl80211_policy,
10532                 /* can be retrieved by unprivileged users */
10533                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10534                                   NL80211_FLAG_NEED_RTNL,
10535         },
10536         {
10537                 .cmd = NL80211_CMD_SET_WOWLAN,
10538                 .doit = nl80211_set_wowlan,
10539                 .policy = nl80211_policy,
10540                 .flags = GENL_ADMIN_PERM,
10541                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10542                                   NL80211_FLAG_NEED_RTNL,
10543         },
10544 #endif
10545         {
10546                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
10547                 .doit = nl80211_set_rekey_data,
10548                 .policy = nl80211_policy,
10549                 .flags = GENL_ADMIN_PERM,
10550                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10551                                   NL80211_FLAG_NEED_RTNL |
10552                                   NL80211_FLAG_CLEAR_SKB,
10553         },
10554         {
10555                 .cmd = NL80211_CMD_TDLS_MGMT,
10556                 .doit = nl80211_tdls_mgmt,
10557                 .policy = nl80211_policy,
10558                 .flags = GENL_ADMIN_PERM,
10559                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10560                                   NL80211_FLAG_NEED_RTNL,
10561         },
10562         {
10563                 .cmd = NL80211_CMD_TDLS_OPER,
10564                 .doit = nl80211_tdls_oper,
10565                 .policy = nl80211_policy,
10566                 .flags = GENL_ADMIN_PERM,
10567                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10568                                   NL80211_FLAG_NEED_RTNL,
10569         },
10570         {
10571                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
10572                 .doit = nl80211_register_unexpected_frame,
10573                 .policy = nl80211_policy,
10574                 .flags = GENL_ADMIN_PERM,
10575                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10576                                   NL80211_FLAG_NEED_RTNL,
10577         },
10578         {
10579                 .cmd = NL80211_CMD_PROBE_CLIENT,
10580                 .doit = nl80211_probe_client,
10581                 .policy = nl80211_policy,
10582                 .flags = GENL_ADMIN_PERM,
10583                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10584                                   NL80211_FLAG_NEED_RTNL,
10585         },
10586         {
10587                 .cmd = NL80211_CMD_REGISTER_BEACONS,
10588                 .doit = nl80211_register_beacons,
10589                 .policy = nl80211_policy,
10590                 .flags = GENL_ADMIN_PERM,
10591                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10592                                   NL80211_FLAG_NEED_RTNL,
10593         },
10594         {
10595                 .cmd = NL80211_CMD_SET_NOACK_MAP,
10596                 .doit = nl80211_set_noack_map,
10597                 .policy = nl80211_policy,
10598                 .flags = GENL_ADMIN_PERM,
10599                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10600                                   NL80211_FLAG_NEED_RTNL,
10601         },
10602         {
10603                 .cmd = NL80211_CMD_START_P2P_DEVICE,
10604                 .doit = nl80211_start_p2p_device,
10605                 .policy = nl80211_policy,
10606                 .flags = GENL_ADMIN_PERM,
10607                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10608                                   NL80211_FLAG_NEED_RTNL,
10609         },
10610         {
10611                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
10612                 .doit = nl80211_stop_p2p_device,
10613                 .policy = nl80211_policy,
10614                 .flags = GENL_ADMIN_PERM,
10615                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10616                                   NL80211_FLAG_NEED_RTNL,
10617         },
10618         {
10619                 .cmd = NL80211_CMD_SET_MCAST_RATE,
10620                 .doit = nl80211_set_mcast_rate,
10621                 .policy = nl80211_policy,
10622                 .flags = GENL_ADMIN_PERM,
10623                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10624                                   NL80211_FLAG_NEED_RTNL,
10625         },
10626         {
10627                 .cmd = NL80211_CMD_SET_MAC_ACL,
10628                 .doit = nl80211_set_mac_acl,
10629                 .policy = nl80211_policy,
10630                 .flags = GENL_ADMIN_PERM,
10631                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10632                                   NL80211_FLAG_NEED_RTNL,
10633         },
10634         {
10635                 .cmd = NL80211_CMD_RADAR_DETECT,
10636                 .doit = nl80211_start_radar_detection,
10637                 .policy = nl80211_policy,
10638                 .flags = GENL_ADMIN_PERM,
10639                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10640                                   NL80211_FLAG_NEED_RTNL,
10641         },
10642         {
10643                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
10644                 .doit = nl80211_get_protocol_features,
10645                 .policy = nl80211_policy,
10646         },
10647         {
10648                 .cmd = NL80211_CMD_UPDATE_FT_IES,
10649                 .doit = nl80211_update_ft_ies,
10650                 .policy = nl80211_policy,
10651                 .flags = GENL_ADMIN_PERM,
10652                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10653                                   NL80211_FLAG_NEED_RTNL,
10654         },
10655         {
10656                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
10657                 .doit = nl80211_crit_protocol_start,
10658                 .policy = nl80211_policy,
10659                 .flags = GENL_ADMIN_PERM,
10660                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10661                                   NL80211_FLAG_NEED_RTNL,
10662         },
10663         {
10664                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
10665                 .doit = nl80211_crit_protocol_stop,
10666                 .policy = nl80211_policy,
10667                 .flags = GENL_ADMIN_PERM,
10668                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10669                                   NL80211_FLAG_NEED_RTNL,
10670         },
10671         {
10672                 .cmd = NL80211_CMD_GET_COALESCE,
10673                 .doit = nl80211_get_coalesce,
10674                 .policy = nl80211_policy,
10675                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10676                                   NL80211_FLAG_NEED_RTNL,
10677         },
10678         {
10679                 .cmd = NL80211_CMD_SET_COALESCE,
10680                 .doit = nl80211_set_coalesce,
10681                 .policy = nl80211_policy,
10682                 .flags = GENL_ADMIN_PERM,
10683                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10684                                   NL80211_FLAG_NEED_RTNL,
10685         },
10686         {
10687                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
10688                 .doit = nl80211_channel_switch,
10689                 .policy = nl80211_policy,
10690                 .flags = GENL_ADMIN_PERM,
10691                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10692                                   NL80211_FLAG_NEED_RTNL,
10693         },
10694         {
10695                 .cmd = NL80211_CMD_VENDOR,
10696                 .doit = nl80211_vendor_cmd,
10697                 .policy = nl80211_policy,
10698                 .flags = GENL_ADMIN_PERM,
10699                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10700                                   NL80211_FLAG_NEED_RTNL,
10701         },
10702         {
10703                 .cmd = NL80211_CMD_SET_QOS_MAP,
10704                 .doit = nl80211_set_qos_map,
10705                 .policy = nl80211_policy,
10706                 .flags = GENL_ADMIN_PERM,
10707                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10708                                   NL80211_FLAG_NEED_RTNL,
10709         },
10710         {
10711                 .cmd = NL80211_CMD_ADD_TX_TS,
10712                 .doit = nl80211_add_tx_ts,
10713                 .policy = nl80211_policy,
10714                 .flags = GENL_ADMIN_PERM,
