net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         assert_cfg80211_lock();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 mutex_lock(&rdev->devlist_mtx);
  84                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  85                         if (have_ifidx && wdev->netdev &&
  86                             wdev->netdev->ifindex == ifidx) {
  87                                 result = wdev;
  88                                 break;
  89                         }
  90                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  91                                 result = wdev;
  92                                 break;
  93                         }
  94                 }
  95                 mutex_unlock(&rdev->devlist_mtx);
  96
  97                 if (result)
  98                         break;
  99         }
 100
 101         if (result)
 102                 return result;
 103         return ERR_PTR(-ENODEV);
 104 }
 105
 106 static struct cfg80211_registered_device *
 107 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 108 {
 109         struct cfg80211_registered_device *rdev = NULL, *tmp;
 110         struct net_device *netdev;
 111
 112         assert_cfg80211_lock();
 113
 114         if (!attrs[NL80211_ATTR_WIPHY] &&
 115             !attrs[NL80211_ATTR_IFINDEX] &&
 116             !attrs[NL80211_ATTR_WDEV])
 117                 return ERR_PTR(-EINVAL);
 118
 119         if (attrs[NL80211_ATTR_WIPHY])
 120                 rdev = cfg80211_rdev_by_wiphy_idx(
 121                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 122
 123         if (attrs[NL80211_ATTR_WDEV]) {
 124                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 125                 struct wireless_dev *wdev;
 126                 bool found = false;
 127
 128                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 129                 if (tmp) {
 130                         /* make sure wdev exists */
 131                         mutex_lock(&tmp->devlist_mtx);
 132                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 133                                 if (wdev->identifier != (u32)wdev_id)
 134                                         continue;
 135                                 found = true;
 136                                 break;
 137                         }
 138                         mutex_unlock(&tmp->devlist_mtx);
 139
 140                         if (!found)
 141                                 tmp = NULL;
 142
 143                         if (rdev && tmp != rdev)
 144                                 return ERR_PTR(-EINVAL);
 145                         rdev = tmp;
 146                 }
 147         }
 148
 149         if (attrs[NL80211_ATTR_IFINDEX]) {
 150                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 151                 netdev = dev_get_by_index(netns, ifindex);
 152                 if (netdev) {
 153                         if (netdev->ieee80211_ptr)
 154                                 tmp = wiphy_to_dev(
 155                                                 netdev->ieee80211_ptr->wiphy);
 156                         else
 157                                 tmp = NULL;
 158
 159                         dev_put(netdev);
 160
 161                         /* not wireless device -- return error */
 162                         if (!tmp)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         /* mismatch -- return error */
 166                         if (rdev && tmp != rdev)
 167                                 return ERR_PTR(-EINVAL);
 168
 169                         rdev = tmp;
 170                 }
 171         }
 172
 173         if (!rdev)
 174                 return ERR_PTR(-ENODEV);
 175
 176         if (netns != wiphy_net(&rdev->wiphy))
 177                 return ERR_PTR(-ENODEV);
 178
 179         return rdev;
 180 }
 181
 182 /*
 183  * This function returns a pointer to the driver
 184  * that the genl_info item that is passed refers to.
 185  * If successful, it returns non-NULL and also locks
 186  * the driver's mutex!
 187  *
 188  * This means that you need to call cfg80211_unlock_rdev()
 189  * before being allowed to acquire &cfg80211_mutex!
 190  *
 191  * This is necessary because we need to lock the global
 192  * mutex to get an item off the list safely, and then
 193  * we lock the rdev mutex so it doesn't go away under us.
 194  *
 195  * We don't want to keep cfg80211_mutex locked
 196  * for all the time in order to allow requests on
 197  * other interfaces to go through at the same time.
 198  *
 199  * The result of this can be a PTR_ERR and hence must
 200  * be checked with IS_ERR() for errors.
 201  */
 202 static struct cfg80211_registered_device *
 203 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 204 {
 205         struct cfg80211_registered_device *rdev;
 206
 207         mutex_lock(&cfg80211_mutex);
 208         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 209
 210         /* if it is not an error we grab the lock on
 211          * it to assure it won't be going away while
 212          * we operate on it */
 213         if (!IS_ERR(rdev))
 214                 mutex_lock(&rdev->mtx);
 215
 216         mutex_unlock(&cfg80211_mutex);
 217
 218         return rdev;
 219 }
 220
 221 /* policy for the attributes */
 222 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 223         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 224         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 225                                       .len = 20-1 },
 226         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 227
 228         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 231         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 232         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 233
 234         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 235         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 236         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 237         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 238         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 239
 240         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 241         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 242         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 243
 244         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 245         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 246
 247         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 248         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 249                                     .len = WLAN_MAX_KEY_LEN },
 250         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 251         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 252         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 253         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 254         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 255
 256         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 257         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 258         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 259                                        .len = IEEE80211_MAX_DATA_LEN },
 260         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 261                                        .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 263         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 264         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 265         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 266                                                .len = NL80211_MAX_SUPP_RATES },
 267         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 268         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 269         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 270         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 271                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 272         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 273
 274         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 275         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 276
 277         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 278         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 280         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 281                                            .len = NL80211_MAX_SUPP_RATES },
 282         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 283
 284         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 286
 287         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 288
 289         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 290         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 291                               .len = IEEE80211_MAX_DATA_LEN },
 292         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 293         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 294
 295         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 296                                 .len = IEEE80211_MAX_SSID_LEN },
 297         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 298         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_STA_FLAGS2] = {
 303                 .len = sizeof(struct nl80211_sta_flag_update),
 304         },
 305         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 306         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 307         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 308         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 309         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 310         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 311         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 312         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 313         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 314                                  .len = WLAN_PMKID_LEN },
 315         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 316         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 317         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 318         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 319                                  .len = IEEE80211_MAX_DATA_LEN },
 320         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 321         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 323         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 325         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 326         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 328         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 329         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 330         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 331         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 332         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 333         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 335         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 336         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 338         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 339         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 340                                          .len = IEEE80211_MAX_DATA_LEN },
 341         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 342                                          .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 345         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 348         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 351         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 352         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 353                                       .len = IEEE80211_MAX_DATA_LEN },
 354         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 355         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 356         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 357                 .len = NL80211_HT_CAPABILITY_LEN
 358         },
 359         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 360         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 361         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 362         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 363         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 364         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 366         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 367         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 368         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 369         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 370         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 371         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 372         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 373         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 374         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 375         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 376                 .len = NL80211_VHT_CAPABILITY_LEN,
 377         },
 378         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 379         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 380                                   .len = IEEE80211_MAX_DATA_LEN },
 381         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 382 };
 383
 384 /* policy for the key attributes */
 385 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 386         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 387         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 388         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 389         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 390         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 391         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 392         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 393         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 394 };
 395
 396 /* policy for the key default flags */
 397 static const struct nla_policy
 398 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 399         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 400         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 401 };
 402
 403 /* policy for WoWLAN attributes */
 404 static const struct nla_policy
 405 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 406         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 407         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 408         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 409         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 410         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 411         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 412         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 413         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 414         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 415 };
 416
 417 static const struct nla_policy
 418 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 419         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 420         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 421         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 422         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 423         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 424         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 425         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 426                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 427         },
 428         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 429                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 430         },
 431         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 432         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 433         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 434 };
 435
 436 /* policy for GTK rekey offload attributes */
 437 static const struct nla_policy
 438 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 439         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 440         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 441         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 442 };
 443
 444 static const struct nla_policy
 445 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 446         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 447                                                  .len = IEEE80211_MAX_SSID_LEN },
 448         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 449 };
 450
 451 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 452                                      struct netlink_callback *cb,
 453                                      struct cfg80211_registered_device **rdev,
 454                                      struct wireless_dev **wdev)
 455 {
 456         int err;
 457
 458         rtnl_lock();
 459         mutex_lock(&cfg80211_mutex);
 460
 461         if (!cb->args[0]) {
 462                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 463                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 464                                   nl80211_policy);
 465                 if (err)
 466                         goto out_unlock;
 467
 468                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 469                                                    nl80211_fam.attrbuf);
 470                 if (IS_ERR(*wdev)) {
 471                         err = PTR_ERR(*wdev);
 472                         goto out_unlock;
 473                 }
 474                 *rdev = wiphy_to_dev((*wdev)->wiphy);
 475                 cb->args[0] = (*rdev)->wiphy_idx;
 476                 cb->args[1] = (*wdev)->identifier;
 477         } else {
 478                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0]);
 479                 struct wireless_dev *tmp;
 480
 481                 if (!wiphy) {
 482                         err = -ENODEV;
 483                         goto out_unlock;
 484                 }
 485                 *rdev = wiphy_to_dev(wiphy);
 486                 *wdev = NULL;
 487
 488                 mutex_lock(&(*rdev)->devlist_mtx);
 489                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 490                         if (tmp->identifier == cb->args[1]) {
 491                                 *wdev = tmp;
 492                                 break;
 493                         }
 494                 }
 495                 mutex_unlock(&(*rdev)->devlist_mtx);
 496
 497                 if (!*wdev) {
 498                         err = -ENODEV;
 499                         goto out_unlock;
 500                 }
 501         }
 502
 503         cfg80211_lock_rdev(*rdev);
 504
 505         mutex_unlock(&cfg80211_mutex);
 506         return 0;
 507  out_unlock:
 508         mutex_unlock(&cfg80211_mutex);
 509         rtnl_unlock();
 510         return err;
 511 }
 512
 513 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 514 {
 515         cfg80211_unlock_rdev(rdev);
 516         rtnl_unlock();
 517 }
 518
 519 /* IE validation */
 520 static bool is_valid_ie_attr(const struct nlattr *attr)
 521 {
 522         const u8 *pos;
 523         int len;
 524
 525         if (!attr)
 526                 return true;
 527
 528         pos = nla_data(attr);
 529         len = nla_len(attr);
 530
 531         while (len) {
 532                 u8 elemlen;
 533
 534                 if (len < 2)
 535                         return false;
 536                 len -= 2;
 537
 538                 elemlen = pos[1];
 539                 if (elemlen > len)
 540                         return false;
 541
 542                 len -= elemlen;
 543                 pos += 2 + elemlen;
 544         }
 545
 546         return true;
 547 }
 548
 549 /* message building helper */
 550 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 551                                    int flags, u8 cmd)
 552 {
 553         /* since there is no private header just add the generic one */
 554         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 555 }
 556
 557 static int nl80211_msg_put_channel(struct sk_buff *msg,
 558                                    struct ieee80211_channel *chan,
 559                                    bool large)
 560 {
 561         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 562                         chan->center_freq))
 563                 goto nla_put_failure;
 564
 565         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 566             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 567                 goto nla_put_failure;
 568         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 569             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 570                 goto nla_put_failure;
 571         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 572             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 573                 goto nla_put_failure;
 574         if (chan->flags & IEEE80211_CHAN_RADAR) {
 575                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 576                         goto nla_put_failure;
 577                 if (large) {
 578                         u32 time;
 579
 580                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 581
 582                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 583                                         chan->dfs_state))
 584                                 goto nla_put_failure;
 585                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 586                                         time))
 587                                 goto nla_put_failure;
 588                 }
 589         }
 590
 591         if (large) {
 592                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 593                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 594                         goto nla_put_failure;
 595                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 596                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 597                         goto nla_put_failure;
 598                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 599                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 600                         goto nla_put_failure;
 601                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 602                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 603                         goto nla_put_failure;
 604         }
 605
 606         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 607                         DBM_TO_MBM(chan->max_power)))
 608                 goto nla_put_failure;
 609
 610         return 0;
 611
 612  nla_put_failure:
 613         return -ENOBUFS;
 614 }
 615
 616 /* netlink command implementations */
 617
 618 struct key_parse {
 619         struct key_params p;
 620         int idx;
 621         int type;
 622         bool def, defmgmt;
 623         bool def_uni, def_multi;
 624 };
 625
 626 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 627 {
 628         struct nlattr *tb[NL80211_KEY_MAX + 1];
 629         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 630                                    nl80211_key_policy);
 631         if (err)
 632                 return err;
 633
 634         k->def = !!tb[NL80211_KEY_DEFAULT];
 635         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 636
 637         if (k->def) {
 638                 k->def_uni = true;
 639                 k->def_multi = true;
 640         }
 641         if (k->defmgmt)
 642                 k->def_multi = true;
 643
 644         if (tb[NL80211_KEY_IDX])
 645                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 646
 647         if (tb[NL80211_KEY_DATA]) {
 648                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 649                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 650         }
 651
 652         if (tb[NL80211_KEY_SEQ]) {
 653                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 654                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 655         }
 656
 657         if (tb[NL80211_KEY_CIPHER])
 658                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 659
 660         if (tb[NL80211_KEY_TYPE]) {
 661                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 662                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 663                         return -EINVAL;
 664         }
 665
 666         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 667                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 668                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 669                                        tb[NL80211_KEY_DEFAULT_TYPES],
 670                                        nl80211_key_default_policy);
 671                 if (err)
 672                         return err;
 673
 674                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 675                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 676         }
 677
 678         return 0;
 679 }
 680
 681 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 682 {
 683         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 684                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 685                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 686         }
 687
 688         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 689                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 690                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 691         }
 692
 693         if (info->attrs[NL80211_ATTR_KEY_IDX])
 694                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 695
 696         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 697                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 698
 699         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 700         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 701
 702         if (k->def) {
 703                 k->def_uni = true;
 704                 k->def_multi = true;
 705         }
 706         if (k->defmgmt)
 707                 k->def_multi = true;
 708
 709         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 710                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 711                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 712                         return -EINVAL;
 713         }
 714
 715         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 716                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 717                 int err = nla_parse_nested(
 718                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 719                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 720                                 nl80211_key_default_policy);
 721                 if (err)
 722                         return err;
 723
 724                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 725                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 726         }
 727
 728         return 0;
 729 }
 730
 731 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 732 {
 733         int err;
 734
 735         memset(k, 0, sizeof(*k));
 736         k->idx = -1;
 737         k->type = -1;
 738
 739         if (info->attrs[NL80211_ATTR_KEY])
 740                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 741         else
 742                 err = nl80211_parse_key_old(info, k);
 743
 744         if (err)
 745                 return err;
 746
 747         if (k->def && k->defmgmt)
 748                 return -EINVAL;
 749
 750         if (k->defmgmt) {
 751                 if (k->def_uni || !k->def_multi)
 752                         return -EINVAL;
 753         }
 754
 755         if (k->idx != -1) {
 756                 if (k->defmgmt) {
 757                         if (k->idx < 4 || k->idx > 5)
 758                                 return -EINVAL;
 759                 } else if (k->def) {
 760                         if (k->idx < 0 || k->idx > 3)
 761                                 return -EINVAL;
 762                 } else {
 763                         if (k->idx < 0 || k->idx > 5)
 764                                 return -EINVAL;
 765                 }
 766         }
 767
 768         return 0;
 769 }
 770
 771 static struct cfg80211_cached_keys *
 772 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 773                        struct nlattr *keys, bool *no_ht)
 774 {
 775         struct key_parse parse;
 776         struct nlattr *key;
 777         struct cfg80211_cached_keys *result;
 778         int rem, err, def = 0;
 779
 780         result = kzalloc(sizeof(*result), GFP_KERNEL);
 781         if (!result)
 782                 return ERR_PTR(-ENOMEM);
 783
 784         result->def = -1;
 785         result->defmgmt = -1;
 786
 787         nla_for_each_nested(key, keys, rem) {
 788                 memset(&parse, 0, sizeof(parse));
 789                 parse.idx = -1;
 790
 791                 err = nl80211_parse_key_new(key, &parse);
 792                 if (err)
 793                         goto error;
 794                 err = -EINVAL;
 795                 if (!parse.p.key)
 796                         goto error;
 797                 if (parse.idx < 0 || parse.idx > 4)
 798                         goto error;
 799                 if (parse.def) {
 800                         if (def)
 801                                 goto error;
 802                         def = 1;
 803                         result->def = parse.idx;
 804                         if (!parse.def_uni || !parse.def_multi)
 805                                 goto error;
 806                 } else if (parse.defmgmt)
 807                         goto error;
 808                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 809                                                      parse.idx, false, NULL);
 810                 if (err)
 811                         goto error;
 812                 result->params[parse.idx].cipher = parse.p.cipher;
 813                 result->params[parse.idx].key_len = parse.p.key_len;
 814                 result->params[parse.idx].key = result->data[parse.idx];
 815                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 816
 817                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 818                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 819                         if (no_ht)
 820                                 *no_ht = true;
 821                 }
 822         }
 823
 824         return result;
 825  error:
 826         kfree(result);
 827         return ERR_PTR(err);
 828 }
 829
 830 static int nl80211_key_allowed(struct wireless_dev *wdev)
 831 {
 832         ASSERT_WDEV_LOCK(wdev);
 833
 834         switch (wdev->iftype) {
 835         case NL80211_IFTYPE_AP:
 836         case NL80211_IFTYPE_AP_VLAN:
 837         case NL80211_IFTYPE_P2P_GO:
 838         case NL80211_IFTYPE_MESH_POINT:
 839                 break;
 840         case NL80211_IFTYPE_ADHOC:
 841                 if (!wdev->current_bss)
 842                         return -ENOLINK;
 843                 break;
 844         case NL80211_IFTYPE_STATION:
 845         case NL80211_IFTYPE_P2P_CLIENT:
 846                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 847                         return -ENOLINK;
 848                 break;
 849         default:
 850                 return -EINVAL;
 851         }
 852
 853         return 0;
 854 }
 855
 856 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 857 {
 858         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 859         int i;
 860
 861         if (!nl_modes)
 862                 goto nla_put_failure;
 863
 864         i = 0;
 865         while (ifmodes) {
 866                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 867                         goto nla_put_failure;
 868                 ifmodes >>= 1;
 869                 i++;
 870         }
 871
 872         nla_nest_end(msg, nl_modes);
 873         return 0;
 874
 875 nla_put_failure:
 876         return -ENOBUFS;
 877 }
 878
 879 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 880                                           struct sk_buff *msg,
 881                                           bool large)
 882 {
 883         struct nlattr *nl_combis;
 884         int i, j;
 885
 886         nl_combis = nla_nest_start(msg,
 887                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 888         if (!nl_combis)
 889                 goto nla_put_failure;
 890
 891         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 892                 const struct ieee80211_iface_combination *c;
 893                 struct nlattr *nl_combi, *nl_limits;
 894
 895                 c = &wiphy->iface_combinations[i];
 896
 897                 nl_combi = nla_nest_start(msg, i + 1);
 898                 if (!nl_combi)
 899                         goto nla_put_failure;
 900
 901                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 902                 if (!nl_limits)
 903                         goto nla_put_failure;
 904
 905                 for (j = 0; j < c->n_limits; j++) {
 906                         struct nlattr *nl_limit;
 907
 908                         nl_limit = nla_nest_start(msg, j + 1);
 909                         if (!nl_limit)
 910                                 goto nla_put_failure;
 911                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 912                                         c->limits[j].max))
 913                                 goto nla_put_failure;
 914                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 915                                                 c->limits[j].types))
 916                                 goto nla_put_failure;
 917                         nla_nest_end(msg, nl_limit);
 918                 }
 919
 920                 nla_nest_end(msg, nl_limits);
 921
 922                 if (c->beacon_int_infra_match &&
 923                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 924                         goto nla_put_failure;
 925                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 926                                 c->num_different_channels) ||
 927                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 928                                 c->max_interfaces))
 929                         goto nla_put_failure;
 930                 if (large &&
 931                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 932                                 c->radar_detect_widths))
 933                         goto nla_put_failure;
 934
 935                 nla_nest_end(msg, nl_combi);
 936         }
 937
 938         nla_nest_end(msg, nl_combis);
 939
 940         return 0;
 941 nla_put_failure:
 942         return -ENOBUFS;
 943 }
 944
 945 #ifdef CONFIG_PM
 946 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 947                                         struct sk_buff *msg)
 948 {
 949         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
 950         struct nlattr *nl_tcp;
 951
 952         if (!tcp)
 953                 return 0;
 954
 955         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 956         if (!nl_tcp)
 957                 return -ENOBUFS;
 958
 959         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 960                         tcp->data_payload_max))
 961                 return -ENOBUFS;
 962
 963         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 964                         tcp->data_payload_max))
 965                 return -ENOBUFS;
 966
 967         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 968                 return -ENOBUFS;
 969
 970         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 971                                 sizeof(*tcp->tok), tcp->tok))
 972                 return -ENOBUFS;
 973
 974         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 975                         tcp->data_interval_max))
 976                 return -ENOBUFS;
 977
 978         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 979                         tcp->wake_payload_max))
 980                 return -ENOBUFS;
 981
 982         nla_nest_end(msg, nl_tcp);
 983         return 0;
 984 }
 985
 986 static int nl80211_send_wowlan(struct sk_buff *msg,
 987                                struct cfg80211_registered_device *dev,
 988                                bool large)
 989 {
 990         struct nlattr *nl_wowlan;
 991
 992         if (!dev->wiphy.wowlan.flags && !dev->wiphy.wowlan.n_patterns)
 993                 return 0;
 994
 995         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 996         if (!nl_wowlan)
 997                 return -ENOBUFS;
 998
 999         if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1000              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1001             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1002              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1003             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1004              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1005             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1006              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1007             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1008              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1009             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1010              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1011             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1012              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1013             ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1014              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1015                 return -ENOBUFS;
1016
1017         if (dev->wiphy.wowlan.n_patterns) {
1018                 struct nl80211_wowlan_pattern_support pat = {
1019                         .max_patterns = dev->wiphy.wowlan.n_patterns,
1020                         .min_pattern_len = dev->wiphy.wowlan.pattern_min_len,
1021                         .max_pattern_len = dev->wiphy.wowlan.pattern_max_len,
1022                         .max_pkt_offset = dev->wiphy.wowlan.max_pkt_offset,
1023                 };
1024
1025                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1026                             sizeof(pat), &pat))
1027                         return -ENOBUFS;
1028         }
1029
1030         if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