10715                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10716                                   NL80211_FLAG_NEED_RTNL,
10717         },
10718         {
10719                 .cmd = NL80211_CMD_DEL_TX_TS,
10720                 .doit = nl80211_del_tx_ts,
10721                 .policy = nl80211_policy,
10722                 .flags = GENL_ADMIN_PERM,
10723                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10724                                   NL80211_FLAG_NEED_RTNL,
10725         },
10726         {
10727                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
10728                 .doit = nl80211_tdls_channel_switch,
10729                 .policy = nl80211_policy,
10730                 .flags = GENL_ADMIN_PERM,
10731                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10732                                   NL80211_FLAG_NEED_RTNL,
10733         },
10734         {
10735                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
10736                 .doit = nl80211_tdls_cancel_channel_switch,
10737                 .policy = nl80211_policy,
10738                 .flags = GENL_ADMIN_PERM,
10739                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10740                                   NL80211_FLAG_NEED_RTNL,
10741         },
10742 };
10743
10744 /* notification functions */
10745
10746 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
10747                           enum nl80211_commands cmd)
10748 {
10749         struct sk_buff *msg;
10750         struct nl80211_dump_wiphy_state state = {};
10751
10752         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
10753                 cmd != NL80211_CMD_DEL_WIPHY);
10754
10755         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10756         if (!msg)
10757                 return;
10758
10759         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
10760                 nlmsg_free(msg);
10761                 return;
10762         }
10763
10764         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10765                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
10766 }
10767
10768 static int nl80211_add_scan_req(struct sk_buff *msg,
10769                                 struct cfg80211_registered_device *rdev)
10770 {
10771         struct cfg80211_scan_request *req = rdev->scan_req;
10772         struct nlattr *nest;
10773         int i;
10774
10775         if (WARN_ON(!req))
10776                 return 0;
10777
10778         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
10779         if (!nest)
10780                 goto nla_put_failure;
10781         for (i = 0; i < req->n_ssids; i++) {
10782                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
10783                         goto nla_put_failure;
10784         }
10785         nla_nest_end(msg, nest);
10786
10787         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10788         if (!nest)
10789                 goto nla_put_failure;
10790         for (i = 0; i < req->n_channels; i++) {
10791                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10792                         goto nla_put_failure;
10793         }
10794         nla_nest_end(msg, nest);
10795
10796         if (req->ie &&
10797             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
10798                 goto nla_put_failure;
10799
10800         if (req->flags &&
10801             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
10802                 goto nla_put_failure;
10803
10804         return 0;
10805  nla_put_failure:
10806         return -ENOBUFS;
10807 }
10808
10809 static int nl80211_send_scan_msg(struct sk_buff *msg,
10810                                  struct cfg80211_registered_device *rdev,
10811                                  struct wireless_dev *wdev,
10812                                  u32 portid, u32 seq, int flags,
10813                                  u32 cmd)
10814 {
10815         void *hdr;
10816
10817         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10818         if (!hdr)
10819                 return -1;
10820
10821         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10822             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10823                                          wdev->netdev->ifindex)) ||
10824             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10825                 goto nla_put_failure;
10826
10827         /* ignore errors and send incomplete event anyway */
10828         nl80211_add_scan_req(msg, rdev);
10829
10830         return genlmsg_end(msg, hdr);
10831
10832  nla_put_failure:
10833         genlmsg_cancel(msg, hdr);
10834         return -EMSGSIZE;
10835 }
10836
10837 static int
10838 nl80211_send_sched_scan_msg(struct sk_buff *msg,
10839                             struct cfg80211_registered_device *rdev,
10840                             struct net_device *netdev,
10841                             u32 portid, u32 seq, int flags, u32 cmd)
10842 {
10843         void *hdr;
10844
10845         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10846         if (!hdr)
10847                 return -1;
10848
10849         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10850             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10851                 goto nla_put_failure;
10852
10853         return genlmsg_end(msg, hdr);
10854
10855  nla_put_failure:
10856         genlmsg_cancel(msg, hdr);
10857         return -EMSGSIZE;
10858 }
10859
10860 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
10861                              struct wireless_dev *wdev)
10862 {
10863         struct sk_buff *msg;
10864
10865         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10866         if (!msg)
10867                 return;
10868
10869         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10870                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
10871                 nlmsg_free(msg);
10872                 return;
10873         }
10874
10875         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10876                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10877 }
10878
10879 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
10880                                        struct wireless_dev *wdev, bool aborted)
10881 {
10882         struct sk_buff *msg;
10883
10884         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10885         if (!msg)
10886                 return NULL;
10887
10888         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10889                                   aborted ? NL80211_CMD_SCAN_ABORTED :
10890                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
10891                 nlmsg_free(msg);
10892                 return NULL;
10893         }
10894
10895         return msg;
10896 }
10897
10898 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
10899                               struct sk_buff *msg)
10900 {
10901         if (!msg)
10902                 return;
10903
10904         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10905                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10906 }
10907
10908 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
10909                                      struct net_device *netdev)
10910 {
10911         struct sk_buff *msg;
10912
10913         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10914         if (!msg)
10915                 return;
10916
10917         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
10918                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
10919                 nlmsg_free(msg);
10920                 return;
10921         }
10922
10923         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10924                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10925 }
10926
10927 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
10928                              struct net_device *netdev, u32 cmd)
10929 {
10930         struct sk_buff *msg;
10931
10932         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10933         if (!msg)
10934                 return;
10935
10936         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
10937                 nlmsg_free(msg);
10938                 return;
10939         }
10940
10941         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10942                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10943 }
10944
10945 /*
10946  * This can happen on global regulatory changes or device specific settings
10947  * based on custom world regulatory domains.