1031                 return -ENOBUFS;
1032
1033         nla_nest_end(msg, nl_wowlan);
1034
1035         return 0;
1036 }
1037 #endif
1038
1039 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1040                                       struct ieee80211_supported_band *sband)
1041 {
1042         struct nlattr *nl_rates, *nl_rate;
1043         struct ieee80211_rate *rate;
1044         int i;
1045
1046         /* add HT info */
1047         if (sband->ht_cap.ht_supported &&
1048             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1049                      sizeof(sband->ht_cap.mcs),
1050                      &sband->ht_cap.mcs) ||
1051              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1052                          sband->ht_cap.cap) ||
1053              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1054                         sband->ht_cap.ampdu_factor) ||
1055              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1056                         sband->ht_cap.ampdu_density)))
1057                 return -ENOBUFS;
1058
1059         /* add VHT info */
1060         if (sband->vht_cap.vht_supported &&
1061             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1062                      sizeof(sband->vht_cap.vht_mcs),
1063                      &sband->vht_cap.vht_mcs) ||
1064              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1065                          sband->vht_cap.cap)))
1066                 return -ENOBUFS;
1067
1068         /* add bitrates */
1069         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1070         if (!nl_rates)
1071                 return -ENOBUFS;
1072
1073         for (i = 0; i < sband->n_bitrates; i++) {
1074                 nl_rate = nla_nest_start(msg, i);
1075                 if (!nl_rate)
1076                         return -ENOBUFS;
1077
1078                 rate = &sband->bitrates[i];
1079                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1080                                 rate->bitrate))
1081                         return -ENOBUFS;
1082                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1083                     nla_put_flag(msg,
1084                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1085                         return -ENOBUFS;
1086
1087                 nla_nest_end(msg, nl_rate);
1088         }
1089
1090         nla_nest_end(msg, nl_rates);
1091
1092         return 0;
1093 }
1094
1095 static int
1096 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1097                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1098 {
1099         u16 stypes;
1100         struct nlattr *nl_ftypes, *nl_ifs;
1101         enum nl80211_iftype ift;
1102         int i;
1103
1104         if (!mgmt_stypes)
1105                 return 0;
1106
1107         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1108         if (!nl_ifs)
1109                 return -ENOBUFS;
1110
1111         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1112                 nl_ftypes = nla_nest_start(msg, ift);
1113                 if (!nl_ftypes)
1114                         return -ENOBUFS;
1115                 i = 0;
1116                 stypes = mgmt_stypes[ift].tx;
1117                 while (stypes) {
1118                         if ((stypes & 1) &&
1119                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1120                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1121                                 return -ENOBUFS;
1122                         stypes >>= 1;
1123                         i++;
1124                 }
1125                 nla_nest_end(msg, nl_ftypes);
1126         }
1127
1128         nla_nest_end(msg, nl_ifs);
1129
1130         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1131         if (!nl_ifs)
1132                 return -ENOBUFS;
1133
1134         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1135                 nl_ftypes = nla_nest_start(msg, ift);
1136                 if (!nl_ftypes)
1137                         return -ENOBUFS;
1138                 i = 0;
1139                 stypes = mgmt_stypes[ift].rx;
1140                 while (stypes) {
1141                         if ((stypes & 1) &&
1142                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1143                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1144                                 return -ENOBUFS;
1145                         stypes >>= 1;
1146                         i++;
1147                 }
1148                 nla_nest_end(msg, nl_ftypes);
1149         }
1150         nla_nest_end(msg, nl_ifs);
1151
1152         return 0;
1153 }
1154
1155 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1156                               struct sk_buff *msg, u32 portid, u32 seq,
1157                               int flags, bool split, long *split_start,
1158                               long *band_start, long *chan_start)
1159 {
1160         void *hdr;
1161         struct nlattr *nl_bands, *nl_band;
1162         struct nlattr *nl_freqs, *nl_freq;
1163         struct nlattr *nl_cmds;
1164         enum ieee80211_band band;
1165         struct ieee80211_channel *chan;
1166         int i;
1167         const struct ieee80211_txrx_stypes *mgmt_stypes =
1168                                 dev->wiphy.mgmt_stypes;
1169         long start = 0, start_chan = 0, start_band = 0;
1170         u32 features;
1171
1172         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1173         if (!hdr)
1174                 return -ENOBUFS;
1175
1176         /* allow always using the variables */
1177         if (!split) {
1178                 split_start = &start;
1179                 band_start = &start_band;
1180                 chan_start = &start_chan;
1181         }
1182
1183         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1184             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1185                            wiphy_name(&dev->wiphy)) ||
1186             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1187                         cfg80211_rdev_list_generation))
1188                 goto nla_put_failure;
1189
1190         switch (*split_start) {
1191         case 0:
1192                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1193                                dev->wiphy.retry_short) ||
1194                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1195                                dev->wiphy.retry_long) ||
1196                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1197                                 dev->wiphy.frag_threshold) ||
1198                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1199                                 dev->wiphy.rts_threshold) ||
1200                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1201                                dev->wiphy.coverage_class) ||
1202                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1203                                dev->wiphy.max_scan_ssids) ||
1204                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1205                                dev->wiphy.max_sched_scan_ssids) ||
1206                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1207                                 dev->wiphy.max_scan_ie_len) ||
1208                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1209                                 dev->wiphy.max_sched_scan_ie_len) ||
1210                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1211                                dev->wiphy.max_match_sets))
1212                         goto nla_put_failure;
1213
1214                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1215                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1216                         goto nla_put_failure;
1217                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1218                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1219                         goto nla_put_failure;
1220                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1221                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1222                         goto nla_put_failure;
1223                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1224                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1225                         goto nla_put_failure;
1226                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1227                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1228                         goto nla_put_failure;
1229                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1230                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1231                         goto nla_put_failure;
1232
1233                 (*split_start)++;
1234                 if (split)
1235                         break;
1236         case 1:
1237                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1238                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1239                             dev->wiphy.cipher_suites))
1240                         goto nla_put_failure;
1241
1242                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1243                                dev->wiphy.max_num_pmkids))
1244                         goto nla_put_failure;
1245
1246                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1247                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1248                         goto nla_put_failure;
1249
1250                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1251                                 dev->wiphy.available_antennas_tx) ||
1252                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1253                                 dev->wiphy.available_antennas_rx))
1254                         goto nla_put_failure;
1255
1256                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1257                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1258                                 dev->wiphy.probe_resp_offload))
1259                         goto nla_put_failure;
1260
1261                 if ((dev->wiphy.available_antennas_tx ||
1262                      dev->wiphy.available_antennas_rx) &&
1263                     dev->ops->get_antenna) {
1264                         u32 tx_ant = 0, rx_ant = 0;
1265                         int res;
1266                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1267                         if (!res) {
1268                                 if (nla_put_u32(msg,
1269                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1270                                                 tx_ant) ||
1271                                     nla_put_u32(msg,
1272                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1273                                                 rx_ant))
1274                                         goto nla_put_failure;
1275                         }
1276                 }
1277
1278                 (*split_start)++;
1279                 if (split)
1280                         break;
1281         case 2:
1282                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1283                                         dev->wiphy.interface_modes))
1284                                 goto nla_put_failure;
1285                 (*split_start)++;
1286                 if (split)
1287                         break;
1288         case 3:
1289                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1290                 if (!nl_bands)
1291                         goto nla_put_failure;
1292
1293                 for (band = *band_start; band < IEEE80211_NUM_BANDS; band++) {
1294                         struct ieee80211_supported_band *sband;
1295
1296                         sband = dev->wiphy.bands[band];
1297
1298                         if (!sband)
1299                                 continue;
1300
1301                         nl_band = nla_nest_start(msg, band);
1302                         if (!nl_band)
1303                                 goto nla_put_failure;
1304
1305                         switch (*chan_start) {
1306                         case 0:
1307                                 if (nl80211_send_band_rateinfo(msg, sband))
1308                                         goto nla_put_failure;
1309                                 (*chan_start)++;
1310                                 if (split)
1311                                         break;
1312                         default:
1313                                 /* add frequencies */
1314                                 nl_freqs = nla_nest_start(
1315                                         msg, NL80211_BAND_ATTR_FREQS);
1316                                 if (!nl_freqs)
1317                                         goto nla_put_failure;
1318
1319                                 for (i = *chan_start - 1;
1320                                      i < sband->n_channels;
1321                                      i++) {
1322                                         nl_freq = nla_nest_start(msg, i);
1323                                         if (!nl_freq)
1324                                                 goto nla_put_failure;
1325
1326                                         chan = &sband->channels[i];
1327
1328                                         if (nl80211_msg_put_channel(msg, chan,
1329                                                                     split))
1330                                                 goto nla_put_failure;
1331
1332                                         nla_nest_end(msg, nl_freq);
1333                                         if (split)
1334                                                 break;
1335                                 }
1336                                 if (i < sband->n_channels)
1337                                         *chan_start = i + 2;
1338                                 else
1339                                         *chan_start = 0;
1340                                 nla_nest_end(msg, nl_freqs);
1341                         }
1342
1343                         nla_nest_end(msg, nl_band);
1344
1345                         if (split) {
1346                                 /* start again here */
1347                                 if (*chan_start)
1348                                         band--;
1349                                 break;
1350                         }
1351                 }
1352                 nla_nest_end(msg, nl_bands);
1353
1354                 if (band < IEEE80211_NUM_BANDS)
1355                         *band_start = band + 1;
1356                 else
1357                         *band_start = 0;
1358
1359                 /* if bands & channels are done, continue outside */
1360                 if (*band_start == 0 && *chan_start == 0)
1361                         (*split_start)++;
1362                 if (split)
1363                         break;
1364         case 4:
1365                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1366                 if (!nl_cmds)
1367                         goto nla_put_failure;
1368
1369                 i = 0;
1370 #define CMD(op, n)                                                      \
1371                  do {                                                   \
1372                         if (dev->ops->op) {                             \
1373                                 i++;                                    \
1374                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1375                                         goto nla_put_failure;           \
1376                         }                                               \
1377                 } while (0)
1378
1379                 CMD(add_virtual_intf, NEW_INTERFACE);
1380                 CMD(change_virtual_intf, SET_INTERFACE);
1381                 CMD(add_key, NEW_KEY);
1382                 CMD(start_ap, START_AP);
1383                 CMD(add_station, NEW_STATION);
1384                 CMD(add_mpath, NEW_MPATH);
1385                 CMD(update_mesh_config, SET_MESH_CONFIG);
1386                 CMD(change_bss, SET_BSS);
1387                 CMD(auth, AUTHENTICATE);
1388                 CMD(assoc, ASSOCIATE);
1389                 CMD(deauth, DEAUTHENTICATE);
1390                 CMD(disassoc, DISASSOCIATE);
1391                 CMD(join_ibss, JOIN_IBSS);
1392                 CMD(join_mesh, JOIN_MESH);
1393                 CMD(set_pmksa, SET_PMKSA);
1394                 CMD(del_pmksa, DEL_PMKSA);
1395                 CMD(flush_pmksa, FLUSH_PMKSA);
1396                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1397                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1398                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1399                 CMD(mgmt_tx, FRAME);
1400                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1401                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1402                         i++;
1403                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1404                                 goto nla_put_failure;
1405                 }
1406                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1407                     dev->ops->join_mesh) {
1408                         i++;
1409                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1410                                 goto nla_put_failure;
1411                 }
1412                 CMD(set_wds_peer, SET_WDS_PEER);
1413                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1414                         CMD(tdls_mgmt, TDLS_MGMT);
1415                         CMD(tdls_oper, TDLS_OPER);
1416                 }
1417                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1418                         CMD(sched_scan_start, START_SCHED_SCAN);
1419                 CMD(probe_client, PROBE_CLIENT);
1420                 CMD(set_noack_map, SET_NOACK_MAP);
1421                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1422                         i++;
1423                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1424                                 goto nla_put_failure;
1425                 }
1426                 CMD(start_p2p_device, START_P2P_DEVICE);
1427                 CMD(set_mcast_rate, SET_MCAST_RATE);
1428                 if (split) {
1429                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1430                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1431                 }
1432
1433 #ifdef CONFIG_NL80211_TESTMODE
1434                 CMD(testmode_cmd, TESTMODE);
1435 #endif
1436
1437 #undef CMD
1438
1439                 if (dev->ops->connect || dev->ops->auth) {
1440                         i++;
1441                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1442                                 goto nla_put_failure;
1443                 }
1444
1445                 if (dev->ops->disconnect || dev->ops->deauth) {
1446                         i++;
1447                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1448                                 goto nla_put_failure;
1449                 }
1450
1451                 nla_nest_end(msg, nl_cmds);
1452                 (*split_start)++;
1453                 if (split)
1454                         break;
1455         case 5:
1456                 if (dev->ops->remain_on_channel &&
1457                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1458                     nla_put_u32(msg,
1459                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1460                                 dev->wiphy.max_remain_on_channel_duration))
1461                         goto nla_put_failure;
1462
1463                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1464                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1465                         goto nla_put_failure;
1466
1467                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1468                         goto nla_put_failure;
1469                 (*split_start)++;
1470                 if (split)
1471                         break;
1472         case 6:
1473 #ifdef CONFIG_PM
1474                 if (nl80211_send_wowlan(msg, dev, split))
1475                         goto nla_put_failure;
1476                 (*split_start)++;
1477                 if (split)
1478                         break;
1479 #else
1480                 (*split_start)++;
1481 #endif
1482         case 7:
1483                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1484                                         dev->wiphy.software_iftypes))
1485                         goto nla_put_failure;
1486
1487                 if (nl80211_put_iface_combinations(&dev->wiphy, msg, split))
1488                         goto nla_put_failure;
1489
1490                 (*split_start)++;
1491                 if (split)
1492                         break;
1493         case 8:
1494                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1495                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1496                                 dev->wiphy.ap_sme_capa))
1497                         goto nla_put_failure;
1498
1499                 features = dev->wiphy.features;
1500                 /*
1501                  * We can only add the per-channel limit information if the
1502                  * dump is split, otherwise it makes it too big. Therefore
1503                  * only advertise it in that case.
1504                  */
1505                 if (split)
1506                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1507                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1508                         goto nla_put_failure;
1509
1510                 if (dev->wiphy.ht_capa_mod_mask &&
1511                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1512                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1513                             dev->wiphy.ht_capa_mod_mask))
1514                         goto nla_put_failure;
1515
1516                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1517                     dev->wiphy.max_acl_mac_addrs &&
1518                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1519                                 dev->wiphy.max_acl_mac_addrs))
1520                         goto nla_put_failure;
1521
1522                 /*
1523                  * Any information below this point is only available to
1524                  * applications that can deal with it being split. This
1525                  * helps ensure that newly added capabilities don't break
1526                  * older tools by overrunning their buffers.
1527                  *
1528                  * We still increment split_start so that in the split
1529                  * case we'll continue with more data in the next round,
1530                  * but break unconditionally so unsplit data stops here.
1531                  */
1532                 (*split_start)++;
1533                 break;
1534         case 9:
1535                 if (dev->wiphy.extended_capabilities &&
1536                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1537                              dev->wiphy.extended_capabilities_len,
1538                              dev->wiphy.extended_capabilities) ||
1539                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1540                              dev->wiphy.extended_capabilities_len,
1541                              dev->wiphy.extended_capabilities_mask)))
1542                         goto nla_put_failure;
1543
1544                 if (dev->wiphy.vht_capa_mod_mask &&
1545                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1546                             sizeof(*dev->wiphy.vht_capa_mod_mask),
1547                             dev->wiphy.vht_capa_mod_mask))
1548                         goto nla_put_failure;
1549
1550                 /* done */
1551                 *split_start = 0;
1552                 break;
1553         }
1554         return genlmsg_end(msg, hdr);
1555
1556  nla_put_failure:
1557         genlmsg_cancel(msg, hdr);
1558         return -EMSGSIZE;
1559 }
1560
1561 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1562 {
1563         int idx = 0, ret;
1564         int start = cb->args[0];
1565         struct cfg80211_registered_device *dev;
1566         s64 filter_wiphy = -1;
1567         bool split = false;
1568         struct nlattr **tb = nl80211_fam.attrbuf;
1569         int res;
1570
1571         mutex_lock(&cfg80211_mutex);
1572         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1573                           tb, nl80211_fam.maxattr, nl80211_policy);
1574         if (res == 0) {
1575                 split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1576                 if (tb[NL80211_ATTR_WIPHY])
1577                         filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1578                 if (tb[NL80211_ATTR_WDEV])
1579                         filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1580                 if (tb[NL80211_ATTR_IFINDEX]) {
1581                         struct net_device *netdev;
1582                         int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1583
1584                         netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
1585                         if (!netdev) {
1586                                 mutex_unlock(&cfg80211_mutex);
1587                                 return -ENODEV;
1588                         }
1589                         if (netdev->ieee80211_ptr) {
1590                                 dev = wiphy_to_dev(
1591                                         netdev->ieee80211_ptr->wiphy);
1592                                 filter_wiphy = dev->wiphy_idx;
1593                         }
1594                         dev_put(netdev);
1595                 }
1596         }
1597
1598         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1599                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1600                         continue;
1601                 if (++idx <= start)
1602                         continue;
1603                 if (filter_wiphy != -1 && dev->wiphy_idx != filter_wiphy)
1604                         continue;
1605                 /* attempt to fit multiple wiphy data chunks into the skb */
1606                 do {
1607                         ret = nl80211_send_wiphy(dev, skb,
1608                                                  NETLINK_CB(cb->skb).portid,
1609                                                  cb->nlh->nlmsg_seq,
1610                                                  NLM_F_MULTI,
1611                                                  split, &cb->args[1],
1612                                                  &cb->args[2],
1613                                                  &cb->args[3]);
1614                         if (ret < 0) {
1615                                 /*
1616                                  * If sending the wiphy data didn't fit (ENOBUFS
1617                                  * or EMSGSIZE returned), this SKB is still
1618                                  * empty (so it's not too big because another
1619                                  * wiphy dataset is already in the skb) and
1620                                  * we've not tried to adjust the dump allocation
1621                                  * yet ... then adjust the alloc size to be
1622                                  * bigger, and return 1 but with the empty skb.
1623                                  * This results in an empty message being RX'ed
1624                                  * in userspace, but that is ignored.
1625                                  *
1626                                  * We can then retry with the larger buffer.
1627                                  */
1628                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1629                                     !skb->len &&
1630                                     cb->min_dump_alloc < 4096) {
1631                                         cb->min_dump_alloc = 4096;
1632                                         mutex_unlock(&cfg80211_mutex);
1633                                         return 1;
1634                                 }
1635                                 idx--;
1636                                 break;
1637                         }
1638                 } while (cb->args[1] > 0);
1639                 break;
1640         }
1641         mutex_unlock(&cfg80211_mutex);
1642
1643         cb->args[0] = idx;
1644
1645         return skb->len;
1646 }
1647
1648 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1649 {
1650         struct sk_buff *msg;
1651         struct cfg80211_registered_device *dev = info->user_ptr[0];
1652
1653         msg = nlmsg_new(4096, GFP_KERNEL);
1654         if (!msg)
1655                 return -ENOMEM;
1656
1657         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1658                                false, NULL, NULL, NULL) < 0) {
1659                 nlmsg_free(msg);
1660                 return -ENOBUFS;
1661         }
1662
1663         return genlmsg_reply(msg, info);
1664 }
1665
1666 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1667         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1668         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1669         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1670         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1671         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1672 };
1673
1674 static int parse_txq_params(struct nlattr *tb[],
1675                             struct ieee80211_txq_params *txq_params)
1676 {
1677         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1678             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1679             !tb[NL80211_TXQ_ATTR_AIFS])
1680                 return -EINVAL;
1681
1682         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1683         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1684         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1685         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1686         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1687
1688         if (txq_params->ac >= NL80211_NUM_ACS)
1689                 return -EINVAL;
1690
1691         return 0;
1692 }
1693
1694 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1695 {
1696         /*
1697          * You can only set the channel explicitly for WDS interfaces,
1698          * all others have their channel managed via their respective
1699          * "establish a connection" command (connect, join, ...)
1700          *
1701          * For AP/GO and mesh mode, the channel can be set with the
1702          * channel userspace API, but is only stored and passed to the
1703          * low-level driver when the AP starts or the mesh is joined.
1704          * This is for backward compatibility, userspace can also give
1705          * the channel in the start-ap or join-mesh commands instead.
1706          *
1707          * Monitors are special as they are normally slaved to
1708          * whatever else is going on, so they have their own special
1709          * operation to set the monitor channel if possible.
1710          */
1711         return !wdev ||
1712                 wdev->iftype == NL80211_IFTYPE_AP ||
1713                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1714                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1715                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1716 }
1717
1718 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1719                                  struct genl_info *info,
1720                                  struct cfg80211_chan_def *chandef)
1721 {
1722         u32 control_freq;
1723
1724         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1725                 return -EINVAL;
1726
1727         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1728
1729         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1730         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1731         chandef->center_freq1 = control_freq;
1732         chandef->center_freq2 = 0;
1733
1734         /* Primary channel not allowed */
1735         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1736                 return -EINVAL;
1737
1738         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1739                 enum nl80211_channel_type chantype;
1740
1741                 chantype = nla_get_u32(
1742                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1743
1744                 switch (chantype) {
1745                 case NL80211_CHAN_NO_HT:
1746                 case NL80211_CHAN_HT20:
1747                 case NL80211_CHAN_HT40PLUS:
1748                 case NL80211_CHAN_HT40MINUS:
1749                         cfg80211_chandef_create(chandef, chandef->chan,
1750                                                 chantype);
1751                         break;
1752                 default:
1753                         return -EINVAL;
1754                 }
1755         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1756                 chandef->width =
1757                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1758                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1759                         chandef->center_freq1 =
1760                                 nla_get_u32(
1761                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1762                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1763                         chandef->center_freq2 =
1764                                 nla_get_u32(
1765                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1766         }
1767
1768         if (!cfg80211_chandef_valid(chandef))
1769                 return -EINVAL;
1770
1771         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1772                                      IEEE80211_CHAN_DISABLED))
1773                 return -EINVAL;
1774
1775         return 0;
1776 }
1777
1778 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1779                                  struct wireless_dev *wdev,
1780                                  struct genl_info *info)
1781 {
1782         struct cfg80211_chan_def chandef;
1783         int result;
1784         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1785
1786         if (wdev)
1787                 iftype = wdev->iftype;
1788
1789         if (!nl80211_can_set_dev_channel(wdev))
1790                 return -EOPNOTSUPP;
1791
1792         result = nl80211_parse_chandef(rdev, info, &chandef);
1793         if (result)
1794                 return result;
1795
1796         mutex_lock(&rdev->devlist_mtx);
1797         switch (iftype) {
1798         case NL80211_IFTYPE_AP:
1799         case NL80211_IFTYPE_P2P_GO:
1800                 if (wdev->beacon_interval) {
1801                         result = -EBUSY;
1802                         break;
1803                 }
1804                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1805                         result = -EINVAL;
1806                         break;
1807                 }
1808                 wdev->preset_chandef = chandef;
1809                 result = 0;
1810                 break;
1811         case NL80211_IFTYPE_MESH_POINT:
1812                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1813                 break;
1814         case NL80211_IFTYPE_MONITOR:
1815                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1816                 break;
1817         default:
1818                 result = -EINVAL;
1819         }
1820         mutex_unlock(&rdev->devlist_mtx);
1821
1822         return result;
1823 }
1824
1825 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1826 {
1827         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1828         struct net_device *netdev = info->user_ptr[1];
1829
1830         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1831 }
1832
1833 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1834 {
1835         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1836         struct net_device *dev = info->user_ptr[1];
1837         struct wireless_dev *wdev = dev->ieee80211_ptr;
1838         const u8 *bssid;
1839
1840         if (!info->attrs[NL80211_ATTR_MAC])
1841                 return -EINVAL;
1842
1843         if (netif_running(dev))
1844                 return -EBUSY;
1845
1846         if (!rdev->ops->set_wds_peer)
1847                 return -EOPNOTSUPP;
1848
1849         if (wdev->iftype != NL80211_IFTYPE_WDS)
1850                 return -EOPNOTSUPP;
1851
1852         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1853         return rdev_set_wds_peer(rdev, dev, bssid);
1854 }
1855
1856
1857 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1858 {
1859         struct cfg80211_registered_device *rdev;
1860         struct net_device *netdev = NULL;
1861         struct wireless_dev *wdev;
1862         int result = 0, rem_txq_params = 0;
1863         struct nlattr *nl_txq_params;
1864         u32 changed;
1865         u8 retry_short = 0, retry_long = 0;
1866         u32 frag_threshold = 0, rts_threshold = 0;
1867         u8 coverage_class = 0;
1868
1869         /*
1870          * Try to find the wiphy and netdev. Normally this
1871          * function shouldn't need the netdev, but this is
1872          * done for backward compatibility -- previously
1873          * setting the channel was done per wiphy, but now
1874          * it is per netdev. Previous userland like hostapd
1875          * also passed a netdev to set_wiphy, so that it is
1876          * possible to let that go to the right netdev!
1877          */
1878         mutex_lock(&cfg80211_mutex);
1879
1880         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1881                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1882
1883                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1884                 if (netdev && netdev->ieee80211_ptr) {
1885                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1886                         mutex_lock(&rdev->mtx);
1887                 } else
1888                         netdev = NULL;
1889         }
1890
1891         if (!netdev) {
1892                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1893                                                   info->attrs);
1894                 if (IS_ERR(rdev)) {
1895                         mutex_unlock(&cfg80211_mutex);
1896                         return PTR_ERR(rdev);
1897                 }
1898                 wdev = NULL;
1899                 netdev = NULL;
1900                 result = 0;
1901
1902                 mutex_lock(&rdev->mtx);
1903         } else
1904                 wdev = netdev->ieee80211_ptr;
1905
1906         /*
1907          * end workaround code, by now the rdev is available
1908          * and locked, and wdev may or may not be NULL.
1909          */
1910
1911         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1912                 result = cfg80211_dev_rename(
1913                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1914
1915         mutex_unlock(&cfg80211_mutex);
1916
1917         if (result)
1918                 goto bad_res;
1919
1920         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1921                 struct ieee80211_txq_params txq_params;
1922                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1923
1924                 if (!rdev->ops->set_txq_params) {
1925                         result = -EOPNOTSUPP;
1926                         goto bad_res;
1927                 }
1928
1929                 if (!netdev) {
1930                         result = -EINVAL;
1931                         goto bad_res;
1932                 }
1933
1934                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1935                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1936                         result = -EINVAL;
1937                         goto bad_res;
1938                 }
1939
1940                 if (!netif_running(netdev)) {
1941                         result = -ENETDOWN;
1942                         goto bad_res;
1943                 }
1944
1945                 nla_for_each_nested(nl_txq_params,
1946                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1947                                     rem_txq_params) {
1948                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1949                                   nla_data(nl_txq_params),
1950                                   nla_len(nl_txq_params),
1951                                   txq_params_policy);
1952                         result = parse_txq_params(tb, &txq_params);
1953                         if (result)
1954                                 goto bad_res;
1955
1956                         result = rdev_set_txq_params(rdev, netdev,
1957                                                      &txq_params);
1958                         if (result)
1959                                 goto bad_res;
1960                 }
1961         }
1962
1963         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1964                 result = __nl80211_set_channel(rdev,
1965                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1966                                 info);
1967                 if (result)
1968                         goto bad_res;
1969         }
1970
1971         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1972                 struct wireless_dev *txp_wdev = wdev;
1973                 enum nl80211_tx_power_setting type;
1974                 int idx, mbm = 0;
1975
1976                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1977                         txp_wdev = NULL;
1978
1979                 if (!rdev->ops->set_tx_power) {
1980                         result = -EOPNOTSUPP;
1981                         goto bad_res;
1982                 }
1983
1984                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1985                 type = nla_get_u32(info->attrs[idx]);
1986
1987                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1988                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1989                         result = -EINVAL;
1990                         goto bad_res;
1991                 }
1992
1993                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1994                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1995                         mbm = nla_get_u32(info->attrs[idx]);
1996                 }
1997
1998                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1999                 if (result)
2000                         goto bad_res;
2001         }
2002
2003         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2004             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2005                 u32 tx_ant, rx_ant;
2006                 if ((!rdev->wiphy.available_antennas_tx &&
2007                      !rdev->wiphy.available_antennas_rx) ||
2008                     !rdev->ops->set_antenna) {
2009                         result = -EOPNOTSUPP;
2010                         goto bad_res;
2011                 }
2012
2013                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2014                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2015
2016                 /* reject antenna configurations which don't match the
2017                  * available antenna masks, except for the "all" mask */
2018                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2019                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
2020                         result = -EINVAL;
2021                         goto bad_res;
2022                 }
2023
2024                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2025                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2026
2027                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2028                 if (result)
2029                         goto bad_res;
2030         }
2031
2032         changed = 0;
2033
2034         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2035                 retry_short = nla_get_u8(
2036                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2037                 if (retry_short == 0) {
2038                         result = -EINVAL;
2039                         goto bad_res;
2040                 }
2041                 changed |= WIPHY_PARAM_RETRY_SHORT;
2042         }
2043
2044         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2045                 retry_long = nla_get_u8(
2046                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2047                 if (retry_long == 0) {
2048                         result = -EINVAL;
2049                         goto bad_res;
2050                 }
2051                 changed |= WIPHY_PARAM_RETRY_LONG;
2052         }
2053
2054         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2055                 frag_threshold = nla_get_u32(
2056                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2057                 if (frag_threshold < 256) {
2058                         result = -EINVAL;
2059                         goto bad_res;
2060                 }
2061                 if (frag_threshold != (u32) -1) {
2062                         /*
2063                          * Fragments (apart from the last one) are required to
2064                          * have even length. Make the fragmentation code
2065                          * simpler by stripping LSB should someone try to use
2066                          * odd threshold value.
2067                          */
2068                         frag_threshold &= ~0x1;
2069                 }
2070                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2071         }
2072
2073         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2074                 rts_threshold = nla_get_u32(
2075                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2076                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2077         }
2078
2079         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2080                 coverage_class = nla_get_u8(
2081                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2082                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2083         }
2084
2085         if (changed) {
2086                 u8 old_retry_short, old_retry_long;
2087                 u32 old_frag_threshold, old_rts_threshold;
2088                 u8 old_coverage_class;
2089
2090                 if (!rdev->ops->set_wiphy_params) {
2091                         result = -EOPNOTSUPP;
2092                         goto bad_res;
2093                 }
2094
2095                 old_retry_short = rdev->wiphy.retry_short;
2096                 old_retry_long = rdev->wiphy.retry_long;
2097                 old_frag_threshold = rdev->wiphy.frag_threshold;
2098                 old_rts_threshold = rdev->wiphy.rts_threshold;
2099                 old_coverage_class = rdev->wiphy.coverage_class;
2100
2101                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2102                         rdev->wiphy.retry_short = retry_short;
2103                 if (changed & WIPHY_PARAM_RETRY_LONG)
2104                         rdev->wiphy.retry_long = retry_long;
2105                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2106                         rdev->wiphy.frag_threshold = frag_threshold;
2107                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2108                         rdev->wiphy.rts_threshold = rts_threshold;
2109                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2110                         rdev->wiphy.coverage_class = coverage_class;
2111
2112                 result = rdev_set_wiphy_params(rdev, changed);
2113                 if (result) {
2114                         rdev->wiphy.retry_short = old_retry_short;
2115                         rdev->wiphy.retry_long = old_retry_long;
2116                         rdev->wiphy.frag_threshold = old_frag_threshold;
2117                         rdev->wiphy.rts_threshold = old_rts_threshold;
2118                         rdev->wiphy.coverage_class = old_coverage_class;
2119                 }
2120         }
2121
2122  bad_res:
2123         mutex_unlock(&rdev->mtx);
2124         if (netdev)
2125                 dev_put(netdev);
2126         return result;
2127 }
2128
2129 static inline u64 wdev_id(struct wireless_dev *wdev)
2130 {
2131         return (u64)wdev->identifier |
2132                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2133 }
2134
2135 static int nl80211_send_chandef(struct sk_buff *msg,
2136                                  struct cfg80211_chan_def *chandef)
2137 {
2138         WARN_ON(!cfg80211_chandef_valid(chandef));
2139
2140         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2141                         chandef->chan->center_freq))
2142                 return -ENOBUFS;
2143         switch (chandef->width) {
2144         case NL80211_CHAN_WIDTH_20_NOHT:
2145         case NL80211_CHAN_WIDTH_20:
2146         case NL80211_CHAN_WIDTH_40:
2147                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2148                                 cfg80211_get_chandef_type(chandef)))
2149                         return -ENOBUFS;
2150                 break;
2151         default:
2152                 break;
2153         }
2154         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2155                 return -ENOBUFS;
2156         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2157                 return -ENOBUFS;
2158         if (chandef->center_freq2 &&
2159             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2160                 return -ENOBUFS;
2161         return 0;
2162 }
2163
2164 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2165                               struct cfg80211_registered_device *rdev,
2166                               struct wireless_dev *wdev)
2167 {
2168         struct net_device *dev = wdev->netdev;
2169         void *hdr;
2170
2171         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2172         if (!hdr)
2173                 return -1;
2174
2175         if (dev &&
2176             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2177              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2178                 goto nla_put_failure;
2179
2180         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2181             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2182             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2183             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2184             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2185                         rdev->devlist_generation ^
2186                         (cfg80211_rdev_list_generation << 2)))
2187                 goto nla_put_failure;
2188
2189         if (rdev->ops->get_channel) {
2190                 int ret;
2191                 struct cfg80211_chan_def chandef;
2192
2193                 ret = rdev_get_channel(rdev, wdev, &chandef);
2194                 if (ret == 0) {
2195                         if (nl80211_send_chandef(msg, &chandef))
2196                                 goto nla_put_failure;
2197                 }
2198         }
2199
2200         if (wdev->ssid_len) {
2201                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2202                         goto nla_put_failure;
2203         }
2204
2205         return genlmsg_end(msg, hdr);
2206
2207  nla_put_failure:
2208         genlmsg_cancel(msg, hdr);
2209         return -EMSGSIZE;
2210 }
2211
2212 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2213 {
2214         int wp_idx = 0;
2215         int if_idx = 0;
2216         int wp_start = cb->args[0];
2217         int if_start = cb->args[1];
2218         struct cfg80211_registered_device *rdev;
2219         struct wireless_dev *wdev;
2220
2221         mutex_lock(&cfg80211_mutex);
2222         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2223                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2224                         continue;
2225                 if (wp_idx < wp_start) {
2226                         wp_idx++;
2227                         continue;
2228                 }
2229                 if_idx = 0;
2230
2231                 mutex_lock(&rdev->devlist_mtx);
2232                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2233                         if (if_idx < if_start) {
2234                                 if_idx++;
2235                                 continue;
2236                         }
2237                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2238                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2239                                                rdev, wdev) < 0) {
2240                                 mutex_unlock(&rdev->devlist_mtx);
2241                                 goto out;
2242                         }
2243                         if_idx++;
2244                 }
2245                 mutex_unlock(&rdev->devlist_mtx);
2246
2247                 wp_idx++;
2248         }
2249  out:
2250         mutex_unlock(&cfg80211_mutex);
2251
2252         cb->args[0] = wp_idx;
2253         cb->args[1] = if_idx;
2254
2255         return skb->len;
2256 }
2257
2258 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2259 {
2260         struct sk_buff *msg;
2261         struct cfg80211_registered_device *dev = info->user_ptr[0];
2262         struct wireless_dev *wdev = info->user_ptr[1];
2263
2264         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2265         if (!msg)
2266                 return -ENOMEM;
2267
2268         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2269                                dev, wdev) < 0) {
2270                 nlmsg_free(msg);
2271                 return -ENOBUFS;
2272         }
2273
2274         return genlmsg_reply(msg, info);
2275 }
2276
2277 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2278         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2279         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2280         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2281         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2282         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2283 };
2284
2285 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2286 {
2287         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2288         int flag;
2289
2290         *mntrflags = 0;
2291
2292         if (!nla)
2293                 return -EINVAL;
2294
2295         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2296                              nla, mntr_flags_policy))
2297                 return -EINVAL;
2298
2299         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2300                 if (flags[flag])
2301                         *mntrflags |= (1<<flag);
2302
2303         return 0;
2304 }
2305
2306 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2307                                struct net_device *netdev, u8 use_4addr,
2308                                enum nl80211_iftype iftype)
2309 {
2310         if (!use_4addr) {
2311                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2312                         return -EBUSY;
2313                 return 0;
2314         }
2315
2316         switch (iftype) {
2317         case NL80211_IFTYPE_AP_VLAN:
2318                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2319                         return 0;
2320                 break;
2321         case NL80211_IFTYPE_STATION:
2322                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2323                         return 0;
2324                 break;
2325         default:
2326                 break;
2327         }
2328
2329         return -EOPNOTSUPP;
2330 }
2331
2332 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2333 {
2334         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2335         struct vif_params params;
2336         int err;
2337         enum nl80211_iftype otype, ntype;
2338         struct net_device *dev = info->user_ptr[1];
2339         u32 _flags, *flags = NULL;
2340         bool change = false;
2341
2342         memset(&params, 0, sizeof(params));
2343
2344         otype = ntype = dev->ieee80211_ptr->iftype;
2345
2346         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2347                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2348                 if (otype != ntype)
2349                         change = true;
2350                 if (ntype > NL80211_IFTYPE_MAX)
2351                         return -EINVAL;
2352         }
2353
2354         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2355                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2356
2357                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2358                         return -EINVAL;
2359                 if (netif_running(dev))
2360                         return -EBUSY;
2361
2362                 wdev_lock(wdev);
2363                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2364                              IEEE80211_MAX_MESH_ID_LEN);
2365                 wdev->mesh_id_up_len =
2366                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2367                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2368                        wdev->mesh_id_up_len);
2369                 wdev_unlock(wdev);
2370         }
2371
2372         if (info->attrs[NL80211_ATTR_4ADDR]) {
2373                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2374                 change = true;
2375                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2376                 if (err)
2377                         return err;
2378         } else {
2379                 params.use_4addr = -1;
2380         }
2381
2382         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2383                 if (ntype != NL80211_IFTYPE_MONITOR)
2384                         return -EINVAL;
2385                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2386                                           &_flags);
2387                 if (err)
2388                         return err;
2389
2390                 flags = &_flags;
2391                 change = true;
2392         }
2393
2394         if (change)
2395                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2396         else
2397                 err = 0;
2398
2399         if (!err && params.use_4addr != -1)
2400                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2401
2402         return err;
2403 }
2404
2405 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2406 {
2407         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2408         struct vif_params params;
2409         struct wireless_dev *wdev;
2410         struct sk_buff *msg;
2411         int err;
2412         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2413         u32 flags;
2414
2415         memset(&params, 0, sizeof(params));
2416
2417         if (!info->attrs[NL80211_ATTR_IFNAME])
2418                 return -EINVAL;
2419
2420         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2421                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2422                 if (type > NL80211_IFTYPE_MAX)
2423                         return -EINVAL;
2424         }
2425
2426         if (!rdev->ops->add_virtual_intf ||
2427             !(rdev->wiphy.interface_modes & (1 << type)))
2428                 return -EOPNOTSUPP;
2429
2430         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2431                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2432                            ETH_ALEN);
2433                 if (!is_valid_ether_addr(params.macaddr))
2434                         return -EADDRNOTAVAIL;
2435         }
2436
2437         if (info->attrs[NL80211_ATTR_4ADDR]) {
2438                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2439                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2440                 if (err)
2441                         return err;
2442         }
2443
2444         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2445         if (!msg)
2446                 return -ENOMEM;
2447
2448         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2449                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2450                                   &flags);
2451         wdev = rdev_add_virtual_intf(rdev,
2452                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2453                                 type, err ? NULL : &flags, &params);
2454         if (IS_ERR(wdev)) {
2455                 nlmsg_free(msg);
2456                 return PTR_ERR(wdev);
2457         }
2458
2459         switch (type) {
2460         case NL80211_IFTYPE_MESH_POINT:
2461                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2462                         break;
2463                 wdev_lock(wdev);
2464                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2465                              IEEE80211_MAX_MESH_ID_LEN);
2466                 wdev->mesh_id_up_len =
2467                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2468                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2469                        wdev->mesh_id_up_len);
2470                 wdev_unlock(wdev);
2471                 break;
2472         case NL80211_IFTYPE_P2P_DEVICE:
2473                 /*
2474                  * P2P Device doesn't have a netdev, so doesn't go
2475                  * through the netdev notifier and must be added here
2476                  */
2477                 mutex_init(&wdev->mtx);
2478                 INIT_LIST_HEAD(&wdev->event_list);
2479                 spin_lock_init(&wdev->event_lock);
2480                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2481                 spin_lock_init(&wdev->mgmt_registrations_lock);
2482
2483                 mutex_lock(&rdev->devlist_mtx);
2484                 wdev->identifier = ++rdev->wdev_id;
2485                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2486                 rdev->devlist_generation++;
2487                 mutex_unlock(&rdev->devlist_mtx);
2488                 break;
2489         default:
2490                 break;
2491         }
2492
2493         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2494                                rdev, wdev) < 0) {
2495                 nlmsg_free(msg);
2496                 return -ENOBUFS;
2497         }
2498
2499         return genlmsg_reply(msg, info);
2500 }
2501
2502 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2503 {
2504         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2505         struct wireless_dev *wdev = info->user_ptr[1];
2506
2507         if (!rdev->ops->del_virtual_intf)
2508                 return -EOPNOTSUPP;
2509
2510         /*
2511          * If we remove a wireless device without a netdev then clear
2512          * user_ptr[1] so that nl80211_post_doit won't dereference it
2513          * to check if it needs to do dev_put(). Otherwise it crashes
2514          * since the wdev has been freed, unlike with a netdev where
2515          * we need the dev_put() for the netdev to really be freed.
2516          */
2517         if (!wdev->netdev)
2518                 info->user_ptr[1] = NULL;
2519
2520         return rdev_del_virtual_intf(rdev, wdev);
2521 }
2522
2523 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2524 {
2525         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2526         struct net_device *dev = info->user_ptr[1];
2527         u16 noack_map;
2528
2529         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2530                 return -EINVAL;
2531
2532         if (!rdev->ops->set_noack_map)
2533                 return -EOPNOTSUPP;
2534
2535         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2536
2537         return rdev_set_noack_map(rdev, dev, noack_map);
2538 }
2539
2540 struct get_key_cookie {
2541         struct sk_buff *msg;
2542         int error;
2543         int idx;
2544 };
2545
2546 static void get_key_callback(void *c, struct key_params *params)
2547 {
2548         struct nlattr *key;
2549         struct get_key_cookie *cookie = c;
2550
2551         if ((params->key &&
2552              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2553                      params->key_len, params->key)) ||
2554             (params->seq &&
2555              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2556                      params->seq_len, params->seq)) ||
2557             (params->cipher &&
2558              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2559                          params->cipher)))
2560                 goto nla_put_failure;
2561
2562         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2563         if (!key)
2564                 goto nla_put_failure;
2565
2566         if ((params->key &&
2567              nla_put(cookie->msg, NL80211_KEY_DATA,
2568                      params->key_len, params->key)) ||
2569             (params->seq &&
2570              nla_put(cookie->msg, NL80211_KEY_SEQ,
2571                      params->seq_len, params->seq)) ||
2572             (params->cipher &&
2573              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2574                          params->cipher)))
2575                 goto nla_put_failure;
2576
2577         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2578                 goto nla_put_failure;
2579
2580         nla_nest_end(cookie->msg, key);
2581
2582         return;
2583  nla_put_failure:
2584         cookie->error = 1;
2585 }
2586
2587 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2588 {
2589         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2590         int err;
2591         struct net_device *dev = info->user_ptr[1];
2592         u8 key_idx = 0;
2593         const u8 *mac_addr = NULL;
2594         bool pairwise;
2595         struct get_key_cookie cookie = {
2596                 .error = 0,
2597         };
2598         void *hdr;
2599         struct sk_buff *msg;
2600
2601         if (info->attrs[NL80211_ATTR_KEY_IDX])
2602                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2603
2604         if (key_idx > 5)
2605                 return -EINVAL;
2606
2607         if (info->attrs[NL80211_ATTR_MAC])
2608                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2609
2610         pairwise = !!mac_addr;
2611         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2612                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2613                 if (kt >= NUM_NL80211_KEYTYPES)
2614                         return -EINVAL;
2615                 if (kt != NL80211_KEYTYPE_GROUP &&
2616                     kt != NL80211_KEYTYPE_PAIRWISE)
2617                         return -EINVAL;
2618                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2619         }
2620
2621         if (!rdev->ops->get_key)
2622                 return -EOPNOTSUPP;
2623
2624         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2625         if (!msg)
2626                 return -ENOMEM;
2627
2628         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2629                              NL80211_CMD_NEW_KEY);
2630         if (IS_ERR(hdr))
2631                 return PTR_ERR(hdr);
2632
2633         cookie.msg = msg;
2634         cookie.idx = key_idx;
2635
2636         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2637             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2638                 goto nla_put_failure;
2639         if (mac_addr &&
2640             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2641                 goto nla_put_failure;
2642
2643         if (pairwise && mac_addr &&
2644             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2645                 return -ENOENT;
2646
2647         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2648                            get_key_callback);
2649
2650         if (err)
2651                 goto free_msg;
2652
2653         if (cookie.error)
2654                 goto nla_put_failure;
2655
2656         genlmsg_end(msg, hdr);
2657         return genlmsg_reply(msg, info);
2658
2659  nla_put_failure:
2660         err = -ENOBUFS;
2661  free_msg:
2662         nlmsg_free(msg);
2663         return err;
2664 }
2665
2666 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2667 {
2668         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2669         struct key_parse key;
2670         int err;
2671         struct net_device *dev = info->user_ptr[1];
2672
2673         err = nl80211_parse_key(info, &key);
2674         if (err)
2675                 return err;
2676
2677         if (key.idx < 0)
2678                 return -EINVAL;
2679
2680         /* only support setting default key */
2681         if (!key.def && !key.defmgmt)
2682                 return -EINVAL;
2683
2684         wdev_lock(dev->ieee80211_ptr);
2685
2686         if (key.def) {
2687                 if (!rdev->ops->set_default_key) {
2688                         err = -EOPNOTSUPP;
2689                         goto out;
2690                 }
2691
2692                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2693                 if (err)
2694                         goto out;
2695
2696                 err = rdev_set_default_key(rdev, dev, key.idx,
2697                                                  key.def_uni, key.def_multi);
2698
2699                 if (err)
2700                         goto out;
2701
2702 #ifdef CONFIG_CFG80211_WEXT
2703                 dev->ieee80211_ptr->wext.default_key = key.idx;
2704 #endif
2705         } else {
2706                 if (key.def_uni || !key.def_multi) {
2707                         err = -EINVAL;
2708                         goto out;
2709                 }
2710
2711                 if (!rdev->ops->set_default_mgmt_key) {
2712                         err = -EOPNOTSUPP;
2713                         goto out;
2714                 }
2715
2716                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2717                 if (err)
2718                         goto out;
2719
2720                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2721                 if (err)
2722                         goto out;
2723
2724 #ifdef CONFIG_CFG80211_WEXT
2725                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2726 #endif
2727         }
2728
2729  out:
2730         wdev_unlock(dev->ieee80211_ptr);
2731
2732         return err;
2733 }
2734
2735 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2736 {
2737         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2738         int err;
2739         struct net_device *dev = info->user_ptr[1];
2740         struct key_parse key;
2741         const u8 *mac_addr = NULL;
2742
2743         err = nl80211_parse_key(info, &key);
2744         if (err)
2745                 return err;
2746
2747         if (!key.p.key)
2748                 return -EINVAL;
2749
2750         if (info->attrs[NL80211_ATTR_MAC])
2751                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2752
2753         if (key.type == -1) {
2754                 if (mac_addr)
2755                         key.type = NL80211_KEYTYPE_PAIRWISE;
2756                 else
2757                         key.type = NL80211_KEYTYPE_GROUP;
2758         }
2759
2760         /* for now */
2761         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2762             key.type != NL80211_KEYTYPE_GROUP)
2763                 return -EINVAL;
2764
2765         if (!rdev->ops->add_key)
2766                 return -EOPNOTSUPP;
2767
2768         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2769                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2770                                            mac_addr))
2771                 return -EINVAL;
2772
2773         wdev_lock(dev->ieee80211_ptr);
2774         err = nl80211_key_allowed(dev->ieee80211_ptr);
2775         if (!err)
2776                 err = rdev_add_key(rdev, dev, key.idx,
2777                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2778                                     mac_addr, &key.p);
2779         wdev_unlock(dev->ieee80211_ptr);
2780
2781         return err;
2782 }
2783
2784 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2785 {
2786         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2787         int err;
2788         struct net_device *dev = info->user_ptr[1];
2789         u8 *mac_addr = NULL;
2790         struct key_parse key;
2791
2792         err = nl80211_parse_key(info, &key);
2793         if (err)
2794                 return err;
2795
2796         if (info->attrs[NL80211_ATTR_MAC])
2797                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2798
2799         if (key.type == -1) {
2800                 if (mac_addr)
2801                         key.type = NL80211_KEYTYPE_PAIRWISE;
2802                 else
2803                         key.type = NL80211_KEYTYPE_GROUP;
2804         }
2805
2806         /* for now */
2807         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2808             key.type != NL80211_KEYTYPE_GROUP)
2809                 return -EINVAL;
2810
2811         if (!rdev->ops->del_key)
2812                 return -EOPNOTSUPP;
2813
2814         wdev_lock(dev->ieee80211_ptr);
2815         err = nl80211_key_allowed(dev->ieee80211_ptr);
2816
2817         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2818             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2819                 err = -ENOENT;
2820
2821         if (!err)
2822                 err = rdev_del_key(rdev, dev, key.idx,
2823                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2824                                    mac_addr);
2825
2826 #ifdef CONFIG_CFG80211_WEXT
2827         if (!err) {
2828                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2829                         dev->ieee80211_ptr->wext.default_key = -1;
2830                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2831                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2832         }
2833 #endif
2834         wdev_unlock(dev->ieee80211_ptr);
2835
2836         return err;
2837 }
2838
2839 /* This function returns an error or the number of nested attributes */
2840 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2841 {
2842         struct nlattr *attr;
2843         int n_entries = 0, tmp;
2844
2845         nla_for_each_nested(attr, nl_attr, tmp) {
2846                 if (nla_len(attr) != ETH_ALEN)
2847                         return -EINVAL;
2848
2849                 n_entries++;
2850         }
2851
2852         return n_entries;
2853 }
2854
2855 /*
2856  * This function parses ACL information and allocates memory for ACL data.