10948  */
10949 void nl80211_send_reg_change_event(struct regulatory_request *request)
10950 {
10951         struct sk_buff *msg;
10952         void *hdr;
10953
10954         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10955         if (!msg)
10956                 return;
10957
10958         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
10959         if (!hdr) {
10960                 nlmsg_free(msg);
10961                 return;
10962         }
10963
10964         /* Userspace can always count this one always being set */
10965         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
10966                 goto nla_put_failure;
10967
10968         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
10969                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10970                                NL80211_REGDOM_TYPE_WORLD))
10971                         goto nla_put_failure;
10972         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
10973                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10974                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
10975                         goto nla_put_failure;
10976         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
10977                    request->intersect) {
10978                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10979                                NL80211_REGDOM_TYPE_INTERSECTION))
10980                         goto nla_put_failure;
10981         } else {
10982                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10983                                NL80211_REGDOM_TYPE_COUNTRY) ||
10984                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
10985                                    request->alpha2))
10986                         goto nla_put_failure;
10987         }
10988
10989         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
10990             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
10991                 goto nla_put_failure;
10992
10993         genlmsg_end(msg, hdr);
10994
10995         rcu_read_lock();
10996         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10997                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10998         rcu_read_unlock();
10999
11000         return;
11001
11002 nla_put_failure:
11003         genlmsg_cancel(msg, hdr);
11004         nlmsg_free(msg);
11005 }
11006
11007 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
11008                                     struct net_device *netdev,
11009                                     const u8 *buf, size_t len,
11010                                     enum nl80211_commands cmd, gfp_t gfp,
11011                                     int uapsd_queues)
11012 {
11013         struct sk_buff *msg;
11014         void *hdr;
11015
11016         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11017         if (!msg)
11018                 return;
11019
11020         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11021         if (!hdr) {
11022                 nlmsg_free(msg);
11023                 return;
11024         }
11025
11026         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11027             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11028             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
11029                 goto nla_put_failure;
11030
11031         if (uapsd_queues >= 0) {
11032                 struct nlattr *nla_wmm =
11033                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
11034                 if (!nla_wmm)
11035                         goto nla_put_failure;
11036
11037                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
11038                                uapsd_queues))
11039                         goto nla_put_failure;
11040
11041                 nla_nest_end(msg, nla_wmm);
11042         }
11043
11044         genlmsg_end(msg, hdr);
11045
11046         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11047                                 NL80211_MCGRP_MLME, gfp);
11048         return;
11049
11050  nla_put_failure:
11051         genlmsg_cancel(msg, hdr);
11052         nlmsg_free(msg);
11053 }
11054
11055 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
11056                           struct net_device *netdev, const u8 *buf,
11057                           size_t len, gfp_t gfp)
11058 {
11059         nl80211_send_mlme_event(rdev, netdev, buf, len,
11060                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
11061 }
11062
11063 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
11064                            struct net_device *netdev, const u8 *buf,
11065                            size_t len, gfp_t gfp, int uapsd_queues)
11066 {
11067         nl80211_send_mlme_event(rdev, netdev, buf, len,
11068                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
11069 }
11070
11071 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
11072                          struct net_device *netdev, const u8 *buf,
11073                          size_t len, gfp_t gfp)
11074 {
11075         nl80211_send_mlme_event(rdev, netdev, buf, len,
11076                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
11077 }
11078
11079 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
11080                            struct net_device *netdev, const u8 *buf,
11081                            size_t len, gfp_t gfp)
11082 {
11083         nl80211_send_mlme_event(rdev, netdev, buf, len,
11084                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
11085 }
11086
11087 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
11088                                   size_t len)
11089 {
11090         struct wireless_dev *wdev = dev->ieee80211_ptr;
11091         struct wiphy *wiphy = wdev->wiphy;
11092         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11093         const struct ieee80211_mgmt *mgmt = (void *)buf;
11094         u32 cmd;
11095
11096         if (WARN_ON(len < 2))
11097                 return;
11098
11099         if (ieee80211_is_deauth(mgmt->frame_control))
11100                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
11101         else
11102                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
11103
11104         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
11105         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
11106 }
11107 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
11108
11109 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
11110                                       struct net_device *netdev, int cmd,
11111                                       const u8 *addr, gfp_t gfp)
11112 {
11113         struct sk_buff *msg;
11114         void *hdr;
11115
11116         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11117         if (!msg)
11118                 return;
11119
11120         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11121         if (!hdr) {
11122                 nlmsg_free(msg);
11123                 return;
11124         }
11125
11126         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11127             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11128             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
11129             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
11130                 goto nla_put_failure;
11131
11132         genlmsg_end(msg, hdr);
11133
11134         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11135                                 NL80211_MCGRP_MLME, gfp);
11136         return;
11137
11138  nla_put_failure:
11139         genlmsg_cancel(msg, hdr);
11140         nlmsg_free(msg);
11141 }
11142
11143 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
11144                                struct net_device *netdev, const u8 *addr,
11145                                gfp_t gfp)
11146 {
11147         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
11148                                   addr, gfp);
11149 }
11150
11151 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
11152                                 struct net_device *netdev, const u8 *addr,
11153                                 gfp_t gfp)
11154 {
11155         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
11156                                   addr, gfp);
11157 }
11158
11159 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
11160                                  struct net_device *netdev, const u8 *bssid,
11161                                  const u8 *req_ie, size_t req_ie_len,
11162                                  const u8 *resp_ie, size_t resp_ie_len,
11163                                  u16 status, gfp_t gfp)
11164 {
11165         struct sk_buff *msg;
11166         void *hdr;
11167
11168         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11169         if (!msg)
11170                 return;
11171
11172         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
11173         if (!hdr) {
11174                 nlmsg_free(msg);
11175                 return;
11176         }
11177
11178         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11179             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11180             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
11181             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
11182             (req_ie &&
11183              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
11184             (resp_ie &&
11185              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
11186                 goto nla_put_failure;
11187
11188         genlmsg_end(msg, hdr);
11189
11190         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11191                                 NL80211_MCGRP_MLME, gfp);
11192         return;
11193
11194  nla_put_failure:
11195         genlmsg_cancel(msg, hdr);
11196         nlmsg_free(msg);
11197
11198 }
11199
11200 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
11201                          struct net_device *netdev, const u8 *bssid,
11202                          const u8 *req_ie, size_t req_ie_len,
11203                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
11204 {
11205         struct sk_buff *msg;
11206         void *hdr;
11207
11208         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11209         if (!msg)
11210                 return;
11211
11212         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
11213         if (!hdr) {
11214                 nlmsg_free(msg);
11215                 return;
11216         }
11217
11218         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11219             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11220             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
11221             (req_ie &&
11222              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