2857  * On successful return, the calling function is responsible to free the
2858  * ACL buffer returned by this function.
2859  */
2860 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2861                                                 struct genl_info *info)
2862 {
2863         enum nl80211_acl_policy acl_policy;
2864         struct nlattr *attr;
2865         struct cfg80211_acl_data *acl;
2866         int i = 0, n_entries, tmp;
2867
2868         if (!wiphy->max_acl_mac_addrs)
2869                 return ERR_PTR(-EOPNOTSUPP);
2870
2871         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2872                 return ERR_PTR(-EINVAL);
2873
2874         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2875         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2876             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2877                 return ERR_PTR(-EINVAL);
2878
2879         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2880                 return ERR_PTR(-EINVAL);
2881
2882         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2883         if (n_entries < 0)
2884                 return ERR_PTR(n_entries);
2885
2886         if (n_entries > wiphy->max_acl_mac_addrs)
2887                 return ERR_PTR(-ENOTSUPP);
2888
2889         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2890                       GFP_KERNEL);
2891         if (!acl)
2892                 return ERR_PTR(-ENOMEM);
2893
2894         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2895                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2896                 i++;
2897         }
2898
2899         acl->n_acl_entries = n_entries;
2900         acl->acl_policy = acl_policy;
2901
2902         return acl;
2903 }
2904
2905 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2906 {
2907         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2908         struct net_device *dev = info->user_ptr[1];
2909         struct cfg80211_acl_data *acl;
2910         int err;
2911
2912         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2913             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2914                 return -EOPNOTSUPP;
2915
2916         if (!dev->ieee80211_ptr->beacon_interval)
2917                 return -EINVAL;
2918
2919         acl = parse_acl_data(&rdev->wiphy, info);
2920         if (IS_ERR(acl))
2921                 return PTR_ERR(acl);
2922
2923         err = rdev_set_mac_acl(rdev, dev, acl);
2924
2925         kfree(acl);
2926
2927         return err;
2928 }
2929
2930 static int nl80211_parse_beacon(struct genl_info *info,
2931                                 struct cfg80211_beacon_data *bcn)
2932 {
2933         bool haveinfo = false;
2934
2935         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2936             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2937             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2938             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2939                 return -EINVAL;
2940
2941         memset(bcn, 0, sizeof(*bcn));
2942
2943         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2944                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2945                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2946                 if (!bcn->head_len)
2947                         return -EINVAL;
2948                 haveinfo = true;
2949         }
2950
2951         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2952                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2953                 bcn->tail_len =
2954                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2955                 haveinfo = true;
2956         }
2957
2958         if (!haveinfo)
2959                 return -EINVAL;
2960
2961         if (info->attrs[NL80211_ATTR_IE]) {
2962                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2963                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2964         }
2965
2966         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2967                 bcn->proberesp_ies =
2968                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2969                 bcn->proberesp_ies_len =
2970                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2971         }
2972
2973         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2974                 bcn->assocresp_ies =
2975                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2976                 bcn->assocresp_ies_len =
2977                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2978         }
2979
2980         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2981                 bcn->probe_resp =
2982                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2983                 bcn->probe_resp_len =
2984                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2985         }
2986
2987         return 0;
2988 }
2989
2990 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2991                                    struct cfg80211_ap_settings *params)
2992 {
2993         struct wireless_dev *wdev;
2994         bool ret = false;
2995
2996         mutex_lock(&rdev->devlist_mtx);
2997
2998         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2999                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3000                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3001                         continue;
3002
3003                 if (!wdev->preset_chandef.chan)
3004                         continue;
3005
3006                 params->chandef = wdev->preset_chandef;
3007                 ret = true;
3008                 break;
3009         }
3010
3011         mutex_unlock(&rdev->devlist_mtx);
3012
3013         return ret;
3014 }
3015
3016 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3017                                     enum nl80211_auth_type auth_type,
3018                                     enum nl80211_commands cmd)
3019 {
3020         if (auth_type > NL80211_AUTHTYPE_MAX)
3021                 return false;
3022
3023         switch (cmd) {
3024         case NL80211_CMD_AUTHENTICATE:
3025                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3026                     auth_type == NL80211_AUTHTYPE_SAE)
3027                         return false;
3028                 return true;
3029         case NL80211_CMD_CONNECT:
3030         case NL80211_CMD_START_AP:
3031                 /* SAE not supported yet */
3032                 if (auth_type == NL80211_AUTHTYPE_SAE)
3033                         return false;
3034                 return true;
3035         default:
3036                 return false;
3037         }
3038 }
3039
3040 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3041 {
3042         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3043         struct net_device *dev = info->user_ptr[1];
3044         struct wireless_dev *wdev = dev->ieee80211_ptr;
3045         struct cfg80211_ap_settings params;
3046         int err;
3047         u8 radar_detect_width = 0;
3048
3049         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3050             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3051                 return -EOPNOTSUPP;
3052
3053         if (!rdev->ops->start_ap)
3054                 return -EOPNOTSUPP;
3055
3056         if (wdev->beacon_interval)
3057                 return -EALREADY;
3058
3059         memset(&params, 0, sizeof(params));
3060
3061         /* these are required for START_AP */
3062         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3063             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3064             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3065                 return -EINVAL;
3066
3067         err = nl80211_parse_beacon(info, &params.beacon);
3068         if (err)
3069                 return err;
3070
3071         params.beacon_interval =
3072                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3073         params.dtim_period =
3074                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3075
3076         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3077         if (err)
3078                 return err;
3079
3080         /*
3081          * In theory, some of these attributes should be required here
3082          * but since they were not used when the command was originally
3083          * added, keep them optional for old user space programs to let
3084          * them continue to work with drivers that do not need the
3085          * additional information -- drivers must check!
3086          */
3087         if (info->attrs[NL80211_ATTR_SSID]) {
3088                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3089                 params.ssid_len =
3090                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3091                 if (params.ssid_len == 0 ||
3092                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3093                         return -EINVAL;
3094         }
3095
3096         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3097                 params.hidden_ssid = nla_get_u32(
3098                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3099                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3100                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3101                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3102                         return -EINVAL;
3103         }
3104
3105         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3106
3107         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3108                 params.auth_type = nla_get_u32(
3109                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3110                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3111                                              NL80211_CMD_START_AP))
3112                         return -EINVAL;
3113         } else
3114                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3115
3116         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3117                                       NL80211_MAX_NR_CIPHER_SUITES);
3118         if (err)
3119                 return err;
3120
3121         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3122                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3123                         return -EOPNOTSUPP;
3124                 params.inactivity_timeout = nla_get_u16(
3125                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3126         }
3127
3128         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3129                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3130                         return -EINVAL;
3131                 params.p2p_ctwindow =
3132                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3133                 if (params.p2p_ctwindow > 127)
3134                         return -EINVAL;
3135                 if (params.p2p_ctwindow != 0 &&
3136                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3137                         return -EINVAL;
3138         }
3139
3140         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3141                 u8 tmp;
3142
3143                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3144                         return -EINVAL;
3145                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3146                 if (tmp > 1)
3147                         return -EINVAL;
3148                 params.p2p_opp_ps = tmp;
3149                 if (params.p2p_opp_ps != 0 &&
3150                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3151                         return -EINVAL;
3152         }
3153
3154         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3155                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3156                 if (err)
3157                         return err;
3158         } else if (wdev->preset_chandef.chan) {
3159                 params.chandef = wdev->preset_chandef;
3160         } else if (!nl80211_get_ap_channel(rdev, &params))
3161                 return -EINVAL;
3162
3163         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3164                 return -EINVAL;
3165
3166         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3167         if (err < 0)
3168                 return err;
3169         if (err) {
3170                 radar_detect_width = BIT(params.chandef.width);
3171                 params.radar_required = true;
3172         }
3173
3174         mutex_lock(&rdev->devlist_mtx);
3175         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3176                                            params.chandef.chan,
3177                                            CHAN_MODE_SHARED,
3178                                            radar_detect_width);
3179         mutex_unlock(&rdev->devlist_mtx);
3180
3181         if (err)
3182                 return err;
3183
3184         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3185                 params.acl = parse_acl_data(&rdev->wiphy, info);
3186                 if (IS_ERR(params.acl))
3187                         return PTR_ERR(params.acl);
3188         }
3189
3190         err = rdev_start_ap(rdev, dev, &params);
3191         if (!err) {
3192                 wdev->preset_chandef = params.chandef;
3193                 wdev->beacon_interval = params.beacon_interval;
3194                 wdev->channel = params.chandef.chan;
3195                 wdev->ssid_len = params.ssid_len;
3196                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3197         }
3198
3199         kfree(params.acl);
3200
3201         return err;
3202 }
3203
3204 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3205 {
3206         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3207         struct net_device *dev = info->user_ptr[1];
3208         struct wireless_dev *wdev = dev->ieee80211_ptr;
3209         struct cfg80211_beacon_data params;
3210         int err;
3211
3212         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3213             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3214                 return -EOPNOTSUPP;
3215
3216         if (!rdev->ops->change_beacon)
3217                 return -EOPNOTSUPP;
3218
3219         if (!wdev->beacon_interval)
3220                 return -EINVAL;
3221
3222         err = nl80211_parse_beacon(info, &params);
3223         if (err)
3224                 return err;
3225
3226         return rdev_change_beacon(rdev, dev, &params);
3227 }
3228
3229 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3230 {
3231         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3232         struct net_device *dev = info->user_ptr[1];
3233
3234         return cfg80211_stop_ap(rdev, dev);
3235 }
3236
3237 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3238         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3239         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3240         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3241         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3242         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3243         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3244 };
3245
3246 static int parse_station_flags(struct genl_info *info,
3247                                enum nl80211_iftype iftype,
3248                                struct station_parameters *params)
3249 {
3250         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3251         struct nlattr *nla;
3252         int flag;
3253
3254         /*
3255          * Try parsing the new attribute first so userspace
3256          * can specify both for older kernels.
3257          */
3258         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3259         if (nla) {
3260                 struct nl80211_sta_flag_update *sta_flags;
3261
3262                 sta_flags = nla_data(nla);
3263                 params->sta_flags_mask = sta_flags->mask;
3264                 params->sta_flags_set = sta_flags->set;
3265                 params->sta_flags_set &= params->sta_flags_mask;
3266                 if ((params->sta_flags_mask |
3267                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3268                         return -EINVAL;
3269                 return 0;
3270         }
3271
3272         /* if present, parse the old attribute */
3273
3274         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3275         if (!nla)
3276                 return 0;
3277
3278         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3279                              nla, sta_flags_policy))
3280                 return -EINVAL;
3281
3282         /*
3283          * Only allow certain flags for interface types so that
3284          * other attributes are silently ignored. Remember that
3285          * this is backward compatibility code with old userspace
3286          * and shouldn't be hit in other cases anyway.
3287          */
3288         switch (iftype) {
3289         case NL80211_IFTYPE_AP:
3290         case NL80211_IFTYPE_AP_VLAN:
3291         case NL80211_IFTYPE_P2P_GO:
3292                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3293                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3294                                          BIT(NL80211_STA_FLAG_WME) |
3295                                          BIT(NL80211_STA_FLAG_MFP);
3296                 break;
3297         case NL80211_IFTYPE_P2P_CLIENT:
3298         case NL80211_IFTYPE_STATION:
3299                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3300                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3301                 break;
3302         case NL80211_IFTYPE_MESH_POINT:
3303                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3304                                          BIT(NL80211_STA_FLAG_MFP) |
3305                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3306         default:
3307                 return -EINVAL;
3308         }
3309
3310         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3311                 if (flags[flag]) {
3312                         params->sta_flags_set |= (1<<flag);
3313
3314                         /* no longer support new API additions in old API */
3315                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3316                                 return -EINVAL;
3317                 }
3318         }
3319
3320         return 0;
3321 }
3322
3323 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3324                                  int attr)
3325 {
3326         struct nlattr *rate;
3327         u32 bitrate;
3328         u16 bitrate_compat;
3329
3330         rate = nla_nest_start(msg, attr);
3331         if (!rate)
3332                 return false;
3333
3334         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3335         bitrate = cfg80211_calculate_bitrate(info);
3336         /* report 16-bit bitrate only if we can */
3337         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3338         if (bitrate > 0 &&
3339             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3340                 return false;
3341         if (bitrate_compat > 0 &&
3342             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3343                 return false;
3344
3345         if (info->flags & RATE_INFO_FLAGS_MCS) {
3346                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3347                         return false;
3348                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3349                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3350                         return false;
3351                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3352                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3353                         return false;
3354         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3355                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3356                         return false;
3357                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3358                         return false;
3359                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3360                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3361                         return false;
3362                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3363                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3364                         return false;
3365                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3366                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3367                         return false;
3368                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3369                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3370                         return false;
3371                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3372                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3373                         return false;
3374         }
3375
3376         nla_nest_end(msg, rate);
3377         return true;
3378 }
3379
3380 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3381                                int id)
3382 {
3383         void *attr;
3384         int i = 0;
3385
3386         if (!mask)
3387                 return true;
3388
3389         attr = nla_nest_start(msg, id);
3390         if (!attr)
3391                 return false;
3392
3393         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3394                 if (!(mask & BIT(i)))
3395                         continue;
3396
3397                 if (nla_put_u8(msg, i, signal[i]))
3398                         return false;
3399         }
3400
3401         nla_nest_end(msg, attr);
3402
3403         return true;
3404 }
3405
3406 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3407                                 int flags,
3408                                 struct cfg80211_registered_device *rdev,
3409                                 struct net_device *dev,
3410                                 const u8 *mac_addr, struct station_info *sinfo)
3411 {
3412         void *hdr;
3413         struct nlattr *sinfoattr, *bss_param;
3414
3415         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3416         if (!hdr)
3417                 return -1;
3418
3419         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3420             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3421             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3422                 goto nla_put_failure;
3423
3424         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3425         if (!sinfoattr)
3426                 goto nla_put_failure;
3427         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3428             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3429                         sinfo->connected_time))
3430                 goto nla_put_failure;
3431         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3432             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3433                         sinfo->inactive_time))
3434                 goto nla_put_failure;
3435         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3436                               STATION_INFO_RX_BYTES64)) &&
3437             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3438                         (u32)sinfo->rx_bytes))
3439                 goto nla_put_failure;
3440         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3441                               STATION_INFO_TX_BYTES64)) &&
3442             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3443                         (u32)sinfo->tx_bytes))
3444                 goto nla_put_failure;
3445         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3446             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3447                         sinfo->rx_bytes))
3448                 goto nla_put_failure;
3449         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3450             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3451                         sinfo->tx_bytes))
3452                 goto nla_put_failure;
3453         if ((sinfo->filled & STATION_INFO_LLID) &&
3454             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3455                 goto nla_put_failure;
3456         if ((sinfo->filled & STATION_INFO_PLID) &&
3457             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3458                 goto nla_put_failure;
3459         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3460             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3461                        sinfo->plink_state))
3462                 goto nla_put_failure;
3463         switch (rdev->wiphy.signal_type) {
3464         case CFG80211_SIGNAL_TYPE_MBM:
3465                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3466                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3467                                sinfo->signal))
3468                         goto nla_put_failure;
3469                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3470                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3471                                sinfo->signal_avg))
3472                         goto nla_put_failure;
3473                 break;
3474         default:
3475                 break;
3476         }
3477         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3478                 if (!nl80211_put_signal(msg, sinfo->chains,
3479                                         sinfo->chain_signal,
3480                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3481                         goto nla_put_failure;
3482         }
3483         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3484                 if (!nl80211_put_signal(msg, sinfo->chains,
3485                                         sinfo->chain_signal_avg,
3486                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3487                         goto nla_put_failure;
3488         }
3489         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3490                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3491                                           NL80211_STA_INFO_TX_BITRATE))
3492                         goto nla_put_failure;
3493         }
3494         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3495                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3496                                           NL80211_STA_INFO_RX_BITRATE))
3497                         goto nla_put_failure;
3498         }
3499         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3500             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3501                         sinfo->rx_packets))
3502                 goto nla_put_failure;
3503         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3504             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3505                         sinfo->tx_packets))
3506                 goto nla_put_failure;
3507         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3508             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3509                         sinfo->tx_retries))
3510                 goto nla_put_failure;
3511         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3512             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3513                         sinfo->tx_failed))
3514                 goto nla_put_failure;
3515         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3516             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3517                         sinfo->beacon_loss_count))
3518                 goto nla_put_failure;
3519         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3520             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3521                         sinfo->local_pm))
3522                 goto nla_put_failure;
3523         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3524             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3525                         sinfo->peer_pm))
3526                 goto nla_put_failure;
3527         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3528             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3529                         sinfo->nonpeer_pm))
3530                 goto nla_put_failure;
3531         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3532                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3533                 if (!bss_param)
3534                         goto nla_put_failure;
3535
3536                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3537                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3538                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3539                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3540                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3541                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3542                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3543                                sinfo->bss_param.dtim_period) ||
3544                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3545                                 sinfo->bss_param.beacon_interval))
3546                         goto nla_put_failure;
3547
3548                 nla_nest_end(msg, bss_param);
3549         }
3550         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3551             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3552                     sizeof(struct nl80211_sta_flag_update),
3553                     &sinfo->sta_flags))
3554                 goto nla_put_failure;
3555         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3556                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3557                             sinfo->t_offset))
3558                 goto nla_put_failure;
3559         nla_nest_end(msg, sinfoattr);
3560
3561         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3562             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3563                     sinfo->assoc_req_ies))
3564                 goto nla_put_failure;
3565
3566         return genlmsg_end(msg, hdr);
3567
3568  nla_put_failure:
3569         genlmsg_cancel(msg, hdr);
3570         return -EMSGSIZE;
3571 }
3572
3573 static int nl80211_dump_station(struct sk_buff *skb,
3574                                 struct netlink_callback *cb)
3575 {
3576         struct station_info sinfo;
3577         struct cfg80211_registered_device *dev;
3578         struct wireless_dev *wdev;
3579         u8 mac_addr[ETH_ALEN];
3580         int sta_idx = cb->args[2];
3581         int err;
3582
3583         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3584         if (err)
3585                 return err;
3586
3587         if (!wdev->netdev) {
3588                 err = -EINVAL;
3589                 goto out_err;
3590         }
3591
3592         if (!dev->ops->dump_station) {
3593                 err = -EOPNOTSUPP;
3594                 goto out_err;
3595         }
3596
3597         while (1) {
3598                 memset(&sinfo, 0, sizeof(sinfo));
3599                 err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3600                                         mac_addr, &sinfo);
3601                 if (err == -ENOENT)
3602                         break;
3603                 if (err)
3604                         goto out_err;
3605
3606                 if (nl80211_send_station(skb,
3607                                 NETLINK_CB(cb->skb).portid,
3608                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3609                                 dev, wdev->netdev, mac_addr,
3610                                 &sinfo) < 0)
3611                         goto out;
3612
3613                 sta_idx++;
3614         }
3615
3616
3617  out:
3618         cb->args[2] = sta_idx;
3619         err = skb->len;
3620  out_err:
3621         nl80211_finish_wdev_dump(dev);
3622
3623         return err;
3624 }
3625
3626 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3627 {
3628         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3629         struct net_device *dev = info->user_ptr[1];
3630         struct station_info sinfo;
3631         struct sk_buff *msg;
3632         u8 *mac_addr = NULL;
3633         int err;
3634
3635         memset(&sinfo, 0, sizeof(sinfo));
3636
3637         if (!info->attrs[NL80211_ATTR_MAC])
3638                 return -EINVAL;
3639
3640         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3641
3642         if (!rdev->ops->get_station)
3643                 return -EOPNOTSUPP;
3644
3645         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3646         if (err)
3647                 return err;
3648
3649         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3650         if (!msg)
3651                 return -ENOMEM;
3652
3653         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3654                                  rdev, dev, mac_addr, &sinfo) < 0) {
3655                 nlmsg_free(msg);
3656                 return -ENOBUFS;
3657         }
3658
3659         return genlmsg_reply(msg, info);
3660 }
3661
3662 int cfg80211_check_station_change(struct wiphy *wiphy,
3663                                   struct station_parameters *params,
3664                                   enum cfg80211_station_type statype)
3665 {
3666         if (params->listen_interval != -1)
3667                 return -EINVAL;
3668         if (params->aid)
3669                 return -EINVAL;
3670
3671         /* When you run into this, adjust the code below for the new flag */
3672         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3673
3674         switch (statype) {
3675         case CFG80211_STA_MESH_PEER_KERNEL:
3676         case CFG80211_STA_MESH_PEER_USER:
3677                 /*
3678                  * No ignoring the TDLS flag here -- the userspace mesh
3679                  * code doesn't have the bug of including TDLS in the
3680                  * mask everywhere.
3681                  */
3682                 if (params->sta_flags_mask &
3683                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3684                                   BIT(NL80211_STA_FLAG_MFP) |
3685                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3686                         return -EINVAL;
3687                 break;
3688         case CFG80211_STA_TDLS_PEER_SETUP:
3689         case CFG80211_STA_TDLS_PEER_ACTIVE:
3690                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3691                         return -EINVAL;
3692                 /* ignore since it can't change */
3693                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3694                 break;
3695         default:
3696                 /* disallow mesh-specific things */
3697                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3698                         return -EINVAL;
3699                 if (params->local_pm)
3700                         return -EINVAL;
3701                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3702                         return -EINVAL;
3703         }
3704
3705         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3706             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3707                 /* TDLS can't be set, ... */
3708                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3709                         return -EINVAL;
3710                 /*
3711                  * ... but don't bother the driver with it. This works around
3712                  * a hostapd/wpa_supplicant issue -- it always includes the
3713                  * TLDS_PEER flag in the mask even for AP mode.
3714                  */
3715                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3716         }
3717
3718         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3719                 /* reject other things that can't change */
3720                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3721                         return -EINVAL;
3722                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3723                         return -EINVAL;
3724                 if (params->supported_rates)
3725                         return -EINVAL;
3726                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3727                         return -EINVAL;
3728         }
3729
3730         if (statype != CFG80211_STA_AP_CLIENT) {
3731                 if (params->vlan)
3732                         return -EINVAL;
3733         }
3734
3735         switch (statype) {
3736         case CFG80211_STA_AP_MLME_CLIENT:
3737                 /* Use this only for authorizing/unauthorizing a station */
3738                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3739                         return -EOPNOTSUPP;
3740                 break;
3741         case CFG80211_STA_AP_CLIENT:
3742                 /* accept only the listed bits */
3743                 if (params->sta_flags_mask &
3744                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3745                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3746                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3747                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3748                                   BIT(NL80211_STA_FLAG_WME) |
3749                                   BIT(NL80211_STA_FLAG_MFP)))
3750                         return -EINVAL;
3751
3752                 /* but authenticated/associated only if driver handles it */
3753                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3754                     params->sta_flags_mask &
3755                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3756                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3757                         return -EINVAL;
3758                 break;
3759         case CFG80211_STA_IBSS:
3760         case CFG80211_STA_AP_STA:
3761                 /* reject any changes other than AUTHORIZED */
3762                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3763                         return -EINVAL;
3764                 break;
3765         case CFG80211_STA_TDLS_PEER_SETUP:
3766                 /* reject any changes other than AUTHORIZED or WME */
3767                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3768                                                BIT(NL80211_STA_FLAG_WME)))
3769                         return -EINVAL;
3770                 /* force (at least) rates when authorizing */
3771                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3772                     !params->supported_rates)
3773                         return -EINVAL;
3774                 break;
3775         case CFG80211_STA_TDLS_PEER_ACTIVE:
3776                 /* reject any changes */
3777                 return -EINVAL;
3778         case CFG80211_STA_MESH_PEER_KERNEL:
3779                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3780                         return -EINVAL;
3781                 break;
3782         case CFG80211_STA_MESH_PEER_USER:
3783                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3784                         return -EINVAL;
3785                 break;
3786         }
3787
3788         return 0;
3789 }
3790 EXPORT_SYMBOL(cfg80211_check_station_change);
3791
3792 /*
3793  * Get vlan interface making sure it is running and on the right wiphy.
3794  */
3795 static struct net_device *get_vlan(struct genl_info *info,
3796                                    struct cfg80211_registered_device *rdev)
3797 {
3798         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3799         struct net_device *v;
3800         int ret;
3801
3802         if (!vlanattr)
3803                 return NULL;
3804
3805         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3806         if (!v)
3807                 return ERR_PTR(-ENODEV);
3808
3809         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3810                 ret = -EINVAL;
3811                 goto error;
3812         }
3813
3814         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3815             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3816             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3817                 ret = -EINVAL;
3818                 goto error;
3819         }
3820
3821         if (!netif_running(v)) {
3822                 ret = -ENETDOWN;
3823                 goto error;
3824         }
3825
3826         return v;
3827  error:
3828         dev_put(v);
3829         return ERR_PTR(ret);
3830 }
3831
3832 static struct nla_policy
3833 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3834         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3835         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3836 };
3837
3838 static int nl80211_parse_sta_wme(struct genl_info *info,
3839                                  struct station_parameters *params)
3840 {
3841         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3842         struct nlattr *nla;
3843         int err;
3844
3845         /* parse WME attributes if present */
3846         if (!info->attrs[NL80211_ATTR_STA_WME])
3847                 return 0;
3848
3849         nla = info->attrs[NL80211_ATTR_STA_WME];
3850         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3851                                nl80211_sta_wme_policy);
3852         if (err)
3853                 return err;
3854
3855         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3856                 params->uapsd_queues = nla_get_u8(
3857                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3858         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3859                 return -EINVAL;
3860
3861         if (tb[NL80211_STA_WME_MAX_SP])
3862                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3863
3864         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3865                 return -EINVAL;
3866
3867         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3868
3869         return 0;
3870 }
3871
3872 static int nl80211_set_station_tdls(struct genl_info *info,
3873                                     struct station_parameters *params)
3874 {
3875         /* Dummy STA entry gets updated once the peer capabilities are known */
3876         if (info->attrs[NL80211_ATTR_PEER_AID])
3877                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
3878         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3879                 params->ht_capa =
3880                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3881         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3882                 params->vht_capa =
3883                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3884
3885         return nl80211_parse_sta_wme(info, params);
3886 }
3887
3888 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3889 {
3890         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3891         struct net_device *dev = info->user_ptr[1];
3892         struct station_parameters params;
3893         u8 *mac_addr;
3894         int err;
3895
3896         memset(&params, 0, sizeof(params));
3897
3898         params.listen_interval = -1;
3899
3900         if (!rdev->ops->change_station)
3901                 return -EOPNOTSUPP;
3902
3903         if (info->attrs[NL80211_ATTR_STA_AID])
3904                 return -EINVAL;
3905
3906         if (!info->attrs[NL80211_ATTR_MAC])
3907                 return -EINVAL;
3908
3909         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3910
3911         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3912                 params.supported_rates =
3913                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3914                 params.supported_rates_len =
3915                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3916         }
3917
3918         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
3919                 params.capability =
3920                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
3921                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
3922         }
3923
3924         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
3925                 params.ext_capab =
3926                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3927                 params.ext_capab_len =
3928                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
3929         }
3930
3931         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3932                 return -EINVAL;
3933
3934         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3935                 return -EINVAL;
3936
3937         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
3938                 params.plink_action =
3939                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3940                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
3941                         return -EINVAL;
3942         }
3943
3944         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
3945                 params.plink_state =
3946                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3947                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
3948                         return -EINVAL;
3949                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
3950         }
3951
3952         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3953                 enum nl80211_mesh_power_mode pm = nla_get_u32(
3954                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3955
3956                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3957                     pm > NL80211_MESH_POWER_MAX)
3958                         return -EINVAL;
3959
3960                 params.local_pm = pm;
3961         }
3962
3963         /* Include parameters for TDLS peer (will check later) */
3964         err = nl80211_set_station_tdls(info, &params);
3965         if (err)
3966                 return err;
3967
3968         params.vlan = get_vlan(info, rdev);
3969         if (IS_ERR(params.vlan))
3970                 return PTR_ERR(params.vlan);
3971
3972         switch (dev->ieee80211_ptr->iftype) {
3973         case NL80211_IFTYPE_AP:
3974         case NL80211_IFTYPE_AP_VLAN:
3975         case NL80211_IFTYPE_P2P_GO:
3976         case NL80211_IFTYPE_P2P_CLIENT:
3977         case NL80211_IFTYPE_STATION:
3978         case NL80211_IFTYPE_ADHOC:
3979         case NL80211_IFTYPE_MESH_POINT:
3980                 break;
3981         default:
3982                 err = -EOPNOTSUPP;
3983                 goto out_put_vlan;
3984         }
3985
3986         /* driver will call cfg80211_check_station_change() */
3987         err = rdev_change_station(rdev, dev, mac_addr, &params);
3988
3989  out_put_vlan:
3990         if (params.vlan)
3991                 dev_put(params.vlan);
3992
3993         return err;
3994 }
3995
3996 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3997 {
3998         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3999         int err;
4000         struct net_device *dev = info->user_ptr[1];
4001         struct station_parameters params;
4002         u8 *mac_addr = NULL;
4003
4004         memset(&params, 0, sizeof(params));
4005
4006         if (!rdev->ops->add_station)
4007                 return -EOPNOTSUPP;
4008
4009         if (!info->attrs[NL80211_ATTR_MAC])
4010                 return -EINVAL;
4011
4012         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4013                 return -EINVAL;
4014
4015         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4016                 return -EINVAL;
4017
4018         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4019             !info->attrs[NL80211_ATTR_PEER_AID])
4020                 return -EINVAL;
4021
4022         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4023         params.supported_rates =
4024                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4025         params.supported_rates_len =
4026                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4027         params.listen_interval =
4028                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4029
4030         if (info->attrs[NL80211_ATTR_STA_AID])
4031                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4032         else
4033                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4034         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4035                 return -EINVAL;
4036
4037         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4038                 params.capability =
4039                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4040                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4041         }
4042
4043         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4044                 params.ext_capab =
4045                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4046                 params.ext_capab_len =
4047                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4048         }
4049
4050         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4051                 params.ht_capa =
4052                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4053
4054         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4055                 params.vht_capa =
4056                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4057
4058         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4059                 params.plink_action =
4060                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4061                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4062                         return -EINVAL;
4063         }
4064
4065         err = nl80211_parse_sta_wme(info, &params);
4066         if (err)
4067                 return err;
4068
4069         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4070                 return -EINVAL;
4071
4072         /* When you run into this, adjust the code below for the new flag */
4073         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4074
4075         switch (dev->ieee80211_ptr->iftype) {
4076         case NL80211_IFTYPE_AP:
4077         case NL80211_IFTYPE_AP_VLAN:
4078         case NL80211_IFTYPE_P2P_GO:
4079                 /* ignore WME attributes if iface/sta is not capable */
4080                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4081                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4082                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4083
4084                 /* TDLS peers cannot be added */
4085                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4086                         return -EINVAL;
4087                 /* but don't bother the driver with it */
4088                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4089
4090                 /* allow authenticated/associated only if driver handles it */
4091                 if (!(rdev->wiphy.features &
4092                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4093                     params.sta_flags_mask &
4094                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4095                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4096                         return -EINVAL;
4097
4098                 /* must be last in here for error handling */
4099                 params.vlan = get_vlan(info, rdev);
4100                 if (IS_ERR(params.vlan))
4101                         return PTR_ERR(params.vlan);
4102                 break;
4103         case NL80211_IFTYPE_MESH_POINT:
4104                 /* ignore uAPSD data */
4105                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4106
4107                 /* associated is disallowed */
4108                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4109                         return -EINVAL;
4110                 /* TDLS peers cannot be added */
4111                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4112                         return -EINVAL;
4113                 break;
4114         case NL80211_IFTYPE_STATION:
4115         case NL80211_IFTYPE_P2P_CLIENT:
4116                 /* ignore uAPSD data */
4117                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4118
4119                 /* these are disallowed */
4120                 if (params.sta_flags_mask &
4121                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4122                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4123                         return -EINVAL;
4124                 /* Only TDLS peers can be added */
4125                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4126                         return -EINVAL;
4127                 /* Can only add if TDLS ... */
4128                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4129                         return -EOPNOTSUPP;
4130                 /* ... with external setup is supported */
4131                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4132                         return -EOPNOTSUPP;
4133                 /*
4134                  * Older wpa_supplicant versions always mark the TDLS peer
4135                  * as authorized, but it shouldn't yet be.
4136                  */
4137                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4138                 break;
4139         default:
4140                 return -EOPNOTSUPP;
4141         }
4142
4143         /* be aware of params.vlan when changing code here */
4144
4145         err = rdev_add_station(rdev, dev, mac_addr, &params);
4146
4147         if (params.vlan)
4148                 dev_put(params.vlan);
4149         return err;
4150 }
4151
4152 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4153 {
4154         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4155         struct net_device *dev = info->user_ptr[1];
4156         u8 *mac_addr = NULL;
4157
4158         if (info->attrs[NL80211_ATTR_MAC])
4159                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4160
4161         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4162             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4163             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4164             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4165                 return -EINVAL;
4166
4167         if (!rdev->ops->del_station)
4168                 return -EOPNOTSUPP;
4169
4170         return rdev_del_station(rdev, dev, mac_addr);
4171 }
4172
4173 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4174                                 int flags, struct net_device *dev,
4175                                 u8 *dst, u8 *next_hop,
4176                                 struct mpath_info *pinfo)
4177 {
4178         void *hdr;
4179         struct nlattr *pinfoattr;
4180
4181         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4182         if (!hdr)
4183                 return -1;
4184
4185         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4186             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4187             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4188             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4189                 goto nla_put_failure;
4190
4191         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4192         if (!pinfoattr)
4193                 goto nla_put_failure;
4194         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4195             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4196                         pinfo->frame_qlen))
4197                 goto nla_put_failure;
4198         if (((pinfo->filled & MPATH_INFO_SN) &&
4199              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4200             ((pinfo->filled & MPATH_INFO_METRIC) &&
4201              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4202                          pinfo->metric)) ||
4203             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4204              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4205                          pinfo->exptime)) ||
4206             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4207              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4208                         pinfo->flags)) ||
4209             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4210              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4211                          pinfo->discovery_timeout)) ||
4212             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4213              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4214                         pinfo->discovery_retries)))
4215                 goto nla_put_failure;
4216
4217         nla_nest_end(msg, pinfoattr);
4218
4219         return genlmsg_end(msg, hdr);
4220
4221  nla_put_failure:
4222         genlmsg_cancel(msg, hdr);
4223         return -EMSGSIZE;
4224 }
4225
4226 static int nl80211_dump_mpath(struct sk_buff *skb,
4227                               struct netlink_callback *cb)
4228 {
4229         struct mpath_info pinfo;
4230         struct cfg80211_registered_device *dev;
4231         struct wireless_dev *wdev;
4232         u8 dst[ETH_ALEN];
4233         u8 next_hop[ETH_ALEN];
4234         int path_idx = cb->args[2];
4235         int err;
4236
4237         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4238         if (err)
4239                 return err;
4240
4241         if (!dev->ops->dump_mpath) {
4242                 err = -EOPNOTSUPP;
4243                 goto out_err;
4244         }
4245
4246         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4247                 err = -EOPNOTSUPP;
4248                 goto out_err;
4249         }
4250
4251         while (1) {
4252                 err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
4253                                       next_hop, &pinfo);
4254                 if (err == -ENOENT)
4255                         break;
4256                 if (err)
4257                         goto out_err;
4258
4259                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4260                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4261                                        wdev->netdev, dst, next_hop,
4262                                        &pinfo) < 0)
4263                         goto out;
4264
4265                 path_idx++;
4266         }
4267
4268
4269  out:
4270         cb->args[2] = path_idx;
4271         err = skb->len;
4272  out_err:
4273         nl80211_finish_wdev_dump(dev);
4274         return err;
4275 }
4276
4277 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4278 {
4279         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4280         int err;
4281         struct net_device *dev = info->user_ptr[1];
4282         struct mpath_info pinfo;
4283         struct sk_buff *msg;
4284         u8 *dst = NULL;
4285         u8 next_hop[ETH_ALEN];
4286
4287         memset(&pinfo, 0, sizeof(pinfo));
4288
4289         if (!info->attrs[NL80211_ATTR_MAC])
4290                 return -EINVAL;
4291
4292         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4293
4294         if (!rdev->ops->get_mpath)
4295                 return -EOPNOTSUPP;
4296
4297         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4298                 return -EOPNOTSUPP;
4299
4300         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4301         if (err)
4302                 return err;
4303
4304         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4305         if (!msg)
4306                 return -ENOMEM;
4307
4308         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4309                                  dev, dst, next_hop, &pinfo) < 0) {
4310                 nlmsg_free(msg);
4311                 return -ENOBUFS;
4312         }
4313
4314         return genlmsg_reply(msg, info);
4315 }
4316
4317 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4318 {
4319         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4320         struct net_device *dev = info->user_ptr[1];
4321         u8 *dst = NULL;
4322         u8 *next_hop = NULL;
4323
4324         if (!info->attrs[NL80211_ATTR_MAC])
4325                 return -EINVAL;
4326
4327         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4328                 return -EINVAL;
4329
4330         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4331         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4332
4333         if (!rdev->ops->change_mpath)
4334                 return -EOPNOTSUPP;
4335
4336         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4337                 return -EOPNOTSUPP;
4338
4339         return rdev_change_mpath(rdev, dev, dst, next_hop);
4340 }
4341
4342 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4343 {
4344         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4345         struct net_device *dev = info->user_ptr[1];
4346         u8 *dst = NULL;
4347         u8 *next_hop = NULL;
4348
4349         if (!info->attrs[NL80211_ATTR_MAC])
4350                 return -EINVAL;
4351
4352         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4353                 return -EINVAL;
4354
4355         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4356         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4357
4358         if (!rdev->ops->add_mpath)
4359                 return -EOPNOTSUPP;
4360
4361         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4362                 return -EOPNOTSUPP;
4363
4364         return rdev_add_mpath(rdev, dev, dst, next_hop);
4365 }
4366
4367 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4368 {
4369         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4370         struct net_device *dev = info->user_ptr[1];
4371         u8 *dst = NULL;
4372
4373         if (info->attrs[NL80211_ATTR_MAC])
4374                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4375
4376         if (!rdev->ops->del_mpath)
4377                 return -EOPNOTSUPP;
4378
4379         return rdev_del_mpath(rdev, dev, dst);
4380 }
4381
4382 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4383 {
4384         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4385         struct net_device *dev = info->user_ptr[1];
4386         struct bss_parameters params;
4387
4388         memset(&params, 0, sizeof(params));
4389         /* default to not changing parameters */
4390         params.use_cts_prot = -1;
4391         params.use_short_preamble = -1;
4392         params.use_short_slot_time = -1;
4393         params.ap_isolate = -1;
4394         params.ht_opmode = -1;
4395         params.p2p_ctwindow = -1;
4396         params.p2p_opp_ps = -1;
4397
4398         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4399                 params.use_cts_prot =
4400                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4401         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4402                 params.use_short_preamble =
4403                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4404         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4405                 params.use_short_slot_time =
4406                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4407         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4408                 params.basic_rates =
4409                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4410                 params.basic_rates_len =
4411                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4412         }
4413         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4414                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4415         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4416                 params.ht_opmode =
4417                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4418
4419         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4420                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4421                         return -EINVAL;
4422                 params.p2p_ctwindow =
4423                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4424                 if (params.p2p_ctwindow < 0)
4425                         return -EINVAL;
4426                 if (params.p2p_ctwindow != 0 &&
4427                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4428                         return -EINVAL;
4429         }
4430
4431         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4432                 u8 tmp;
4433
4434                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4435                         return -EINVAL;
4436                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4437                 if (tmp > 1)
4438                         return -EINVAL;
4439                 params.p2p_opp_ps = tmp;
4440                 if (params.p2p_opp_ps &&
4441                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4442                         return -EINVAL;
4443         }
4444
4445         if (!rdev->ops->change_bss)
4446                 return -EOPNOTSUPP;
4447
4448         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4449             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4450                 return -EOPNOTSUPP;
4451
4452         return rdev_change_bss(rdev, dev, &params);
4453 }
4454
4455 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4456         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4457         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4458         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4459         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4460         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4461         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4462 };
4463
4464 static int parse_reg_rule(struct nlattr *tb[],
4465         struct ieee80211_reg_rule *reg_rule)
4466 {
4467         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4468         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4469
4470         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4471                 return -EINVAL;
4472         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4473                 return -EINVAL;
4474         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4475                 return -EINVAL;
4476         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4477                 return -EINVAL;
4478         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4479                 return -EINVAL;
4480
4481         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4482
4483         freq_range->start_freq_khz =
4484                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4485         freq_range->end_freq_khz =
4486                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4487         freq_range->max_bandwidth_khz =
4488                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4489
4490         power_rule->max_eirp =
4491                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4492
4493         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4494                 power_rule->max_antenna_gain =
4495                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4496
4497         return 0;
4498 }
4499
4500 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4501 {
4502         int r;
4503         char *data = NULL;
4504         enum nl80211_user_reg_hint_type user_reg_hint_type;
4505
4506         /*
4507          * You should only get this when cfg80211 hasn't yet initialized
4508          * completely when built-in to the kernel right between the time
4509          * window between nl80211_init() and regulatory_init(), if that is
4510          * even possible.