11223             (resp_ie &&
11224              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
11225                 goto nla_put_failure;
11226
11227         genlmsg_end(msg, hdr);
11228
11229         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11230                                 NL80211_MCGRP_MLME, gfp);
11231         return;
11232
11233  nla_put_failure:
11234         genlmsg_cancel(msg, hdr);
11235         nlmsg_free(msg);
11236
11237 }
11238
11239 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
11240                                struct net_device *netdev, u16 reason,
11241                                const u8 *ie, size_t ie_len, bool from_ap)
11242 {
11243         struct sk_buff *msg;
11244         void *hdr;
11245
11246         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11247         if (!msg)
11248                 return;
11249
11250         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
11251         if (!hdr) {
11252                 nlmsg_free(msg);
11253                 return;
11254         }
11255
11256         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11257             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11258             (from_ap && reason &&
11259              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
11260             (from_ap &&
11261              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
11262             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
11263                 goto nla_put_failure;
11264
11265         genlmsg_end(msg, hdr);
11266
11267         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11268                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11269         return;
11270
11271  nla_put_failure:
11272         genlmsg_cancel(msg, hdr);
11273         nlmsg_free(msg);
11274
11275 }
11276
11277 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
11278                              struct net_device *netdev, const u8 *bssid,
11279                              gfp_t gfp)
11280 {
11281         struct sk_buff *msg;
11282         void *hdr;
11283
11284         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11285         if (!msg)
11286                 return;
11287
11288         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
11289         if (!hdr) {
11290                 nlmsg_free(msg);
11291                 return;
11292         }
11293
11294         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11295             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11296             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11297                 goto nla_put_failure;
11298
11299         genlmsg_end(msg, hdr);
11300
11301         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11302                                 NL80211_MCGRP_MLME, gfp);
11303         return;
11304
11305  nla_put_failure:
11306         genlmsg_cancel(msg, hdr);
11307         nlmsg_free(msg);
11308 }
11309
11310 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
11311                                         const u8* ie, u8 ie_len, gfp_t gfp)
11312 {
11313         struct wireless_dev *wdev = dev->ieee80211_ptr;
11314         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11315         struct sk_buff *msg;
11316         void *hdr;
11317
11318         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11319                 return;
11320
11321         trace_cfg80211_notify_new_peer_candidate(dev, addr);
11322
11323         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11324         if (!msg)
11325                 return;
11326
11327         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
11328         if (!hdr) {
11329                 nlmsg_free(msg);
11330                 return;
11331         }
11332
11333         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11334             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11335             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11336             (ie_len && ie &&
11337              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
11338                 goto nla_put_failure;
11339
11340         genlmsg_end(msg, hdr);
11341
11342         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11343                                 NL80211_MCGRP_MLME, gfp);
11344         return;
11345
11346  nla_put_failure:
11347         genlmsg_cancel(msg, hdr);
11348         nlmsg_free(msg);
11349 }
11350 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
11351
11352 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
11353                                  struct net_device *netdev, const u8 *addr,
11354                                  enum nl80211_key_type key_type, int key_id,
11355                                  const u8 *tsc, gfp_t gfp)
11356 {
11357         struct sk_buff *msg;
11358         void *hdr;
11359
11360         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11361         if (!msg)
11362                 return;
11363
11364         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
11365         if (!hdr) {
11366                 nlmsg_free(msg);
11367                 return;
11368         }
11369
11370         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11371             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11372             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
11373             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
11374             (key_id != -1 &&
11375              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
11376             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
11377                 goto nla_put_failure;
11378
11379         genlmsg_end(msg, hdr);
11380
11381         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11382                                 NL80211_MCGRP_MLME, gfp);
11383         return;
11384
11385  nla_put_failure:
11386         genlmsg_cancel(msg, hdr);
11387         nlmsg_free(msg);
11388 }
11389
11390 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
11391                                     struct ieee80211_channel *channel_before,
11392                                     struct ieee80211_channel *channel_after)
11393 {
11394         struct sk_buff *msg;
11395         void *hdr;
11396         struct nlattr *nl_freq;
11397
11398         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
11399         if (!msg)
11400                 return;
11401
11402         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
11403         if (!hdr) {
11404                 nlmsg_free(msg);
11405                 return;
11406         }
11407
11408         /*
11409          * Since we are applying the beacon hint to a wiphy we know its
11410          * wiphy_idx is valid
11411          */
11412         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
11413                 goto nla_put_failure;
11414
11415         /* Before */
11416         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
11417         if (!nl_freq)
11418                 goto nla_put_failure;
11419         if (nl80211_msg_put_channel(msg, channel_before, false))
11420                 goto nla_put_failure;
11421         nla_nest_end(msg, nl_freq);
11422
11423         /* After */
11424         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
11425         if (!nl_freq)
11426                 goto nla_put_failure;
11427         if (nl80211_msg_put_channel(msg, channel_after, false))
11428                 goto nla_put_failure;
11429         nla_nest_end(msg, nl_freq);
11430
11431         genlmsg_end(msg, hdr);
11432
11433         rcu_read_lock();
11434         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
11435                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
11436         rcu_read_unlock();
11437
11438         return;
11439
11440 nla_put_failure:
11441         genlmsg_cancel(msg, hdr);
11442         nlmsg_free(msg);
11443 }
11444
11445 static void nl80211_send_remain_on_chan_event(
11446         int cmd, struct cfg80211_registered_device *rdev,
11447         struct wireless_dev *wdev, u64 cookie,
11448         struct ieee80211_channel *chan,
11449         unsigned int duration, gfp_t gfp)
11450 {
11451         struct sk_buff *msg;
11452         void *hdr;
11453
11454         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11455         if (!msg)
11456                 return;
11457
11458         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11459         if (!hdr) {
11460                 nlmsg_free(msg);
11461                 return;
11462         }
11463
11464         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11465             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11466                                          wdev->netdev->ifindex)) ||
11467             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11468             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
11469             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
11470                         NL80211_CHAN_NO_HT) ||
11471             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
11472                 goto nla_put_failure;
11473
11474         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
11475             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
11476                 goto nla_put_failure;
11477
11478         genlmsg_end(msg, hdr);
11479
11480         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11481                                 NL80211_MCGRP_MLME, gfp);
11482         return;
11483
11484  nla_put_failure:
11485         genlmsg_cancel(msg, hdr);
11486         nlmsg_free(msg);
11487 }
11488
11489 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
11490                                struct ieee80211_channel *chan,
11491                                unsigned int duration, gfp_t gfp)
11492 {
11493         struct wiphy *wiphy = wdev->wiphy;
11494         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11495
11496         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
11497         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
11498                                           rdev, wdev, cookie, chan,
11499                                           duration, gfp);
11500 }
11501 EXPORT_SYMBOL(cfg80211_ready_on_channel);
11502
11503 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
11504                                         struct ieee80211_channel *chan,
11505                                         gfp_t gfp)
11506 {
11507         struct wiphy *wiphy = wdev->wiphy;
11508         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11509
11510         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
11511         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
11512                                           rdev, wdev, cookie, chan, 0, gfp);