4511          */
4512         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4513                 return -EINPROGRESS;
4514
4515         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4516                 return -EINVAL;
4517
4518         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4519
4520         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4521                 user_reg_hint_type =
4522                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4523         else
4524                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4525
4526         switch (user_reg_hint_type) {
4527         case NL80211_USER_REG_HINT_USER:
4528         case NL80211_USER_REG_HINT_CELL_BASE:
4529                 break;
4530         default:
4531                 return -EINVAL;
4532         }
4533
4534         r = regulatory_hint_user(data, user_reg_hint_type);
4535
4536         return r;
4537 }
4538
4539 static int nl80211_get_mesh_config(struct sk_buff *skb,
4540                                    struct genl_info *info)
4541 {
4542         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4543         struct net_device *dev = info->user_ptr[1];
4544         struct wireless_dev *wdev = dev->ieee80211_ptr;
4545         struct mesh_config cur_params;
4546         int err = 0;
4547         void *hdr;
4548         struct nlattr *pinfoattr;
4549         struct sk_buff *msg;
4550
4551         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4552                 return -EOPNOTSUPP;
4553
4554         if (!rdev->ops->get_mesh_config)
4555                 return -EOPNOTSUPP;
4556
4557         wdev_lock(wdev);
4558         /* If not connected, get default parameters */
4559         if (!wdev->mesh_id_len)
4560                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4561         else
4562                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4563         wdev_unlock(wdev);
4564
4565         if (err)
4566                 return err;
4567
4568         /* Draw up a netlink message to send back */
4569         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4570         if (!msg)
4571                 return -ENOMEM;
4572         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4573                              NL80211_CMD_GET_MESH_CONFIG);
4574         if (!hdr)
4575                 goto out;
4576         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4577         if (!pinfoattr)
4578                 goto nla_put_failure;
4579         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4580             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4581                         cur_params.dot11MeshRetryTimeout) ||
4582             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4583                         cur_params.dot11MeshConfirmTimeout) ||
4584             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4585                         cur_params.dot11MeshHoldingTimeout) ||
4586             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4587                         cur_params.dot11MeshMaxPeerLinks) ||
4588             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4589                        cur_params.dot11MeshMaxRetries) ||
4590             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4591                        cur_params.dot11MeshTTL) ||
4592             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4593                        cur_params.element_ttl) ||
4594             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4595                        cur_params.auto_open_plinks) ||
4596             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4597                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4598             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4599                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4600             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4601                         cur_params.path_refresh_time) ||
4602             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4603                         cur_params.min_discovery_timeout) ||
4604             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4605                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4606             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4607                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4608             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4609                         cur_params.dot11MeshHWMPperrMinInterval) ||
4610             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4611                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4612             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4613                        cur_params.dot11MeshHWMPRootMode) ||
4614             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4615                         cur_params.dot11MeshHWMPRannInterval) ||
4616             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4617                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4618             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4619                        cur_params.dot11MeshForwarding) ||
4620             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4621                         cur_params.rssi_threshold) ||
4622             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4623                         cur_params.ht_opmode) ||
4624             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4625                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4626             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4627                         cur_params.dot11MeshHWMProotInterval) ||
4628             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4629                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4630             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4631                         cur_params.power_mode) ||
4632             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4633                         cur_params.dot11MeshAwakeWindowDuration))
4634                 goto nla_put_failure;
4635         nla_nest_end(msg, pinfoattr);
4636         genlmsg_end(msg, hdr);
4637         return genlmsg_reply(msg, info);
4638
4639  nla_put_failure:
4640         genlmsg_cancel(msg, hdr);
4641  out:
4642         nlmsg_free(msg);
4643         return -ENOBUFS;
4644 }
4645
4646 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4647         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4648         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4649         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4650         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4651         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4652         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4653         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4654         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4655         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4656         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4657         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4658         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4659         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4660         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4661         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4662         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4663         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4664         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4665         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4666         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4667         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4668         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4669         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4670         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4671         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4672         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4673         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4674 };
4675
4676 static const struct nla_policy
4677         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4678         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4679         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4680         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4681         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4682         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4683         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4684         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4685                                     .len = IEEE80211_MAX_DATA_LEN },
4686         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4687 };
4688
4689 static int nl80211_parse_mesh_config(struct genl_info *info,
4690                                      struct mesh_config *cfg,
4691                                      u32 *mask_out)
4692 {
4693         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4694         u32 mask = 0;
4695
4696 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4697 do {                                                                        \
4698         if (tb[attr]) {                                                     \
4699                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4700                         return -EINVAL;                                     \
4701                 cfg->param = fn(tb[attr]);                                  \
4702                 mask |= (1 << (attr - 1));                                  \
4703         }                                                                   \
4704 } while (0)
4705
4706
4707         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4708                 return -EINVAL;
4709         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4710                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4711                              nl80211_meshconf_params_policy))
4712                 return -EINVAL;
4713
4714         /* This makes sure that there aren't more than 32 mesh config
4715          * parameters (otherwise our bitfield scheme would not work.) */
4716         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4717
4718         /* Fill in the params struct */
4719         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4720                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4721                                   nla_get_u16);
4722         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4723                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4724                                   nla_get_u16);
4725         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4726                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4727                                   nla_get_u16);
4728         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4729                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4730                                   nla_get_u16);
4731         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4732                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4733                                   nla_get_u8);
4734         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4735                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4736         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4737                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4738                                   nla_get_u8);
4739         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4740                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4741                                   nla_get_u8);
4742         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4743                                   1, 255, mask,
4744                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4745                                   nla_get_u32);
4746         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4747                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4748                                   nla_get_u8);
4749         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4750                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4751                                   nla_get_u32);
4752         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4753                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4754                                   nla_get_u16);
4755         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4756                                   1, 65535, mask,
4757                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4758                                   nla_get_u32);
4759         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4760                                   1, 65535, mask,
4761                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4762                                   nla_get_u16);
4763         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4764                                   1, 65535, mask,
4765                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4766                                   nla_get_u16);
4767         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4768                                   dot11MeshHWMPnetDiameterTraversalTime,
4769                                   1, 65535, mask,
4770                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4771                                   nla_get_u16);
4772         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4773                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4774                                   nla_get_u8);
4775         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4776                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4777                                   nla_get_u16);
4778         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4779                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4780                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4781                                   nla_get_u8);
4782         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4783                                   mask, NL80211_MESHCONF_FORWARDING,
4784                                   nla_get_u8);
4785         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
4786                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4787                                   nla_get_u32);
4788         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4789                                   mask, NL80211_MESHCONF_HT_OPMODE,
4790                                   nla_get_u16);
4791         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4792                                   1, 65535, mask,
4793                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4794                                   nla_get_u32);
4795         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4796                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4797                                   nla_get_u16);
4798         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4799                                   dot11MeshHWMPconfirmationInterval,
4800                                   1, 65535, mask,
4801                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4802                                   nla_get_u16);
4803         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4804                                   NL80211_MESH_POWER_ACTIVE,
4805                                   NL80211_MESH_POWER_MAX,
4806                                   mask, NL80211_MESHCONF_POWER_MODE,
4807                                   nla_get_u32);
4808         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4809                                   0, 65535, mask,
4810                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4811         if (mask_out)
4812                 *mask_out = mask;
4813
4814         return 0;
4815
4816 #undef FILL_IN_MESH_PARAM_IF_SET
4817 }
4818
4819 static int nl80211_parse_mesh_setup(struct genl_info *info,
4820                                      struct mesh_setup *setup)
4821 {
4822         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4823         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4824
4825         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4826                 return -EINVAL;
4827         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4828                              info->attrs[NL80211_ATTR_MESH_SETUP],
4829                              nl80211_mesh_setup_params_policy))
4830                 return -EINVAL;
4831
4832         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4833                 setup->sync_method =
4834                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4835                  IEEE80211_SYNC_METHOD_VENDOR :
4836                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4837
4838         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4839                 setup->path_sel_proto =
4840                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4841                  IEEE80211_PATH_PROTOCOL_VENDOR :
4842                  IEEE80211_PATH_PROTOCOL_HWMP;
4843
4844         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4845                 setup->path_metric =
4846                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4847                  IEEE80211_PATH_METRIC_VENDOR :
4848                  IEEE80211_PATH_METRIC_AIRTIME;
4849
4850
4851         if (tb[NL80211_MESH_SETUP_IE]) {
4852                 struct nlattr *ieattr =
4853                         tb[NL80211_MESH_SETUP_IE];
4854                 if (!is_valid_ie_attr(ieattr))
4855                         return -EINVAL;
4856                 setup->ie = nla_data(ieattr);
4857                 setup->ie_len = nla_len(ieattr);
4858         }
4859         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
4860             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
4861                 return -EINVAL;
4862         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
4863         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4864         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4865         if (setup->is_secure)
4866                 setup->user_mpm = true;
4867
4868         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
4869                 if (!setup->user_mpm)
4870                         return -EINVAL;
4871                 setup->auth_id =
4872                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
4873         }
4874
4875         return 0;
4876 }
4877
4878 static int nl80211_update_mesh_config(struct sk_buff *skb,
4879                                       struct genl_info *info)
4880 {
4881         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4882         struct net_device *dev = info->user_ptr[1];
4883         struct wireless_dev *wdev = dev->ieee80211_ptr;
4884         struct mesh_config cfg;
4885         u32 mask;
4886         int err;
4887
4888         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4889                 return -EOPNOTSUPP;
4890
4891         if (!rdev->ops->update_mesh_config)
4892                 return -EOPNOTSUPP;
4893
4894         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4895         if (err)
4896                 return err;
4897
4898         wdev_lock(wdev);
4899         if (!wdev->mesh_id_len)
4900                 err = -ENOLINK;
4901
4902         if (!err)
4903                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4904
4905         wdev_unlock(wdev);
4906
4907         return err;
4908 }
4909
4910 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4911 {
4912         const struct ieee80211_regdomain *regdom;
4913         struct sk_buff *msg;
4914         void *hdr = NULL;
4915         struct nlattr *nl_reg_rules;
4916         unsigned int i;
4917         int err = -EINVAL;
4918
4919         mutex_lock(&cfg80211_mutex);
4920
4921         if (!cfg80211_regdomain)
4922                 goto out;
4923
4924         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4925         if (!msg) {
4926                 err = -ENOBUFS;
4927                 goto out;
4928         }
4929
4930         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4931                              NL80211_CMD_GET_REG);
4932         if (!hdr)
4933                 goto put_failure;
4934
4935         if (reg_last_request_cell_base() &&
4936             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4937                         NL80211_USER_REG_HINT_CELL_BASE))
4938                 goto nla_put_failure;
4939
4940         rcu_read_lock();
4941         regdom = rcu_dereference(cfg80211_regdomain);
4942
4943         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4944             (regdom->dfs_region &&
4945              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4946                 goto nla_put_failure_rcu;
4947
4948         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4949         if (!nl_reg_rules)
4950                 goto nla_put_failure_rcu;
4951
4952         for (i = 0; i < regdom->n_reg_rules; i++) {
4953                 struct nlattr *nl_reg_rule;
4954                 const struct ieee80211_reg_rule *reg_rule;
4955                 const struct ieee80211_freq_range *freq_range;
4956                 const struct ieee80211_power_rule *power_rule;
4957
4958                 reg_rule = &regdom->reg_rules[i];
4959                 freq_range = &reg_rule->freq_range;
4960                 power_rule = &reg_rule->power_rule;
4961
4962                 nl_reg_rule = nla_nest_start(msg, i);
4963                 if (!nl_reg_rule)
4964                         goto nla_put_failure_rcu;
4965
4966                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4967                                 reg_rule->flags) ||
4968                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4969                                 freq_range->start_freq_khz) ||
4970                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4971                                 freq_range->end_freq_khz) ||
4972                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4973                                 freq_range->max_bandwidth_khz) ||
4974                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4975                                 power_rule->max_antenna_gain) ||
4976                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4977                                 power_rule->max_eirp))
4978                         goto nla_put_failure_rcu;
4979
4980                 nla_nest_end(msg, nl_reg_rule);
4981         }
4982         rcu_read_unlock();
4983
4984         nla_nest_end(msg, nl_reg_rules);
4985
4986         genlmsg_end(msg, hdr);
4987         err = genlmsg_reply(msg, info);
4988         goto out;
4989
4990 nla_put_failure_rcu:
4991         rcu_read_unlock();
4992 nla_put_failure:
4993         genlmsg_cancel(msg, hdr);
4994 put_failure:
4995         nlmsg_free(msg);
4996         err = -EMSGSIZE;
4997 out:
4998         mutex_unlock(&cfg80211_mutex);
4999         return err;
5000 }
5001
5002 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5003 {
5004         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5005         struct nlattr *nl_reg_rule;
5006         char *alpha2 = NULL;
5007         int rem_reg_rules = 0, r = 0;
5008         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5009         u8 dfs_region = 0;
5010         struct ieee80211_regdomain *rd = NULL;
5011
5012         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5013                 return -EINVAL;
5014
5015         if (!info->attrs[NL80211_ATTR_REG_RULES])
5016                 return -EINVAL;
5017
5018         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5019
5020         if (info->attrs[NL80211_ATTR_DFS_REGION])
5021                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5022
5023         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5024                             rem_reg_rules) {
5025                 num_rules++;
5026                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5027                         return -EINVAL;
5028         }
5029
5030         size_of_regd = sizeof(struct ieee80211_regdomain) +
5031                        num_rules * sizeof(struct ieee80211_reg_rule);
5032
5033         rd = kzalloc(size_of_regd, GFP_KERNEL);
5034         if (!rd)
5035                 return -ENOMEM;
5036
5037         rd->n_reg_rules = num_rules;
5038         rd->alpha2[0] = alpha2[0];
5039         rd->alpha2[1] = alpha2[1];
5040
5041         /*
5042          * Disable DFS master mode if the DFS region was
5043          * not supported or known on this kernel.
5044          */
5045         if (reg_supported_dfs_region(dfs_region))
5046                 rd->dfs_region = dfs_region;
5047
5048         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5049                             rem_reg_rules) {
5050                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5051                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5052                           reg_rule_policy);
5053                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5054                 if (r)
5055                         goto bad_reg;
5056
5057                 rule_idx++;
5058
5059                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5060                         r = -EINVAL;
5061                         goto bad_reg;
5062                 }
5063         }
5064
5065         mutex_lock(&cfg80211_mutex);
5066
5067         r = set_regdom(rd);
5068         /* set_regdom took ownership */
5069         rd = NULL;
5070         mutex_unlock(&cfg80211_mutex);
5071
5072  bad_reg:
5073         kfree(rd);
5074         return r;
5075 }
5076
5077 static int validate_scan_freqs(struct nlattr *freqs)
5078 {
5079         struct nlattr *attr1, *attr2;
5080         int n_channels = 0, tmp1, tmp2;
5081
5082         nla_for_each_nested(attr1, freqs, tmp1) {
5083                 n_channels++;
5084                 /*
5085                  * Some hardware has a limited channel list for
5086                  * scanning, and it is pretty much nonsensical
5087                  * to scan for a channel twice, so disallow that
5088                  * and don't require drivers to check that the
5089                  * channel list they get isn't longer than what
5090                  * they can scan, as long as they can scan all
5091                  * the channels they registered at once.
5092                  */
5093                 nla_for_each_nested(attr2, freqs, tmp2)
5094                         if (attr1 != attr2 &&
5095                             nla_get_u32(attr1) == nla_get_u32(attr2))
5096                                 return 0;
5097         }
5098
5099         return n_channels;
5100 }
5101
5102 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5103 {
5104         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5105         struct wireless_dev *wdev = info->user_ptr[1];
5106         struct cfg80211_scan_request *request;
5107         struct nlattr *attr;
5108         struct wiphy *wiphy;
5109         int err, tmp, n_ssids = 0, n_channels, i;
5110         size_t ie_len;
5111
5112         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5113                 return -EINVAL;
5114
5115         wiphy = &rdev->wiphy;
5116
5117         if (!rdev->ops->scan)
5118                 return -EOPNOTSUPP;
5119
5120         mutex_lock(&rdev->sched_scan_mtx);
5121         if (rdev->scan_req) {
5122                 err = -EBUSY;
5123                 goto unlock;
5124         }
5125
5126         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5127                 n_channels = validate_scan_freqs(
5128                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5129                 if (!n_channels) {
5130                         err = -EINVAL;
5131                         goto unlock;
5132                 }
5133         } else {
5134                 enum ieee80211_band band;
5135                 n_channels = 0;
5136
5137                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5138                         if (wiphy->bands[band])
5139                                 n_channels += wiphy->bands[band]->n_channels;
5140         }
5141
5142         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5143                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5144                         n_ssids++;
5145
5146         if (n_ssids > wiphy->max_scan_ssids) {
5147                 err = -EINVAL;
5148                 goto unlock;
5149         }
5150
5151         if (info->attrs[NL80211_ATTR_IE])
5152                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5153         else
5154                 ie_len = 0;
5155
5156         if (ie_len > wiphy->max_scan_ie_len) {
5157                 err = -EINVAL;
5158                 goto unlock;
5159         }
5160
5161         request = kzalloc(sizeof(*request)
5162                         + sizeof(*request->ssids) * n_ssids
5163                         + sizeof(*request->channels) * n_channels
5164                         + ie_len, GFP_KERNEL);
5165         if (!request) {
5166                 err = -ENOMEM;
5167                 goto unlock;
5168         }
5169
5170         if (n_ssids)
5171                 request->ssids = (void *)&request->channels[n_channels];
5172         request->n_ssids = n_ssids;
5173         if (ie_len) {
5174                 if (request->ssids)
5175                         request->ie = (void *)(request->ssids + n_ssids);
5176                 else
5177                         request->ie = (void *)(request->channels + n_channels);
5178         }
5179
5180         i = 0;
5181         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5182                 /* user specified, bail out if channel not found */
5183                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5184                         struct ieee80211_channel *chan;
5185
5186                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5187
5188                         if (!chan) {
5189                                 err = -EINVAL;
5190                                 goto out_free;
5191                         }
5192
5193                         /* ignore disabled channels */
5194                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5195                                 continue;
5196
5197                         request->channels[i] = chan;
5198                         i++;
5199                 }
5200         } else {
5201                 enum ieee80211_band band;
5202
5203                 /* all channels */
5204                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5205                         int j;
5206                         if (!wiphy->bands[band])
5207                                 continue;
5208                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5209                                 struct ieee80211_channel *chan;
5210
5211                                 chan = &wiphy->bands[band]->channels[j];
5212
5213                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5214                                         continue;
5215
5216                                 request->channels[i] = chan;
5217                                 i++;
5218                         }
5219                 }
5220         }
5221
5222         if (!i) {
5223                 err = -EINVAL;
5224                 goto out_free;
5225         }
5226
5227         request->n_channels = i;
5228
5229         i = 0;
5230         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5231                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5232                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5233                                 err = -EINVAL;
5234                                 goto out_free;
5235                         }
5236                         request->ssids[i].ssid_len = nla_len(attr);
5237                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5238                         i++;
5239                 }
5240         }
5241
5242         if (info->attrs[NL80211_ATTR_IE]) {
5243                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5244                 memcpy((void *)request->ie,
5245                        nla_data(info->attrs[NL80211_ATTR_IE]),
5246                        request->ie_len);
5247         }
5248
5249         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5250                 if (wiphy->bands[i])
5251                         request->rates[i] =
5252                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5253
5254         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5255                 nla_for_each_nested(attr,
5256                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5257                                     tmp) {
5258                         enum ieee80211_band band = nla_type(attr);
5259
5260                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5261                                 err = -EINVAL;
5262                                 goto out_free;
5263                         }
5264                         err = ieee80211_get_ratemask(wiphy->bands[band],
5265                                                      nla_data(attr),
5266                                                      nla_len(attr),
5267                                                      &request->rates[band]);
5268                         if (err)
5269                                 goto out_free;
5270                 }
5271         }
5272
5273         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5274                 request->flags = nla_get_u32(
5275                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5276                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5277                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5278                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5279                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5280                         err = -EOPNOTSUPP;
5281                         goto out_free;
5282                 }
5283         }
5284
5285         request->no_cck =
5286                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5287
5288         request->wdev = wdev;
5289         request->wiphy = &rdev->wiphy;
5290         request->scan_start = jiffies;
5291
5292         rdev->scan_req = request;
5293         err = rdev_scan(rdev, request);
5294
5295         if (!err) {
5296                 nl80211_send_scan_start(rdev, wdev);
5297                 if (wdev->netdev)
5298                         dev_hold(wdev->netdev);
5299         } else {
5300  out_free:
5301                 rdev->scan_req = NULL;
5302                 kfree(request);
5303         }
5304
5305  unlock:
5306         mutex_unlock(&rdev->sched_scan_mtx);
5307         return err;
5308 }
5309
5310 static int nl80211_start_sched_scan(struct sk_buff *skb,
5311                                     struct genl_info *info)
5312 {
5313         struct cfg80211_sched_scan_request *request;
5314         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5315         struct net_device *dev = info->user_ptr[1];
5316         struct nlattr *attr;
5317         struct wiphy *wiphy;
5318         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5319         u32 interval;
5320         enum ieee80211_band band;
5321         size_t ie_len;
5322         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5323
5324         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5325             !rdev->ops->sched_scan_start)
5326                 return -EOPNOTSUPP;
5327
5328         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5329                 return -EINVAL;
5330
5331         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5332                 return -EINVAL;
5333
5334         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5335         if (interval == 0)
5336                 return -EINVAL;
5337
5338         wiphy = &rdev->wiphy;
5339
5340         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5341                 n_channels = validate_scan_freqs(
5342                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5343                 if (!n_channels)
5344                         return -EINVAL;
5345         } else {
5346                 n_channels = 0;
5347
5348                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
5349                         if (wiphy->bands[band])
5350                                 n_channels += wiphy->bands[band]->n_channels;
5351         }
5352
5353         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5354                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5355                                     tmp)
5356                         n_ssids++;
5357
5358         if (n_ssids > wiphy->max_sched_scan_ssids)
5359                 return -EINVAL;
5360
5361         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5362                 nla_for_each_nested(attr,
5363                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5364                                     tmp)
5365                         n_match_sets++;
5366
5367         if (n_match_sets > wiphy->max_match_sets)
5368                 return -EINVAL;
5369
5370         if (info->attrs[NL80211_ATTR_IE])
5371                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5372         else
5373                 ie_len = 0;
5374
5375         if (ie_len > wiphy->max_sched_scan_ie_len)
5376                 return -EINVAL;
5377
5378         mutex_lock(&rdev->sched_scan_mtx);
5379
5380         if (rdev->sched_scan_req) {
5381                 err = -EINPROGRESS;
5382                 goto out;
5383         }
5384
5385         request = kzalloc(sizeof(*request)
5386                         + sizeof(*request->ssids) * n_ssids
5387                         + sizeof(*request->match_sets) * n_match_sets
5388                         + sizeof(*request->channels) * n_channels
5389                         + ie_len, GFP_KERNEL);
5390         if (!request) {
5391                 err = -ENOMEM;
5392                 goto out;
5393         }
5394
5395         if (n_ssids)
5396                 request->ssids = (void *)&request->channels[n_channels];
5397         request->n_ssids = n_ssids;
5398         if (ie_len) {
5399                 if (request->ssids)
5400                         request->ie = (void *)(request->ssids + n_ssids);
5401                 else
5402                         request->ie = (void *)(request->channels + n_channels);
5403         }
5404
5405         if (n_match_sets) {
5406                 if (request->ie)
5407                         request->match_sets = (void *)(request->ie + ie_len);
5408                 else if (request->ssids)
5409                         request->match_sets =
5410                                 (void *)(request->ssids + n_ssids);
5411                 else
5412                         request->match_sets =
5413                                 (void *)(request->channels + n_channels);
5414         }
5415         request->n_match_sets = n_match_sets;
5416
5417         i = 0;
5418         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5419                 /* user specified, bail out if channel not found */
5420                 nla_for_each_nested(attr,
5421                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5422                                     tmp) {
5423                         struct ieee80211_channel *chan;
5424
5425                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5426
5427                         if (!chan) {
5428                                 err = -EINVAL;
5429                                 goto out_free;
5430                         }
5431
5432                         /* ignore disabled channels */
5433                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5434                                 continue;
5435
5436                         request->channels[i] = chan;