11513 }
11514 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
11515
11516 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
11517                       struct station_info *sinfo, gfp_t gfp)
11518 {
11519         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11520         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11521         struct sk_buff *msg;
11522
11523         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
11524
11525         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11526         if (!msg)
11527                 return;
11528
11529         if (nl80211_send_station(msg, 0, 0, 0,
11530                                  rdev, dev, mac_addr, sinfo) < 0) {
11531                 nlmsg_free(msg);
11532                 return;
11533         }
11534
11535         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11536                                 NL80211_MCGRP_MLME, gfp);
11537 }
11538 EXPORT_SYMBOL(cfg80211_new_sta);
11539
11540 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
11541 {
11542         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11543         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11544         struct sk_buff *msg;
11545         void *hdr;
11546
11547         trace_cfg80211_del_sta(dev, mac_addr);
11548
11549         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11550         if (!msg)
11551                 return;
11552
11553         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
11554         if (!hdr) {
11555                 nlmsg_free(msg);
11556                 return;
11557         }
11558
11559         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11560             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
11561                 goto nla_put_failure;
11562
11563         genlmsg_end(msg, hdr);
11564
11565         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11566                                 NL80211_MCGRP_MLME, gfp);
11567         return;
11568
11569  nla_put_failure:
11570         genlmsg_cancel(msg, hdr);
11571         nlmsg_free(msg);
11572 }
11573 EXPORT_SYMBOL(cfg80211_del_sta);
11574
11575 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
11576                           enum nl80211_connect_failed_reason reason,
11577                           gfp_t gfp)
11578 {
11579         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
11580         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11581         struct sk_buff *msg;
11582         void *hdr;
11583
11584         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11585         if (!msg)
11586                 return;
11587
11588         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
11589         if (!hdr) {
11590                 nlmsg_free(msg);
11591                 return;
11592         }
11593
11594         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11595             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
11596             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
11597                 goto nla_put_failure;
11598
11599         genlmsg_end(msg, hdr);
11600
11601         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11602                                 NL80211_MCGRP_MLME, gfp);
11603         return;
11604
11605  nla_put_failure:
11606         genlmsg_cancel(msg, hdr);
11607         nlmsg_free(msg);
11608 }
11609 EXPORT_SYMBOL(cfg80211_conn_failed);
11610
11611 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
11612                                        const u8 *addr, gfp_t gfp)
11613 {
11614         struct wireless_dev *wdev = dev->ieee80211_ptr;
11615         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11616         struct sk_buff *msg;
11617         void *hdr;
11618         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
11619
11620         if (!nlportid)
11621                 return false;
11622
11623         msg = nlmsg_new(100, gfp);
11624         if (!msg)
11625                 return true;
11626
11627         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
11628         if (!hdr) {
11629                 nlmsg_free(msg);
11630                 return true;
11631         }
11632
11633         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11634             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11635             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
11636                 goto nla_put_failure;
11637
11638         genlmsg_end(msg, hdr);
11639         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11640         return true;
11641
11642  nla_put_failure:
11643         genlmsg_cancel(msg, hdr);
11644         nlmsg_free(msg);
11645         return true;
11646 }
11647
11648 bool cfg80211_rx_spurious_frame(struct net_device *dev,
11649                                 const u8 *addr, gfp_t gfp)
11650 {
11651         struct wireless_dev *wdev = dev->ieee80211_ptr;
11652         bool ret;
11653
11654         trace_cfg80211_rx_spurious_frame(dev, addr);
11655
11656         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11657                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
11658                 trace_cfg80211_return_bool(false);
11659                 return false;
11660         }
11661         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
11662                                          addr, gfp);
11663         trace_cfg80211_return_bool(ret);
11664         return ret;
11665 }
11666 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
11667
11668 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
11669                                         const u8 *addr, gfp_t gfp)
11670 {
11671         struct wireless_dev *wdev = dev->ieee80211_ptr;
11672         bool ret;
11673
11674         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
11675
11676         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11677                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11678                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
11679                 trace_cfg80211_return_bool(false);
11680                 return false;
11681         }
11682         ret = __nl80211_unexpected_frame(dev,
11683                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
11684                                          addr, gfp);
11685         trace_cfg80211_return_bool(ret);
11686         return ret;
11687 }
11688 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
11689
11690 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
11691                       struct wireless_dev *wdev, u32 nlportid,
11692                       int freq, int sig_dbm,
11693                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
11694 {
11695         struct net_device *netdev = wdev->netdev;
11696         struct sk_buff *msg;
11697         void *hdr;
11698
11699         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11700         if (!msg)
11701                 return -ENOMEM;
11702
11703         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11704         if (!hdr) {
11705                 nlmsg_free(msg);
11706                 return -ENOMEM;
11707         }
11708
11709         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11710             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11711                                         netdev->ifindex)) ||
11712             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11713             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
11714             (sig_dbm &&
11715              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11716             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11717             (flags &&
11718              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
11719                 goto nla_put_failure;
11720
11721         genlmsg_end(msg, hdr);
11722
11723         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11724
11725  nla_put_failure:
11726         genlmsg_cancel(msg, hdr);
11727         nlmsg_free(msg);
11728         return -ENOBUFS;
11729 }
11730
11731 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
11732                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
11733 {
11734         struct wiphy *wiphy = wdev->wiphy;
11735         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11736         struct net_device *netdev = wdev->netdev;
11737         struct sk_buff *msg;
11738         void *hdr;
11739
11740         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
11741
11742         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11743         if (!msg)
11744                 return;
11745
11746         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
11747         if (!hdr) {
11748                 nlmsg_free(msg);
11749                 return;
11750         }
11751
11752         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11753             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11754                                    netdev->ifindex)) ||
11755             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11756             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11757             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11758             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
11759                 goto nla_put_failure;
11760
11761         genlmsg_end(msg, hdr);
11762
11763         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11764                                 NL80211_MCGRP_MLME, gfp);
11765         return;
11766
11767  nla_put_failure:
11768         genlmsg_cancel(msg, hdr);
11769         nlmsg_free(msg);
11770 }
11771 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
11772
11773 void cfg80211_cqm_rssi_notify(struct net_device *dev,
11774                               enum nl80211_cqm_rssi_threshold_event rssi_event,
11775                               gfp_t gfp)
11776 {
11777         struct wireless_dev *wdev = dev->ieee80211_ptr;
11778         struct wiphy *wiphy = wdev->wiphy;
11779         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11780         struct sk_buff *msg;
11781         struct nlattr *pinfoattr;
11782         void *hdr;
11783
11784         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
11785
11786         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11787         if (!msg)
11788                 return;
11789
11790         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11791         if (!hdr) {
11792                 nlmsg_free(msg);
11793                 return;
11794         }
11795
11796         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11797             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
11798                 goto nla_put_failure;
11799
11800         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11801         if (!pinfoattr)