5437                         i++;
5438                 }
5439         } else {
5440                 /* all channels */
5441                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5442                         int j;
5443                         if (!wiphy->bands[band])
5444                                 continue;
5445                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5446                                 struct ieee80211_channel *chan;
5447
5448                                 chan = &wiphy->bands[band]->channels[j];
5449
5450                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5451                                         continue;
5452
5453                                 request->channels[i] = chan;
5454                                 i++;
5455                         }
5456                 }
5457         }
5458
5459         if (!i) {
5460                 err = -EINVAL;
5461                 goto out_free;
5462         }
5463
5464         request->n_channels = i;
5465
5466         i = 0;
5467         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5468                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5469                                     tmp) {
5470                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5471                                 err = -EINVAL;
5472                                 goto out_free;
5473                         }
5474                         request->ssids[i].ssid_len = nla_len(attr);
5475                         memcpy(request->ssids[i].ssid, nla_data(attr),
5476                                nla_len(attr));
5477                         i++;
5478                 }
5479         }
5480
5481         i = 0;
5482         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5483                 nla_for_each_nested(attr,
5484                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5485                                     tmp) {
5486                         struct nlattr *ssid, *rssi;
5487
5488                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5489                                   nla_data(attr), nla_len(attr),
5490                                   nl80211_match_policy);
5491                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5492                         if (ssid) {
5493                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5494                                         err = -EINVAL;
5495                                         goto out_free;
5496                                 }
5497                                 memcpy(request->match_sets[i].ssid.ssid,
5498                                        nla_data(ssid), nla_len(ssid));
5499                                 request->match_sets[i].ssid.ssid_len =
5500                                         nla_len(ssid);
5501                         }
5502                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5503                         if (rssi)
5504                                 request->rssi_thold = nla_get_u32(rssi);
5505                         else
5506                                 request->rssi_thold =
5507                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5508                         i++;
5509                 }
5510         }
5511
5512         if (info->attrs[NL80211_ATTR_IE]) {
5513                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5514                 memcpy((void *)request->ie,
5515                        nla_data(info->attrs[NL80211_ATTR_IE]),
5516                        request->ie_len);
5517         }
5518
5519         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5520                 request->flags = nla_get_u32(
5521                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5522                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5523                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5524                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5525                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5526                         err = -EOPNOTSUPP;
5527                         goto out_free;
5528                 }
5529         }
5530
5531         request->dev = dev;
5532         request->wiphy = &rdev->wiphy;
5533         request->interval = interval;
5534         request->scan_start = jiffies;
5535
5536         err = rdev_sched_scan_start(rdev, dev, request);
5537         if (!err) {
5538                 rdev->sched_scan_req = request;
5539                 nl80211_send_sched_scan(rdev, dev,
5540                                         NL80211_CMD_START_SCHED_SCAN);
5541                 goto out;
5542         }
5543
5544 out_free:
5545         kfree(request);
5546 out:
5547         mutex_unlock(&rdev->sched_scan_mtx);
5548         return err;
5549 }
5550
5551 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5552                                    struct genl_info *info)
5553 {
5554         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5555         int err;
5556
5557         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5558             !rdev->ops->sched_scan_stop)
5559                 return -EOPNOTSUPP;
5560
5561         mutex_lock(&rdev->sched_scan_mtx);
5562         err = __cfg80211_stop_sched_scan(rdev, false);
5563         mutex_unlock(&rdev->sched_scan_mtx);
5564
5565         return err;
5566 }
5567
5568 static int nl80211_start_radar_detection(struct sk_buff *skb,
5569                                          struct genl_info *info)
5570 {
5571         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5572         struct net_device *dev = info->user_ptr[1];
5573         struct wireless_dev *wdev = dev->ieee80211_ptr;
5574         struct cfg80211_chan_def chandef;
5575         int err;
5576
5577         err = nl80211_parse_chandef(rdev, info, &chandef);
5578         if (err)
5579                 return err;
5580
5581         if (wdev->cac_started)
5582                 return -EBUSY;
5583
5584         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5585         if (err < 0)
5586                 return err;
5587
5588         if (err == 0)
5589                 return -EINVAL;
5590
5591         if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5592                 return -EINVAL;
5593
5594         if (!rdev->ops->start_radar_detection)
5595                 return -EOPNOTSUPP;
5596
5597         mutex_lock(&rdev->devlist_mtx);
5598         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5599                                            chandef.chan, CHAN_MODE_SHARED,
5600                                            BIT(chandef.width));
5601         if (err)
5602                 goto err_locked;
5603
5604         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5605         if (!err) {
5606                 wdev->channel = chandef.chan;
5607                 wdev->cac_started = true;
5608                 wdev->cac_start_time = jiffies;
5609         }
5610 err_locked:
5611         mutex_unlock(&rdev->devlist_mtx);
5612
5613         return err;
5614 }
5615
5616 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5617                             u32 seq, int flags,
5618                             struct cfg80211_registered_device *rdev,
5619                             struct wireless_dev *wdev,
5620                             struct cfg80211_internal_bss *intbss)
5621 {
5622         struct cfg80211_bss *res = &intbss->pub;
5623         const struct cfg80211_bss_ies *ies;
5624         void *hdr;
5625         struct nlattr *bss;
5626         bool tsf = false;
5627
5628         ASSERT_WDEV_LOCK(wdev);
5629
5630         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5631                              NL80211_CMD_NEW_SCAN_RESULTS);
5632         if (!hdr)
5633                 return -1;
5634
5635         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5636
5637         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
5638                 goto nla_put_failure;
5639         if (wdev->netdev &&
5640             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5641                 goto nla_put_failure;
5642         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
5643                 goto nla_put_failure;
5644
5645         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5646         if (!bss)
5647                 goto nla_put_failure;
5648         if ((!is_zero_ether_addr(res->bssid) &&
5649              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5650                 goto nla_put_failure;
5651
5652         rcu_read_lock();
5653         ies = rcu_dereference(res->ies);
5654         if (ies) {
5655                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5656                         goto fail_unlock_rcu;
5657                 tsf = true;
5658                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5659                                         ies->len, ies->data))
5660                         goto fail_unlock_rcu;
5661         }
5662         ies = rcu_dereference(res->beacon_ies);
5663         if (ies) {
5664                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5665                         goto fail_unlock_rcu;
5666                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5667                                         ies->len, ies->data))
5668                         goto fail_unlock_rcu;
5669         }
5670         rcu_read_unlock();
5671
5672         if (res->beacon_interval &&
5673             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5674                 goto nla_put_failure;
5675         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5676             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5677             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5678                         jiffies_to_msecs(jiffies - intbss->ts)))
5679                 goto nla_put_failure;
5680
5681         switch (rdev->wiphy.signal_type) {
5682         case CFG80211_SIGNAL_TYPE_MBM:
5683                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5684                         goto nla_put_failure;
5685                 break;
5686         case CFG80211_SIGNAL_TYPE_UNSPEC:
5687                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5688                         goto nla_put_failure;
5689                 break;
5690         default:
5691                 break;
5692         }
5693
5694         switch (wdev->iftype) {
5695         case NL80211_IFTYPE_P2P_CLIENT:
5696         case NL80211_IFTYPE_STATION:
5697                 if (intbss == wdev->current_bss &&
5698                     nla_put_u32(msg, NL80211_BSS_STATUS,
5699                                 NL80211_BSS_STATUS_ASSOCIATED))
5700                         goto nla_put_failure;
5701                 break;
5702         case NL80211_IFTYPE_ADHOC:
5703                 if (intbss == wdev->current_bss &&
5704                     nla_put_u32(msg, NL80211_BSS_STATUS,
5705                                 NL80211_BSS_STATUS_IBSS_JOINED))
5706                         goto nla_put_failure;
5707                 break;
5708         default:
5709                 break;
5710         }
5711
5712         nla_nest_end(msg, bss);
5713
5714         return genlmsg_end(msg, hdr);
5715
5716  fail_unlock_rcu:
5717         rcu_read_unlock();
5718  nla_put_failure:
5719         genlmsg_cancel(msg, hdr);
5720         return -EMSGSIZE;
5721 }
5722
5723 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
5724 {
5725         struct cfg80211_registered_device *rdev;
5726         struct cfg80211_internal_bss *scan;
5727         struct wireless_dev *wdev;
5728         int start = cb->args[2], idx = 0;
5729         int err;
5730
5731         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5732         if (err)
5733                 return err;
5734
5735         wdev_lock(wdev);
5736         spin_lock_bh(&rdev->bss_lock);
5737         cfg80211_bss_expire(rdev);
5738
5739         cb->seq = rdev->bss_generation;
5740
5741         list_for_each_entry(scan, &rdev->bss_list, list) {
5742                 if (++idx <= start)
5743                         continue;
5744                 if (nl80211_send_bss(skb, cb,
5745                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5746                                 rdev, wdev, scan) < 0) {
5747                         idx--;
5748                         break;
5749                 }
5750         }
5751
5752         spin_unlock_bh(&rdev->bss_lock);
5753         wdev_unlock(wdev);
5754
5755         cb->args[2] = idx;
5756         nl80211_finish_wdev_dump(rdev);
5757
5758         return skb->len;
5759 }
5760
5761 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5762                                 int flags, struct net_device *dev,
5763                                 struct survey_info *survey)
5764 {
5765         void *hdr;
5766         struct nlattr *infoattr;
5767
5768         hdr = nl80211hdr_put(msg, portid, seq, flags,
5769                              NL80211_CMD_NEW_SURVEY_RESULTS);
5770         if (!hdr)
5771                 return -ENOMEM;
5772
5773         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5774                 goto nla_put_failure;
5775
5776         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5777         if (!infoattr)
5778                 goto nla_put_failure;
5779
5780         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5781                         survey->channel->center_freq))
5782                 goto nla_put_failure;
5783
5784         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5785             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5786                 goto nla_put_failure;
5787         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5788             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5789                 goto nla_put_failure;
5790         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5791             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5792                         survey->channel_time))
5793                 goto nla_put_failure;
5794         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5795             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5796                         survey->channel_time_busy))
5797                 goto nla_put_failure;
5798         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5799             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5800                         survey->channel_time_ext_busy))
5801                 goto nla_put_failure;
5802         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5803             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5804                         survey->channel_time_rx))
5805                 goto nla_put_failure;
5806         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5807             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5808                         survey->channel_time_tx))
5809                 goto nla_put_failure;
5810
5811         nla_nest_end(msg, infoattr);
5812
5813         return genlmsg_end(msg, hdr);
5814
5815  nla_put_failure:
5816         genlmsg_cancel(msg, hdr);
5817         return -EMSGSIZE;
5818 }
5819
5820 static int nl80211_dump_survey(struct sk_buff *skb,
5821                         struct netlink_callback *cb)
5822 {
5823         struct survey_info survey;
5824         struct cfg80211_registered_device *dev;
5825         struct wireless_dev *wdev;
5826         int survey_idx = cb->args[2];
5827         int res;
5828
5829         res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
5830         if (res)
5831                 return res;
5832
5833         if (!wdev->netdev) {
5834                 res = -EINVAL;
5835                 goto out_err;
5836         }
5837
5838         if (!dev->ops->dump_survey) {
5839                 res = -EOPNOTSUPP;
5840                 goto out_err;
5841         }
5842
5843         while (1) {
5844                 struct ieee80211_channel *chan;
5845
5846                 res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
5847                 if (res == -ENOENT)
5848                         break;
5849                 if (res)
5850                         goto out_err;
5851
5852                 /* Survey without a channel doesn't make sense */
5853                 if (!survey.channel) {
5854                         res = -EINVAL;
5855                         goto out;
5856                 }
5857
5858                 chan = ieee80211_get_channel(&dev->wiphy,
5859                                              survey.channel->center_freq);
5860                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5861                         survey_idx++;
5862                         continue;
5863                 }
5864
5865                 if (nl80211_send_survey(skb,
5866                                 NETLINK_CB(cb->skb).portid,
5867                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5868                                 wdev->netdev, &survey) < 0)
5869                         goto out;
5870                 survey_idx++;
5871         }
5872
5873  out:
5874         cb->args[2] = survey_idx;
5875         res = skb->len;
5876  out_err:
5877         nl80211_finish_wdev_dump(dev);
5878         return res;
5879 }
5880
5881 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5882 {
5883         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5884                                   NL80211_WPA_VERSION_2));
5885 }
5886
5887 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5888 {
5889         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5890         struct net_device *dev = info->user_ptr[1];
5891         struct ieee80211_channel *chan;
5892         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5893         int err, ssid_len, ie_len = 0, sae_data_len = 0;
5894         enum nl80211_auth_type auth_type;
5895         struct key_parse key;
5896         bool local_state_change;
5897
5898         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5899                 return -EINVAL;
5900
5901         if (!info->attrs[NL80211_ATTR_MAC])
5902                 return -EINVAL;
5903
5904         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5905                 return -EINVAL;
5906
5907         if (!info->attrs[NL80211_ATTR_SSID])
5908                 return -EINVAL;
5909
5910         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5911                 return -EINVAL;
5912
5913         err = nl80211_parse_key(info, &key);
5914         if (err)
5915                 return err;
5916
5917         if (key.idx >= 0) {
5918                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5919                         return -EINVAL;
5920                 if (!key.p.key || !key.p.key_len)
5921                         return -EINVAL;
5922                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5923                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5924                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5925                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5926                         return -EINVAL;
5927                 if (key.idx > 4)
5928                         return -EINVAL;
5929         } else {
5930                 key.p.key_len = 0;
5931                 key.p.key = NULL;
5932         }
5933
5934         if (key.idx >= 0) {
5935                 int i;
5936                 bool ok = false;
5937                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5938                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5939                                 ok = true;
5940                                 break;
5941                         }
5942                 }
5943                 if (!ok)
5944                         return -EINVAL;
5945         }
5946
5947         if (!rdev->ops->auth)
5948                 return -EOPNOTSUPP;
5949
5950         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5951             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5952                 return -EOPNOTSUPP;
5953
5954         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5955         chan = ieee80211_get_channel(&rdev->wiphy,
5956                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5957         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5958                 return -EINVAL;
5959
5960         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5961         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5962
5963         if (info->attrs[NL80211_ATTR_IE]) {
5964                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5965                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5966         }
5967
5968         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5969         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5970                 return -EINVAL;
5971
5972         if (auth_type == NL80211_AUTHTYPE_SAE &&
5973             !info->attrs[NL80211_ATTR_SAE_DATA])
5974                 return -EINVAL;
5975
5976         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5977                 if (auth_type != NL80211_AUTHTYPE_SAE)
5978                         return -EINVAL;
5979                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5980                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5981                 /* need to include at least Auth Transaction and Status Code */
5982                 if (sae_data_len < 4)
5983                         return -EINVAL;
5984         }
5985
5986         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5987
5988         /*
5989          * Since we no longer track auth state, ignore
5990          * requests to only change local state.
5991          */
5992         if (local_state_change)
5993                 return 0;
5994
5995         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5996                                   ssid, ssid_len, ie, ie_len,
5997                                   key.p.key, key.p.key_len, key.idx,
5998                                   sae_data, sae_data_len);
5999 }
6000
6001 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6002                                    struct genl_info *info,
6003                                    struct cfg80211_crypto_settings *settings,
6004                                    int cipher_limit)
6005 {
6006         memset(settings, 0, sizeof(*settings));
6007
6008         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6009
6010         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6011                 u16 proto;
6012                 proto = nla_get_u16(
6013                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6014                 settings->control_port_ethertype = cpu_to_be16(proto);
6015                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6016                     proto != ETH_P_PAE)
6017                         return -EINVAL;
6018                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6019                         settings->control_port_no_encrypt = true;
6020         } else
6021                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6022
6023         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6024                 void *data;
6025                 int len, i;
6026
6027                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6028                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6029                 settings->n_ciphers_pairwise = len / sizeof(u32);
6030
6031                 if (len % sizeof(u32))
6032                         return -EINVAL;
6033
6034                 if (settings->n_ciphers_pairwise > cipher_limit)
6035                         return -EINVAL;
6036
6037                 memcpy(settings->ciphers_pairwise, data, len);
6038
6039                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6040                         if (!cfg80211_supported_cipher_suite(
6041                                         &rdev->wiphy,
6042                                         settings->ciphers_pairwise[i]))
6043                                 return -EINVAL;
6044         }
6045
6046         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6047                 settings->cipher_group =
6048                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6049                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6050                                                      settings->cipher_group))
6051                         return -EINVAL;
6052         }
6053
6054         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6055                 settings->wpa_versions =
6056                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6057                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6058                         return -EINVAL;
6059         }
6060
6061         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6062                 void *data;
6063                 int len;
6064
6065                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6066                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6067                 settings->n_akm_suites = len / sizeof(u32);
6068
6069                 if (len % sizeof(u32))
6070                         return -EINVAL;
6071
6072                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6073                         return -EINVAL;
6074
6075                 memcpy(settings->akm_suites, data, len);
6076         }
6077
6078         return 0;
6079 }
6080
6081 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6082 {
6083         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6084         struct net_device *dev = info->user_ptr[1];
6085         struct ieee80211_channel *chan;
6086         struct cfg80211_assoc_request req = {};
6087         const u8 *bssid, *ssid;
6088         int err, ssid_len = 0;
6089
6090         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6091                 return -EINVAL;
6092
6093         if (!info->attrs[NL80211_ATTR_MAC] ||
6094             !info->attrs[NL80211_ATTR_SSID] ||
6095             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6096                 return -EINVAL;
6097
6098         if (!rdev->ops->assoc)
6099                 return -EOPNOTSUPP;
6100
6101         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6102             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6103                 return -EOPNOTSUPP;
6104
6105         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6106
6107         chan = ieee80211_get_channel(&rdev->wiphy,
6108                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6109         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6110                 return -EINVAL;
6111
6112         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6113         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6114
6115         if (info->attrs[NL80211_ATTR_IE]) {
6116                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6117                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6118         }
6119
6120         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6121                 enum nl80211_mfp mfp =
6122                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6123                 if (mfp == NL80211_MFP_REQUIRED)
6124                         req.use_mfp = true;
6125                 else if (mfp != NL80211_MFP_NO)
6126                         return -EINVAL;
6127         }
6128
6129         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6130                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6131
6132         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6133                 req.flags |= ASSOC_REQ_DISABLE_HT;
6134
6135         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6136                 memcpy(&req.ht_capa_mask,
6137                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6138                        sizeof(req.ht_capa_mask));
6139
6140         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6141                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6142                         return -EINVAL;
6143                 memcpy(&req.ht_capa,
6144                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6145                        sizeof(req.ht_capa));
6146         }
6147
6148         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6149                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6150
6151         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6152                 memcpy(&req.vht_capa_mask,
6153                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6154                        sizeof(req.vht_capa_mask));
6155
6156         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6157                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6158                         return -EINVAL;
6159                 memcpy(&req.vht_capa,
6160                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6161                        sizeof(req.vht_capa));
6162         }
6163
6164         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6165         if (!err)
6166                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6167                                           ssid, ssid_len, &req);
6168
6169         return err;
6170 }
6171
6172 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6173 {
6174         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6175         struct net_device *dev = info->user_ptr[1];
6176         const u8 *ie = NULL, *bssid;
6177         int ie_len = 0;
6178         u16 reason_code;
6179         bool local_state_change;
6180
6181         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6182                 return -EINVAL;
6183
6184         if (!info->attrs[NL80211_ATTR_MAC])
6185                 return -EINVAL;
6186
6187         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6188                 return -EINVAL;
6189
6190         if (!rdev->ops->deauth)
6191                 return -EOPNOTSUPP;
6192
6193         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6194             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6195                 return -EOPNOTSUPP;
6196
6197         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6198
6199         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6200         if (reason_code == 0) {
6201                 /* Reason Code 0 is reserved */
6202                 return -EINVAL;
6203         }
6204
6205         if (info->attrs[NL80211_ATTR_IE]) {
6206                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6207                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6208         }
6209
6210         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6211
6212         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6213                                     local_state_change);
6214 }
6215
6216 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6217 {
6218         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6219         struct net_device *dev = info->user_ptr[1];
6220         const u8 *ie = NULL, *bssid;
6221         int ie_len = 0;
6222         u16 reason_code;
6223         bool local_state_change;
6224
6225         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6226                 return -EINVAL;
6227
6228         if (!info->attrs[NL80211_ATTR_MAC])
6229                 return -EINVAL;
6230
6231         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6232                 return -EINVAL;
6233
6234         if (!rdev->ops->disassoc)
6235                 return -EOPNOTSUPP;
6236
6237         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6238             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6239                 return -EOPNOTSUPP;
6240
6241         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6242
6243         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6244         if (reason_code == 0) {
6245                 /* Reason Code 0 is reserved */
6246                 return -EINVAL;
6247         }
6248
6249         if (info->attrs[NL80211_ATTR_IE]) {
6250                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6251                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6252         }
6253
6254         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6255
6256         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6257                                       local_state_change);
6258 }
6259
6260 static bool
6261 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6262                          int mcast_rate[IEEE80211_NUM_BANDS],
6263                          int rateval)
6264 {
6265         struct wiphy *wiphy = &rdev->wiphy;
6266         bool found = false;
6267         int band, i;
6268
6269         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6270                 struct ieee80211_supported_band *sband;
6271
6272                 sband = wiphy->bands[band];
6273                 if (!sband)
6274                         continue;
6275
6276                 for (i = 0; i < sband->n_bitrates; i++) {
6277                         if (sband->bitrates[i].bitrate == rateval) {
6278                                 mcast_rate[band] = i + 1;
6279                                 found = true;
6280                                 break;
6281                         }
6282                 }
6283         }
6284
6285         return found;
6286 }
6287
6288 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6289 {
6290         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6291         struct net_device *dev = info->user_ptr[1];
6292         struct cfg80211_ibss_params ibss;
6293         struct wiphy *wiphy;
6294         struct cfg80211_cached_keys *connkeys = NULL;
6295         int err;
6296
6297         memset(&ibss, 0, sizeof(ibss));
6298
6299         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6300                 return -EINVAL;
6301
6302         if (!info->attrs[NL80211_ATTR_SSID] ||
6303             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6304                 return -EINVAL;
6305
6306         ibss.beacon_interval = 100;
6307
6308         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6309                 ibss.beacon_interval =
6310                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6311                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6312                         return -EINVAL;
6313         }
6314
6315         if (!rdev->ops->join_ibss)
6316                 return -EOPNOTSUPP;
6317
6318         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6319                 return -EOPNOTSUPP;
6320
6321         wiphy = &rdev->wiphy;
6322
6323         if (info->attrs[NL80211_ATTR_MAC]) {
6324                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6325
6326                 if (!is_valid_ether_addr(ibss.bssid))
6327                         return -EINVAL;
6328         }
6329         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6330         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6331
6332         if (info->attrs[NL80211_ATTR_IE]) {
6333                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6334                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6335         }
6336
6337         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6338         if (err)
6339                 return err;
6340
6341         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6342                 return -EINVAL;
6343
6344         if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
6345                 return -EINVAL;
6346         if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
6347             !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
6348                 return -EINVAL;
6349
6350         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6351         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6352
6353         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6354                 u8 *rates =
6355                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6356                 int n_rates =
6357                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6358                 struct ieee80211_supported_band *sband =
6359                         wiphy->bands[ibss.chandef.chan->band];
6360
6361                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6362                                              &ibss.basic_rates);
6363                 if (err)
6364                         return err;
6365         }
6366
6367         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6368             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6369                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6370                 return -EINVAL;
6371
6372         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6373                 bool no_ht = false;
6374
6375                 connkeys = nl80211_parse_connkeys(rdev,
6376                                           info->attrs[NL80211_ATTR_KEYS],
6377                                           &no_ht);
6378                 if (IS_ERR(connkeys))
6379                         return PTR_ERR(connkeys);
6380
6381                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6382                     no_ht) {
6383                         kfree(connkeys);
6384                         return -EINVAL;
6385                 }
6386         }
6387
6388         ibss.control_port =
6389                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6390
6391         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6392         if (err)
6393                 kfree(connkeys);
6394         return err;
6395 }
6396
6397 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6398 {
6399         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6400         struct net_device *dev = info->user_ptr[1];
6401
6402         if (!rdev->ops->leave_ibss)
6403                 return -EOPNOTSUPP;
6404
6405         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6406                 return -EOPNOTSUPP;
6407
6408         return cfg80211_leave_ibss(rdev, dev, false);
6409 }
6410
6411 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6412 {
6413         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6414         struct net_device *dev = info->user_ptr[1];
6415         int mcast_rate[IEEE80211_NUM_BANDS];
6416         u32 nla_rate;
6417         int err;
6418
6419         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6420             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6421                 return -EOPNOTSUPP;
6422
6423         if (!rdev->ops->set_mcast_rate)
6424                 return -EOPNOTSUPP;
6425
6426         memset(mcast_rate, 0, sizeof(mcast_rate));
6427
6428         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6429                 return -EINVAL;
6430
6431         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6432         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6433                 return -EINVAL;
6434
6435         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6436
6437         return err;
6438 }
6439
6440
6441 #ifdef CONFIG_NL80211_TESTMODE
6442 static struct genl_multicast_group nl80211_testmode_mcgrp = {
6443         .name = "testmode",
6444 };
6445
6446 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6447 {
6448         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6449         int err;
6450
6451         if (!info->attrs[NL80211_ATTR_TESTDATA])
6452                 return -EINVAL;
6453
6454         err = -EOPNOTSUPP;
6455         if (rdev->ops->testmode_cmd) {
6456                 rdev->testmode_info = info;
6457                 err = rdev_testmode_cmd(rdev,
6458                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6459                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6460                 rdev->testmode_info = NULL;
6461         }
6462
6463         return err;
6464 }
6465
6466 static int nl80211_testmode_dump(struct sk_buff *skb,
6467                                  struct netlink_callback *cb)
6468 {
6469         struct cfg80211_registered_device *rdev;
6470         int err;
6471         long phy_idx;
6472         void *data = NULL;
6473         int data_len = 0;
6474
6475         if (cb->args[0]) {
6476                 /*
6477                  * 0 is a valid index, but not valid for args[0],
6478                  * so we need to offset by 1.