11802                 goto nla_put_failure;
11803
11804         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
11805                         rssi_event))
11806                 goto nla_put_failure;
11807
11808         nla_nest_end(msg, pinfoattr);
11809
11810         genlmsg_end(msg, hdr);
11811
11812         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11813                                 NL80211_MCGRP_MLME, gfp);
11814         return;
11815
11816  nla_put_failure:
11817         genlmsg_cancel(msg, hdr);
11818         nlmsg_free(msg);
11819 }
11820 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
11821
11822 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
11823                                      struct net_device *netdev, const u8 *bssid,
11824                                      const u8 *replay_ctr, gfp_t gfp)
11825 {
11826         struct sk_buff *msg;
11827         struct nlattr *rekey_attr;
11828         void *hdr;
11829
11830         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11831         if (!msg)
11832                 return;
11833
11834         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
11835         if (!hdr) {
11836                 nlmsg_free(msg);
11837                 return;
11838         }
11839
11840         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11841             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11842             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11843                 goto nla_put_failure;
11844
11845         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
11846         if (!rekey_attr)
11847                 goto nla_put_failure;
11848
11849         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
11850                     NL80211_REPLAY_CTR_LEN, replay_ctr))
11851                 goto nla_put_failure;
11852
11853         nla_nest_end(msg, rekey_attr);
11854
11855         genlmsg_end(msg, hdr);
11856
11857         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11858                                 NL80211_MCGRP_MLME, gfp);
11859         return;
11860
11861  nla_put_failure:
11862         genlmsg_cancel(msg, hdr);
11863         nlmsg_free(msg);
11864 }
11865
11866 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
11867                                const u8 *replay_ctr, gfp_t gfp)
11868 {
11869         struct wireless_dev *wdev = dev->ieee80211_ptr;
11870         struct wiphy *wiphy = wdev->wiphy;
11871         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11872
11873         trace_cfg80211_gtk_rekey_notify(dev, bssid);
11874         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
11875 }
11876 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
11877
11878 static void
11879 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
11880                                struct net_device *netdev, int index,
11881                                const u8 *bssid, bool preauth, gfp_t gfp)
11882 {
11883         struct sk_buff *msg;
11884         struct nlattr *attr;
11885         void *hdr;
11886
11887         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11888         if (!msg)
11889                 return;
11890
11891         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
11892         if (!hdr) {
11893                 nlmsg_free(msg);
11894                 return;
11895         }
11896
11897         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11898             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11899                 goto nla_put_failure;
11900
11901         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
11902         if (!attr)
11903                 goto nla_put_failure;
11904
11905         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
11906             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
11907             (preauth &&
11908              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
11909                 goto nla_put_failure;
11910
11911         nla_nest_end(msg, attr);
11912
11913         genlmsg_end(msg, hdr);
11914
11915         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11916                                 NL80211_MCGRP_MLME, gfp);
11917         return;
11918
11919  nla_put_failure:
11920         genlmsg_cancel(msg, hdr);
11921         nlmsg_free(msg);
11922 }
11923
11924 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
11925                                      const u8 *bssid, bool preauth, gfp_t gfp)
11926 {
11927         struct wireless_dev *wdev = dev->ieee80211_ptr;
11928         struct wiphy *wiphy = wdev->wiphy;
11929         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11930
11931         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
11932         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
11933 }
11934 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
11935
11936 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
11937                                      struct net_device *netdev,
11938                                      struct cfg80211_chan_def *chandef,
11939                                      gfp_t gfp,
11940                                      enum nl80211_commands notif,
11941                                      u8 count)
11942 {
11943         struct sk_buff *msg;
11944         void *hdr;
11945
11946         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11947         if (!msg)
11948                 return;
11949
11950         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
11951         if (!hdr) {
11952                 nlmsg_free(msg);
11953                 return;
11954         }
11955
11956         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11957                 goto nla_put_failure;
11958
11959         if (nl80211_send_chandef(msg, chandef))
11960                 goto nla_put_failure;
11961
11962         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
11963             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
11964                         goto nla_put_failure;
11965
11966         genlmsg_end(msg, hdr);
11967
11968         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11969                                 NL80211_MCGRP_MLME, gfp);
11970         return;
11971
11972  nla_put_failure:
11973         genlmsg_cancel(msg, hdr);
11974         nlmsg_free(msg);
11975 }
11976
11977 void cfg80211_ch_switch_notify(struct net_device *dev,
11978                                struct cfg80211_chan_def *chandef)
11979 {
11980         struct wireless_dev *wdev = dev->ieee80211_ptr;
11981         struct wiphy *wiphy = wdev->wiphy;
11982         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11983
11984         ASSERT_WDEV_LOCK(wdev);
11985
11986         trace_cfg80211_ch_switch_notify(dev, chandef);
11987
11988         wdev->chandef = *chandef;
11989         wdev->preset_chandef = *chandef;
11990         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
11991                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
11992 }
11993 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
11994
11995 void cfg80211_ch_switch_started_notify(struct net_device *dev,
11996                                        struct cfg80211_chan_def *chandef,
11997                                        u8 count)
11998 {
11999         struct wireless_dev *wdev = dev->ieee80211_ptr;
12000         struct wiphy *wiphy = wdev->wiphy;
12001         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12002
12003         trace_cfg80211_ch_switch_started_notify(dev, chandef);
12004
12005         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
12006                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
12007 }
12008 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
12009
12010 void cfg80211_cqm_txe_notify(struct net_device *dev,
12011                              const u8 *peer, u32 num_packets,
12012                              u32 rate, u32 intvl, gfp_t gfp)
12013 {
12014         struct wireless_dev *wdev = dev->ieee80211_ptr;
12015         struct wiphy *wiphy = wdev->wiphy;
12016         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12017         struct sk_buff *msg;
12018         struct nlattr *pinfoattr;
12019         void *hdr;
12020
12021         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
12022         if (!msg)
12023                 return;
12024
12025         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
12026         if (!hdr) {
12027                 nlmsg_free(msg);
12028                 return;
12029         }
12030
12031         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12032             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12033             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
12034                 goto nla_put_failure;
12035
12036         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
12037         if (!pinfoattr)
12038                 goto nla_put_failure;
12039
12040         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
12041                 goto nla_put_failure;
12042
12043         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
12044                 goto nla_put_failure;
12045
12046         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
12047                 goto nla_put_failure;
12048
12049         nla_nest_end(msg, pinfoattr);
12050
12051         genlmsg_end(msg, hdr);
12052
12053         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12054                                 NL80211_MCGRP_MLME, gfp);
12055         return;
12056
12057  nla_put_failure:
12058         genlmsg_cancel(msg, hdr);
12059         nlmsg_free(msg);
12060 }
12061 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
12062
12063 void
12064 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
12065                      const struct cfg80211_chan_def *chandef,
12066                      enum nl80211_radar_event event,
12067                      struct net_device *netdev, gfp_t gfp)
12068 {
12069         struct sk_buff *msg;
12070         void *hdr;
12071
12072         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12073         if (!msg)
12074                 return;
12075
12076         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
12077         if (!hdr) {
12078                 nlmsg_free(msg);
12079                 return;
12080         }
12081
12082         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
12083                 goto nla_put_failure;
12084
12085         /* NOP and radar events don't need a netdev parameter */
12086         if (netdev) {
12087                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
12088
12089                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12090                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12091                         goto nla_put_failure;
12092         }
12093
12094         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
12095                 goto nla_put_failure;
12096
12097         if (nl80211_send_chandef(msg, chandef))
12098                 goto nla_put_failure;
12099
12100         genlmsg_end(msg, hdr);
12101
12102         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12103                                 NL80211_MCGRP_MLME, gfp);
12104         return;
12105
12106  nla_put_failure:
12107         genlmsg_cancel(msg, hdr);
12108         nlmsg_free(msg);
12109 }
12110
12111 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
12112                                  const u8 *peer, u32 num_packets, gfp_t gfp)
12113 {
12114         struct wireless_dev *wdev = dev->ieee80211_ptr;
12115         struct wiphy *wiphy = wdev->wiphy;
12116         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12117         struct sk_buff *msg;
12118         struct nlattr *pinfoattr;
12119         void *hdr;
12120
12121         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
12122
12123         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12124         if (!msg)
12125                 return;
12126
12127         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
12128         if (!hdr) {
12129                 nlmsg_free(msg);
12130                 return;
12131         }
12132
12133         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12134             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12135             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
12136                 goto nla_put_failure;
12137
12138         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
12139         if (!pinfoattr)
12140                 goto nla_put_failure;
12141
12142         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
12143                 goto nla_put_failure;
12144
12145         nla_nest_end(msg, pinfoattr);
12146
12147         genlmsg_end(msg, hdr);
12148
12149         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12150                                 NL80211_MCGRP_MLME, gfp);
12151         return;
12152
12153  nla_put_failure:
12154         genlmsg_cancel(msg, hdr);
12155         nlmsg_free(msg);
12156 }
12157 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
12158
12159 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
12160                            u64 cookie, bool acked, gfp_t gfp)
12161 {
12162         struct wireless_dev *wdev = dev->ieee80211_ptr;
12163         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12164         struct sk_buff *msg;
12165         void *hdr;
12166
12167         trace_cfg80211_probe_status(dev, addr, cookie, acked);
12168
12169         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12170
12171         if (!msg)
12172                 return;
12173
12174         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
12175         if (!hdr) {
12176                 nlmsg_free(msg);
12177                 return;
12178         }
12179
12180         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12181             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12182             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
12183             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
12184             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
12185                 goto nla_put_failure;
12186
12187         genlmsg_end(msg, hdr);
12188
12189         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12190                                 NL80211_MCGRP_MLME, gfp);
12191         return;
12192
12193  nla_put_failure:
12194         genlmsg_cancel(msg, hdr);
12195         nlmsg_free(msg);
12196 }
12197 EXPORT_SYMBOL(cfg80211_probe_status);
12198
12199 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
12200                                  const u8 *frame, size_t len,
12201                                  int freq, int sig_dbm)
12202 {
12203         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12204         struct sk_buff *msg;
12205         void *hdr;
12206         struct cfg80211_beacon_registration *reg;
12207
12208         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
12209
12210         spin_lock_bh(&rdev->beacon_registrations_lock);
12211         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
12212                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
12213                 if (!msg) {
12214                         spin_unlock_bh(&rdev->beacon_registrations_lock);
12215                         return;
12216                 }
12217
12218                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
12219                 if (!hdr)
12220                         goto nla_put_failure;
12221
12222                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12223                     (freq &&
12224                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
12225                     (sig_dbm &&
12226                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
12227                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
12228                         goto nla_put_failure;
12229
12230                 genlmsg_end(msg, hdr);
12231
12232                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
12233         }
12234         spin_unlock_bh(&rdev->beacon_registrations_lock);
12235         return;
12236
12237  nla_put_failure:
12238         spin_unlock_bh(&rdev->beacon_registrations_lock);
12239         if (hdr)
12240                 genlmsg_cancel(msg, hdr);
12241         nlmsg_free(msg);
12242 }
12243 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
12244
12245 #ifdef CONFIG_PM
12246 static int cfg80211_net_detect_results(struct sk_buff *msg,
12247                                        struct cfg80211_wowlan_wakeup *wakeup)
12248 {
12249         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
12250         struct nlattr *nl_results, *nl_match, *nl_freqs;
12251         int i, j;
12252
12253         nl_results = nla_nest_start(
12254                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
12255         if (!nl_results)
12256                 return -EMSGSIZE;
12257
12258         for (i = 0; i < nd->n_matches; i++) {
12259                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
12260
12261                 nl_match = nla_nest_start(msg, i);
12262                 if (!nl_match)
12263                         break;
12264
12265                 /* The SSID attribute is optional in nl80211, but for
12266                  * simplicity reasons it's always present in the
12267                  * cfg80211 structure.  If a driver can't pass the
12268                  * SSID, that needs to be changed.  A zero length SSID
12269                  * is still a valid SSID (wildcard), so it cannot be
12270                  * used for this purpose.
12271                  */
12272                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
12273                             match->ssid.ssid)) {
12274                         nla_nest_cancel(msg, nl_match);
12275                         goto out;
12276                 }
12277
12278                 if (match->n_channels) {
12279                         nl_freqs = nla_nest_start(
12280                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
12281                         if (!nl_freqs) {
12282                                 nla_nest_cancel(msg, nl_match);
12283                                 goto out;
12284                         }
12285
12286                         for (j = 0; j < match->n_channels; j++) {
12287                                 if (nla_put_u32(msg,
12288                                                 NL80211_ATTR_WIPHY_FREQ,
12289                                                 match->channels[j])) {
12290                                         nla_nest_cancel(msg, nl_freqs);
12291                                         nla_nest_cancel(msg, nl_match);
12292                                         goto out;
12293                                 }
12294                         }
12295
12296                         nla_nest_end(msg, nl_freqs);
12297                 }
12298
12299                 nla_nest_end(msg, nl_match);
12300         }
12301
12302 out:
12303         nla_nest_end(msg, nl_results);
12304         return 0;
12305 }
12306
12307 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
12308                                    struct cfg80211_wowlan_wakeup *wakeup,
12309                                    gfp_t gfp)
12310 {
12311         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12312         struct sk_buff *msg;
12313         void *hdr;
12314         int size = 200;
12315
12316         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
12317
12318         if (wakeup)
12319                 size += wakeup->packet_present_len;
12320
12321         msg = nlmsg_new(size, gfp);
12322         if (!msg)
12323                 return;
12324
12325         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
12326         if (!hdr)
12327                 goto free_msg;
12328
12329         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12330             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12331                 goto free_msg;
12332
12333         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12334                                         wdev->netdev->ifindex))
12335                 goto free_msg;
12336
12337         if (wakeup) {
12338                 struct nlattr *reasons;
12339
12340                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
12341                 if (!reasons)
12342                         goto free_msg;
12343
12344                 if (wakeup->disconnect &&
12345                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
12346                         goto free_msg;
12347                 if (wakeup->magic_pkt &&
12348                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
12349                         goto free_msg;
12350                 if (wakeup->gtk_rekey_failure &&
12351                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
12352                         goto free_msg;
12353                 if (wakeup->eap_identity_req &&
12354                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
12355                         goto free_msg;
12356                 if (wakeup->four_way_handshake &&
12357                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
12358                         goto free_msg;
12359                 if (wakeup->rfkill_release &&
12360                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
12361                         goto free_msg;
12362
12363                 if (wakeup->pattern_idx >= 0 &&
12364                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
12365                                 wakeup->pattern_idx))
12366                         goto free_msg;
12367
12368                 if (wakeup->tcp_match &&
12369                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
12370                         goto free_msg;
12371
12372                 if (wakeup->tcp_connlost &&
12373                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
12374                         goto free_msg;
12375
12376                 if (wakeup->tcp_nomoretokens &&
12377                     nla_put_flag(msg,
12378                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
12379                         goto free_msg;
12380
12381                 if (wakeup->packet) {
12382                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
12383                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
12384
12385                         if (!wakeup->packet_80211) {
12386                                 pkt_attr =
12387                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
12388                                 len_attr =
12389                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
12390                         }
12391
12392                         if (wakeup->packet_len &&
12393                             nla_put_u32(msg, len_attr, wakeup->packet_len))
12394                                 goto free_msg;
12395
12396                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
12397                                     wakeup->packet))
12398                                 goto free_msg;
12399                 }
12400
12401                 if (wakeup->net_detect &&
12402                     cfg80211_net_detect_results(msg, wakeup))
12403                                 goto free_msg;
12404
12405                 nla_nest_end(msg, reasons);
12406         }
12407
12408         genlmsg_end(msg, hdr);
12409
12410         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12411                                 NL80211_MCGRP_MLME, gfp);
12412         return;
12413
12414  free_msg:
12415         nlmsg_free(msg);
12416 }
12417 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
12418 #endif
12419
12420 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
12421                                 enum nl80211_tdls_operation oper,
12422                                 u16 reason_code, gfp_t gfp)
12423 {
12424         struct wireless_dev *wdev = dev->ieee80211_ptr;
12425         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12426         struct sk_buff *msg;
12427         void *hdr;
12428
12429         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
12430                                          reason_code);
12431
12432         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12433         if (!msg)
12434                 return;
12435
12436         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
12437         if (!hdr) {
12438                 nlmsg_free(msg);
12439                 return;
12440         }
12441
12442         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12443             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12444             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
12445             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
12446             (reason_code > 0 &&
12447              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
12448                 goto nla_put_failure;
12449
12450         genlmsg_end(msg, hdr);
12451
12452         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12453                                 NL80211_MCGRP_MLME, gfp);
12454         return;
12455
12456  nla_put_failure:
12457         genlmsg_cancel(msg, hdr);
12458         nlmsg_free(msg);
12459 }
12460 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
12461
12462 static int nl80211_netlink_notify(struct notifier_block * nb,
12463                                   unsigned long state,
12464                                   void *_notify)
12465 {
12466         struct netlink_notify *notify = _notify;
12467         struct cfg80211_registered_device *rdev;
12468         struct wireless_dev *wdev;
12469         struct cfg80211_beacon_registration *reg, *tmp;
12470
12471         if (state != NETLINK_URELEASE)
12472                 return NOTIFY_DONE;
12473
12474         rcu_read_lock();
12475
12476         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
12477                 bool schedule_destroy_work = false;
12478
12479                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
12480                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
12481
12482                         if (wdev->owner_nlportid == notify->portid)
12483                                 schedule_destroy_work = true;
12484                 }
12485
12486                 spin_lock_bh(&rdev->beacon_registrations_lock);
12487                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
12488                                          list) {
12489                         if (reg->nlportid == notify->portid) {
12490                                 list_del(&reg->list);
12491                                 kfree(reg);
12492                                 break;
12493                         }
12494                 }
12495                 spin_unlock_bh(&rdev->beacon_registrations_lock);
12496
12497                 if (schedule_destroy_work) {
12498                         struct cfg80211_iface_destroy *destroy;
12499
12500                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
12501                         if (destroy) {
12502                                 destroy->nlportid = notify->portid;
12503                                 spin_lock(&rdev->destroy_list_lock);
12504                                 list_add(&destroy->list, &rdev->destroy_list);
12505                                 spin_unlock(&rdev->destroy_list_lock);
12506                                 schedule_work(&rdev->destroy_work);
12507                         }
12508                 }
12509         }
12510
12511         rcu_read_unlock();
12512
12513         return NOTIFY_OK;
12514 }
12515
12516 static struct notifier_block nl80211_netlink_notifier = {
12517         .notifier_call = nl80211_netlink_notify,
12518 };
12519
12520 void cfg80211_ft_event(struct net_device *netdev,
12521                        struct cfg80211_ft_event_params *ft_event)
12522 {
12523         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
12524         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12525         struct sk_buff *msg;
12526         void *hdr;
12527
12528         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
12529
12530         if (!ft_event->target_ap)
12531                 return;
12532
12533         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12534         if (!msg)
12535                 return;
12536
12537         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
12538         if (!hdr)
12539                 goto out;
12540
12541         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12542             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12543             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
12544                 goto out;
12545
12546         if (ft_event->ies &&
12547             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
12548                 goto out;
12549         if (ft_event->ric_ies &&
12550             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
12551                     ft_event->ric_ies))
12552                 goto out;
12553
12554         genlmsg_end(msg, hdr);
12555
12556         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12557                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12558         return;
12559  out:
12560         nlmsg_free(msg);
12561 }
12562 EXPORT_SYMBOL(cfg80211_ft_event);
12563
12564 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
12565 {
12566         struct cfg80211_registered_device *rdev;
12567         struct sk_buff *msg;
12568         void *hdr;
12569         u32 nlportid;
12570
12571         rdev = wiphy_to_rdev(wdev->wiphy);
12572         if (!rdev->crit_proto_nlportid)
12573                 return;
12574
12575         nlportid = rdev->crit_proto_nlportid;
12576         rdev->crit_proto_nlportid = 0;
12577
12578         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12579         if (!msg)
12580                 return;
12581
12582         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
12583         if (!hdr)
12584                 goto nla_put_failure;
12585
12586         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12587             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12588                 goto nla_put_failure;
12589
12590         genlmsg_end(msg, hdr);
12591
12592         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
12593         return;
12594
12595  nla_put_failure:
12596         if (hdr)
12597                 genlmsg_cancel(msg, hdr);
12598         nlmsg_free(msg);
12599
12600 }
12601 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
12602
12603 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
12604 {
12605         struct wiphy *wiphy = wdev->wiphy;
12606         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12607         struct sk_buff *msg;
12608         void *hdr;
12609
12610         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12611         if (!msg)
12612                 return;
12613
12614         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
12615         if (!hdr)
12616                 goto out;
12617
12618         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12619             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
12620             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12621                 goto out;
12622
12623         genlmsg_end(msg, hdr);
12624
12625         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
12626                                 NL80211_MCGRP_MLME, GFP_KERNEL);
12627         return;
12628  out:
12629         nlmsg_free(msg);
12630 }
12631
12632 /* initialisation/exit functions */
12633
12634 int nl80211_init(void)
12635 {
12636         int err;
12637
12638         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
12639                                                    nl80211_mcgrps);
12640         if (err)
12641                 return err;
12642
12643         err = netlink_register_notifier(&nl80211_netlink_notifier);
12644         if (err)
12645                 goto err_out;
12646
12647         return 0;
12648  err_out:
12649         genl_unregister_family(&nl80211_fam);
12650         return err;
12651 }
12652
12653 void nl80211_exit(void)
12654 {
12655         netlink_unregister_notifier(&nl80211_netlink_notifier);
12656         genl_unregister_family(&nl80211_fam);
12657 }