6479                  */
6480                 phy_idx = cb->args[0] - 1;
6481         } else {
6482                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6483                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6484                                   nl80211_policy);
6485                 if (err)
6486                         return err;
6487
6488                 mutex_lock(&cfg80211_mutex);
6489                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6490                                                   nl80211_fam.attrbuf);
6491                 if (IS_ERR(rdev)) {
6492                         mutex_unlock(&cfg80211_mutex);
6493                         return PTR_ERR(rdev);
6494                 }
6495                 phy_idx = rdev->wiphy_idx;
6496                 rdev = NULL;
6497                 mutex_unlock(&cfg80211_mutex);
6498
6499                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6500                         cb->args[1] =
6501                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6502         }
6503
6504         if (cb->args[1]) {
6505                 data = nla_data((void *)cb->args[1]);
6506                 data_len = nla_len((void *)cb->args[1]);
6507         }
6508
6509         mutex_lock(&cfg80211_mutex);
6510         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6511         if (!rdev) {
6512                 mutex_unlock(&cfg80211_mutex);
6513                 return -ENOENT;
6514         }
6515         cfg80211_lock_rdev(rdev);
6516         mutex_unlock(&cfg80211_mutex);
6517
6518         if (!rdev->ops->testmode_dump) {
6519                 err = -EOPNOTSUPP;
6520                 goto out_err;
6521         }
6522
6523         while (1) {
6524                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6525                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6526                                            NL80211_CMD_TESTMODE);
6527                 struct nlattr *tmdata;
6528
6529                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6530                         genlmsg_cancel(skb, hdr);
6531                         break;
6532                 }
6533
6534                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6535                 if (!tmdata) {
6536                         genlmsg_cancel(skb, hdr);
6537                         break;
6538                 }
6539                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6540                 nla_nest_end(skb, tmdata);
6541
6542                 if (err == -ENOBUFS || err == -ENOENT) {
6543                         genlmsg_cancel(skb, hdr);
6544                         break;
6545                 } else if (err) {
6546                         genlmsg_cancel(skb, hdr);
6547                         goto out_err;
6548                 }
6549
6550                 genlmsg_end(skb, hdr);
6551         }
6552
6553         err = skb->len;
6554         /* see above */
6555         cb->args[0] = phy_idx + 1;
6556  out_err:
6557         cfg80211_unlock_rdev(rdev);
6558         return err;
6559 }
6560
6561 static struct sk_buff *
6562 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6563                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6564 {
6565         struct sk_buff *skb;
6566         void *hdr;
6567         struct nlattr *data;
6568
6569         skb = nlmsg_new(approxlen + 100, gfp);
6570         if (!skb)
6571                 return NULL;
6572
6573         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6574         if (!hdr) {
6575                 kfree_skb(skb);
6576                 return NULL;
6577         }
6578
6579         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6580                 goto nla_put_failure;
6581         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6582
6583         ((void **)skb->cb)[0] = rdev;
6584         ((void **)skb->cb)[1] = hdr;
6585         ((void **)skb->cb)[2] = data;
6586
6587         return skb;
6588
6589  nla_put_failure:
6590         kfree_skb(skb);
6591         return NULL;
6592 }
6593
6594 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6595                                                   int approxlen)
6596 {
6597         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6598
6599         if (WARN_ON(!rdev->testmode_info))
6600                 return NULL;
6601
6602         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6603                                 rdev->testmode_info->snd_portid,
6604                                 rdev->testmode_info->snd_seq,
6605                                 GFP_KERNEL);
6606 }
6607 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6608
6609 int cfg80211_testmode_reply(struct sk_buff *skb)
6610 {
6611         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6612         void *hdr = ((void **)skb->cb)[1];
6613         struct nlattr *data = ((void **)skb->cb)[2];
6614
6615         if (WARN_ON(!rdev->testmode_info)) {
6616                 kfree_skb(skb);
6617                 return -EINVAL;
6618         }
6619
6620         nla_nest_end(skb, data);
6621         genlmsg_end(skb, hdr);
6622         return genlmsg_reply(skb, rdev->testmode_info);
6623 }
6624 EXPORT_SYMBOL(cfg80211_testmode_reply);
6625
6626 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6627                                                   int approxlen, gfp_t gfp)
6628 {
6629         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6630
6631         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6632 }
6633 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6634
6635 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6636 {
6637         void *hdr = ((void **)skb->cb)[1];
6638         struct nlattr *data = ((void **)skb->cb)[2];
6639
6640         nla_nest_end(skb, data);
6641         genlmsg_end(skb, hdr);
6642         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
6643 }
6644 EXPORT_SYMBOL(cfg80211_testmode_event);
6645 #endif
6646
6647 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6648 {
6649         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6650         struct net_device *dev = info->user_ptr[1];
6651         struct cfg80211_connect_params connect;
6652         struct wiphy *wiphy;
6653         struct cfg80211_cached_keys *connkeys = NULL;
6654         int err;
6655
6656         memset(&connect, 0, sizeof(connect));
6657
6658         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6659                 return -EINVAL;
6660
6661         if (!info->attrs[NL80211_ATTR_SSID] ||
6662             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6663                 return -EINVAL;
6664
6665         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6666                 connect.auth_type =
6667                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6668                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6669                                              NL80211_CMD_CONNECT))
6670                         return -EINVAL;
6671         } else
6672                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6673
6674         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6675
6676         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6677                                       NL80211_MAX_NR_CIPHER_SUITES);
6678         if (err)
6679                 return err;
6680
6681         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6682             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6683                 return -EOPNOTSUPP;
6684
6685         wiphy = &rdev->wiphy;
6686
6687         connect.bg_scan_period = -1;
6688         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6689                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6690                 connect.bg_scan_period =
6691                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6692         }
6693
6694         if (info->attrs[NL80211_ATTR_MAC])
6695                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6696         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6697         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6698
6699         if (info->attrs[NL80211_ATTR_IE]) {
6700                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6701                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6702         }
6703
6704         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6705                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6706                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6707                     connect.mfp != NL80211_MFP_NO)
6708                         return -EINVAL;
6709         } else {
6710                 connect.mfp = NL80211_MFP_NO;
6711         }
6712
6713         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6714                 connect.channel =
6715                         ieee80211_get_channel(wiphy,
6716                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6717                 if (!connect.channel ||
6718                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6719                         return -EINVAL;
6720         }
6721
6722         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6723                 connkeys = nl80211_parse_connkeys(rdev,
6724                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6725                 if (IS_ERR(connkeys))
6726                         return PTR_ERR(connkeys);
6727         }
6728
6729         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6730                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6731
6732         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6733                 memcpy(&connect.ht_capa_mask,
6734                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6735                        sizeof(connect.ht_capa_mask));
6736
6737         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6738                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6739                         kfree(connkeys);
6740                         return -EINVAL;
6741                 }
6742                 memcpy(&connect.ht_capa,
6743                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6744                        sizeof(connect.ht_capa));
6745         }
6746
6747         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6748                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
6749
6750         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6751                 memcpy(&connect.vht_capa_mask,
6752                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6753                        sizeof(connect.vht_capa_mask));
6754
6755         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6756                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
6757                         kfree(connkeys);
6758                         return -EINVAL;
6759                 }
6760                 memcpy(&connect.vht_capa,
6761                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6762                        sizeof(connect.vht_capa));
6763         }
6764
6765         err = cfg80211_connect(rdev, dev, &connect, connkeys);
6766         if (err)
6767                 kfree(connkeys);
6768         return err;
6769 }
6770
6771 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6772 {
6773         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6774         struct net_device *dev = info->user_ptr[1];
6775         u16 reason;
6776
6777         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6778                 reason = WLAN_REASON_DEAUTH_LEAVING;
6779         else
6780                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6781
6782         if (reason == 0)
6783                 return -EINVAL;
6784
6785         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6786             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6787                 return -EOPNOTSUPP;
6788
6789         return cfg80211_disconnect(rdev, dev, reason, true);
6790 }
6791
6792 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6793 {
6794         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6795         struct net *net;
6796         int err;
6797         u32 pid;
6798
6799         if (!info->attrs[NL80211_ATTR_PID])
6800                 return -EINVAL;
6801
6802         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6803
6804         net = get_net_ns_by_pid(pid);
6805         if (IS_ERR(net))
6806                 return PTR_ERR(net);
6807
6808         err = 0;
6809
6810         /* check if anything to do */
6811         if (!net_eq(wiphy_net(&rdev->wiphy), net))
6812                 err = cfg80211_switch_netns(rdev, net);
6813
6814         put_net(net);
6815         return err;
6816 }
6817
6818 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6819 {
6820         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6821         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6822                         struct cfg80211_pmksa *pmksa) = NULL;
6823         struct net_device *dev = info->user_ptr[1];
6824         struct cfg80211_pmksa pmksa;
6825
6826         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6827
6828         if (!info->attrs[NL80211_ATTR_MAC])
6829                 return -EINVAL;
6830
6831         if (!info->attrs[NL80211_ATTR_PMKID])
6832                 return -EINVAL;
6833
6834         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6835         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6836
6837         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6838             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6839                 return -EOPNOTSUPP;
6840
6841         switch (info->genlhdr->cmd) {
6842         case NL80211_CMD_SET_PMKSA:
6843                 rdev_ops = rdev->ops->set_pmksa;
6844                 break;
6845         case NL80211_CMD_DEL_PMKSA:
6846                 rdev_ops = rdev->ops->del_pmksa;
6847                 break;
6848         default:
6849                 WARN_ON(1);
6850                 break;
6851         }
6852
6853         if (!rdev_ops)
6854                 return -EOPNOTSUPP;
6855
6856         return rdev_ops(&rdev->wiphy, dev, &pmksa);
6857 }
6858
6859 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6860 {
6861         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6862         struct net_device *dev = info->user_ptr[1];
6863
6864         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6865             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6866                 return -EOPNOTSUPP;
6867
6868         if (!rdev->ops->flush_pmksa)
6869                 return -EOPNOTSUPP;
6870
6871         return rdev_flush_pmksa(rdev, dev);
6872 }
6873
6874 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6875 {
6876         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6877         struct net_device *dev = info->user_ptr[1];
6878         u8 action_code, dialog_token;
6879         u16 status_code;
6880         u8 *peer;
6881
6882         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6883             !rdev->ops->tdls_mgmt)
6884                 return -EOPNOTSUPP;
6885
6886         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6887             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6888             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6889             !info->attrs[NL80211_ATTR_IE] ||
6890             !info->attrs[NL80211_ATTR_MAC])
6891                 return -EINVAL;
6892
6893         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6894         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6895         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6896         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6897
6898         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6899                               dialog_token, status_code,
6900                               nla_data(info->attrs[NL80211_ATTR_IE]),
6901                               nla_len(info->attrs[NL80211_ATTR_IE]));
6902 }
6903
6904 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6905 {
6906         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6907         struct net_device *dev = info->user_ptr[1];
6908         enum nl80211_tdls_operation operation;
6909         u8 *peer;
6910
6911         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6912             !rdev->ops->tdls_oper)
6913                 return -EOPNOTSUPP;
6914
6915         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6916             !info->attrs[NL80211_ATTR_MAC])
6917                 return -EINVAL;
6918
6919         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6920         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6921
6922         return rdev_tdls_oper(rdev, dev, peer, operation);
6923 }
6924
6925 static int nl80211_remain_on_channel(struct sk_buff *skb,
6926                                      struct genl_info *info)
6927 {
6928         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6929         struct wireless_dev *wdev = info->user_ptr[1];
6930         struct cfg80211_chan_def chandef;
6931         struct sk_buff *msg;
6932         void *hdr;
6933         u64 cookie;
6934         u32 duration;
6935         int err;
6936
6937         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6938             !info->attrs[NL80211_ATTR_DURATION])
6939                 return -EINVAL;
6940
6941         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6942
6943         if (!rdev->ops->remain_on_channel ||
6944             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6945                 return -EOPNOTSUPP;
6946
6947         /*
6948          * We should be on that channel for at least a minimum amount of
6949          * time (10ms) but no longer than the driver supports.
6950          */
6951         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6952             duration > rdev->wiphy.max_remain_on_channel_duration)
6953                 return -EINVAL;
6954
6955         err = nl80211_parse_chandef(rdev, info, &chandef);
6956         if (err)
6957                 return err;
6958
6959         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6960         if (!msg)
6961                 return -ENOMEM;
6962
6963         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6964                              NL80211_CMD_REMAIN_ON_CHANNEL);
6965
6966         if (IS_ERR(hdr)) {
6967                 err = PTR_ERR(hdr);
6968                 goto free_msg;
6969         }
6970
6971         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6972                                      duration, &cookie);
6973
6974         if (err)
6975                 goto free_msg;
6976
6977         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6978                 goto nla_put_failure;
6979
6980         genlmsg_end(msg, hdr);
6981
6982         return genlmsg_reply(msg, info);
6983
6984  nla_put_failure:
6985         err = -ENOBUFS;
6986  free_msg:
6987         nlmsg_free(msg);
6988         return err;
6989 }
6990
6991 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6992                                             struct genl_info *info)
6993 {
6994         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6995         struct wireless_dev *wdev = info->user_ptr[1];
6996         u64 cookie;
6997
6998         if (!info->attrs[NL80211_ATTR_COOKIE])
6999                 return -EINVAL;
7000
7001         if (!rdev->ops->cancel_remain_on_channel)
7002                 return -EOPNOTSUPP;
7003
7004         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7005
7006         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7007 }
7008
7009 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7010                            u8 *rates, u8 rates_len)
7011 {
7012         u8 i;
7013         u32 mask = 0;
7014
7015         for (i = 0; i < rates_len; i++) {
7016                 int rate = (rates[i] & 0x7f) * 5;
7017                 int ridx;
7018                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7019                         struct ieee80211_rate *srate =
7020                                 &sband->bitrates[ridx];
7021                         if (rate == srate->bitrate) {
7022                                 mask |= 1 << ridx;
7023                                 break;
7024                         }
7025                 }
7026                 if (ridx == sband->n_bitrates)
7027                         return 0; /* rate not found */
7028         }
7029
7030         return mask;
7031 }
7032
7033 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7034                                u8 *rates, u8 rates_len,
7035                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7036 {
7037         u8 i;
7038
7039         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7040
7041         for (i = 0; i < rates_len; i++) {
7042                 int ridx, rbit;
7043
7044                 ridx = rates[i] / 8;
7045                 rbit = BIT(rates[i] % 8);
7046
7047                 /* check validity */
7048                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7049                         return false;
7050
7051                 /* check availability */
7052                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7053                         mcs[ridx] |= rbit;
7054                 else
7055                         return false;
7056         }
7057
7058         return true;
7059 }
7060
7061 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7062         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7063                                     .len = NL80211_MAX_SUPP_RATES },
7064         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
7065                                  .len = NL80211_MAX_SUPP_HT_RATES },
7066 };
7067
7068 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7069                                        struct genl_info *info)
7070 {
7071         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7072         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7073         struct cfg80211_bitrate_mask mask;
7074         int rem, i;
7075         struct net_device *dev = info->user_ptr[1];
7076         struct nlattr *tx_rates;
7077         struct ieee80211_supported_band *sband;
7078
7079         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
7080                 return -EINVAL;
7081
7082         if (!rdev->ops->set_bitrate_mask)
7083                 return -EOPNOTSUPP;
7084
7085         memset(&mask, 0, sizeof(mask));
7086         /* Default to all rates enabled */
7087         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7088                 sband = rdev->wiphy.bands[i];
7089                 mask.control[i].legacy =
7090                         sband ? (1 << sband->n_bitrates) - 1 : 0;
7091                 if (sband)
7092                         memcpy(mask.control[i].mcs,
7093                                sband->ht_cap.mcs.rx_mask,
7094                                sizeof(mask.control[i].mcs));
7095                 else
7096                         memset(mask.control[i].mcs, 0,
7097                                sizeof(mask.control[i].mcs));
7098         }
7099
7100         /*
7101          * The nested attribute uses enum nl80211_band as the index. This maps
7102          * directly to the enum ieee80211_band values used in cfg80211.
7103          */
7104         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7105         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
7106         {
7107                 enum ieee80211_band band = nla_type(tx_rates);
7108                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7109                         return -EINVAL;
7110                 sband = rdev->wiphy.bands[band];
7111                 if (sband == NULL)
7112                         return -EINVAL;
7113                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7114                           nla_len(tx_rates), nl80211_txattr_policy);
7115                 if (tb[NL80211_TXRATE_LEGACY]) {
7116                         mask.control[band].legacy = rateset_to_mask(
7117                                 sband,
7118                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7119                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7120                         if ((mask.control[band].legacy == 0) &&
7121                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7122                                 return -EINVAL;
7123                 }
7124                 if (tb[NL80211_TXRATE_MCS]) {
7125                         if (!ht_rateset_to_mask(
7126                                         sband,
7127                                         nla_data(tb[NL80211_TXRATE_MCS]),
7128                                         nla_len(tb[NL80211_TXRATE_MCS]),
7129                                         mask.control[band].mcs))
7130                                 return -EINVAL;
7131                 }
7132
7133                 if (mask.control[band].legacy == 0) {
7134                         /* don't allow empty legacy rates if HT
7135                          * is not even supported. */
7136                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
7137                                 return -EINVAL;
7138
7139                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7140                                 if (mask.control[band].mcs[i])
7141                                         break;
7142
7143                         /* legacy and mcs rates may not be both empty */
7144                         if (i == IEEE80211_HT_MCS_MASK_LEN)
7145                                 return -EINVAL;
7146                 }
7147         }
7148
7149         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7150 }
7151
7152 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7153 {
7154         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7155         struct wireless_dev *wdev = info->user_ptr[1];
7156         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7157
7158         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7159                 return -EINVAL;
7160
7161         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7162                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7163
7164         switch (wdev->iftype) {
7165         case NL80211_IFTYPE_STATION:
7166         case NL80211_IFTYPE_ADHOC:
7167         case NL80211_IFTYPE_P2P_CLIENT:
7168         case NL80211_IFTYPE_AP:
7169         case NL80211_IFTYPE_AP_VLAN:
7170         case NL80211_IFTYPE_MESH_POINT:
7171         case NL80211_IFTYPE_P2P_GO:
7172         case NL80211_IFTYPE_P2P_DEVICE:
7173                 break;
7174         default:
7175                 return -EOPNOTSUPP;
7176         }
7177
7178         /* not much point in registering if we can't reply */
7179         if (!rdev->ops->mgmt_tx)
7180                 return -EOPNOTSUPP;
7181
7182         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7183                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7184                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7185 }
7186
7187 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7188 {
7189         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7190         struct wireless_dev *wdev = info->user_ptr[1];
7191         struct cfg80211_chan_def chandef;
7192         int err;
7193         void *hdr = NULL;
7194         u64 cookie;
7195         struct sk_buff *msg = NULL;
7196         unsigned int wait = 0;
7197         bool offchan, no_cck, dont_wait_for_ack;
7198
7199         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
7200
7201         if (!info->attrs[NL80211_ATTR_FRAME])
7202                 return -EINVAL;
7203
7204         if (!rdev->ops->mgmt_tx)
7205                 return -EOPNOTSUPP;
7206
7207         switch (wdev->iftype) {
7208         case NL80211_IFTYPE_STATION:
7209         case NL80211_IFTYPE_ADHOC:
7210         case NL80211_IFTYPE_P2P_CLIENT:
7211         case NL80211_IFTYPE_AP:
7212         case NL80211_IFTYPE_AP_VLAN:
7213         case NL80211_IFTYPE_MESH_POINT:
7214         case NL80211_IFTYPE_P2P_GO:
7215         case NL80211_IFTYPE_P2P_DEVICE:
7216                 break;
7217         default:
7218                 return -EOPNOTSUPP;
7219         }
7220
7221         if (info->attrs[NL80211_ATTR_DURATION]) {
7222                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7223                         return -EINVAL;
7224                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7225
7226                 /*
7227                  * We should wait on the channel for at least a minimum amount
7228                  * of time (10ms) but no longer than the driver supports.
7229                  */
7230                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7231                     wait > rdev->wiphy.max_remain_on_channel_duration)
7232                         return -EINVAL;
7233
7234         }
7235
7236         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7237
7238         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7239                 return -EINVAL;
7240
7241         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7242
7243         err = nl80211_parse_chandef(rdev, info, &chandef);
7244         if (err)
7245                 return err;
7246
7247         if (!dont_wait_for_ack) {
7248                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7249                 if (!msg)
7250                         return -ENOMEM;
7251
7252                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7253                                      NL80211_CMD_FRAME);
7254
7255                 if (IS_ERR(hdr)) {
7256                         err = PTR_ERR(hdr);
7257                         goto free_msg;
7258                 }
7259         }
7260
7261         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
7262                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
7263                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
7264                                     no_cck, dont_wait_for_ack, &cookie);
7265         if (err)
7266                 goto free_msg;
7267
7268         if (msg) {
7269                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7270                         goto nla_put_failure;
7271
7272                 genlmsg_end(msg, hdr);
7273                 return genlmsg_reply(msg, info);
7274         }
7275
7276         return 0;
7277
7278  nla_put_failure:
7279         err = -ENOBUFS;
7280  free_msg:
7281         nlmsg_free(msg);
7282         return err;
7283 }
7284
7285 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7286 {
7287         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7288         struct wireless_dev *wdev = info->user_ptr[1];
7289         u64 cookie;
7290
7291         if (!info->attrs[NL80211_ATTR_COOKIE])
7292                 return -EINVAL;
7293
7294         if (!rdev->ops->mgmt_tx_cancel_wait)
7295                 return -EOPNOTSUPP;
7296
7297         switch (wdev->iftype) {
7298         case NL80211_IFTYPE_STATION:
7299         case NL80211_IFTYPE_ADHOC:
7300         case NL80211_IFTYPE_P2P_CLIENT:
7301         case NL80211_IFTYPE_AP:
7302         case NL80211_IFTYPE_AP_VLAN:
7303         case NL80211_IFTYPE_P2P_GO:
7304         case NL80211_IFTYPE_P2P_DEVICE:
7305                 break;
7306         default:
7307                 return -EOPNOTSUPP;
7308         }
7309
7310         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7311
7312         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7313 }
7314
7315 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7316 {
7317         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7318         struct wireless_dev *wdev;
7319         struct net_device *dev = info->user_ptr[1];
7320         u8 ps_state;
7321         bool state;
7322         int err;
7323
7324         if (!info->attrs[NL80211_ATTR_PS_STATE])
7325                 return -EINVAL;
7326
7327         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7328
7329         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7330                 return -EINVAL;
7331
7332         wdev = dev->ieee80211_ptr;
7333
7334         if (!rdev->ops->set_power_mgmt)
7335                 return -EOPNOTSUPP;
7336
7337         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7338
7339         if (state == wdev->ps)
7340                 return 0;
7341
7342         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7343         if (!err)
7344                 wdev->ps = state;
7345         return err;
7346 }
7347
7348 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7349 {
7350         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7351         enum nl80211_ps_state ps_state;
7352         struct wireless_dev *wdev;
7353         struct net_device *dev = info->user_ptr[1];
7354         struct sk_buff *msg;
7355         void *hdr;
7356         int err;
7357
7358         wdev = dev->ieee80211_ptr;
7359
7360         if (!rdev->ops->set_power_mgmt)
7361                 return -EOPNOTSUPP;
7362
7363         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7364         if (!msg)
7365                 return -ENOMEM;
7366
7367         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7368                              NL80211_CMD_GET_POWER_SAVE);
7369         if (!hdr) {
7370                 err = -ENOBUFS;
7371                 goto free_msg;
7372         }
7373
7374         if (wdev->ps)
7375                 ps_state = NL80211_PS_ENABLED;
7376         else
7377                 ps_state = NL80211_PS_DISABLED;
7378
7379         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7380                 goto nla_put_failure;
7381
7382         genlmsg_end(msg, hdr);
7383         return genlmsg_reply(msg, info);
7384
7385  nla_put_failure:
7386         err = -ENOBUFS;
7387  free_msg:
7388         nlmsg_free(msg);
7389         return err;
7390 }
7391
7392 static struct nla_policy
7393 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7394         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7395         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7396         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7397         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7398         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7399         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7400 };
7401
7402 static int nl80211_set_cqm_txe(struct genl_info *info,
7403                                u32 rate, u32 pkts, u32 intvl)
7404 {
7405         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7406         struct wireless_dev *wdev;
7407         struct net_device *dev = info->user_ptr[1];
7408
7409         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7410                 return -EINVAL;
7411
7412         wdev = dev->ieee80211_ptr;
7413
7414         if (!rdev->ops->set_cqm_txe_config)
7415                 return -EOPNOTSUPP;
7416
7417         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7418             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7419                 return -EOPNOTSUPP;
7420
7421         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7422 }
7423
7424 static int nl80211_set_cqm_rssi(struct genl_info *info,
7425                                 s32 threshold, u32 hysteresis)
7426 {
7427         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7428         struct wireless_dev *wdev;
7429         struct net_device *dev = info->user_ptr[1];
7430
7431         if (threshold > 0)
7432                 return -EINVAL;
7433
7434         wdev = dev->ieee80211_ptr;
7435
7436         if (!rdev->ops->set_cqm_rssi_config)
7437                 return -EOPNOTSUPP;
7438
7439         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7440             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7441                 return -EOPNOTSUPP;
7442
7443         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7444 }
7445
7446 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7447 {
7448         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7449         struct nlattr *cqm;
7450         int err;
7451
7452         cqm = info->attrs[NL80211_ATTR_CQM];
7453         if (!cqm) {
7454                 err = -EINVAL;
7455                 goto out;
7456         }
7457
7458         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7459                                nl80211_attr_cqm_policy);
7460         if (err)
7461                 goto out;
7462
7463         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7464             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7465                 s32 threshold;
7466                 u32 hysteresis;
7467                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7468                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7469                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
7470         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7471                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7472                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7473                 u32 rate, pkts, intvl;
7474                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7475                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7476                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7477                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
7478         } else
7479                 err = -EINVAL;
7480
7481 out:
7482         return err;
7483 }
7484
7485 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7486 {
7487         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7488         struct net_device *dev = info->user_ptr[1];
7489         struct mesh_config cfg;
7490         struct mesh_setup setup;
7491         int err;
7492
7493         /* start with default */
7494         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7495         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7496
7497         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7498                 /* and parse parameters if given */
7499                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7500                 if (err)
7501                         return err;
7502         }
7503
7504         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7505             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7506                 return -EINVAL;
7507
7508         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7509         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7510
7511         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7512             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7513                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7514                         return -EINVAL;
7515
7516         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7517                 setup.beacon_interval =
7518                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7519                 if (setup.beacon_interval < 10 ||
7520                     setup.beacon_interval > 10000)
7521                         return -EINVAL;
7522         }
7523
7524         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7525                 setup.dtim_period =
7526                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7527                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7528                         return -EINVAL;
7529         }
7530
7531         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7532                 /* parse additional setup parameters if given */
7533                 err = nl80211_parse_mesh_setup(info, &setup);
7534                 if (err)
7535                         return err;
7536         }
7537
7538         if (setup.user_mpm)
7539                 cfg.auto_open_plinks = false;
7540
7541         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7542                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7543                 if (err)
7544                         return err;
7545         } else {
7546                 /* cfg80211_join_mesh() will sort it out */
7547                 setup.chandef.chan = NULL;
7548         }
7549
7550         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7551 }
7552
7553 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7554 {
7555         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7556         struct net_device *dev = info->user_ptr[1];
7557
7558         return cfg80211_leave_mesh(rdev, dev);
7559 }
7560
7561 #ifdef CONFIG_PM
7562 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7563                                         struct cfg80211_registered_device *rdev)
7564 {
7565         struct nlattr *nl_pats, *nl_pat;
7566         int i, pat_len;
7567
7568         if (!rdev->wowlan->n_patterns)
7569                 return 0;
7570
7571         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7572         if (!nl_pats)
7573                 return -ENOBUFS;
7574
7575         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
7576                 nl_pat = nla_nest_start(msg, i + 1);
7577                 if (!nl_pat)
7578                         return -ENOBUFS;
7579                 pat_len = rdev->wowlan->patterns[i].pattern_len;
7580                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
7581                             DIV_ROUND_UP(pat_len, 8),
7582                             rdev->wowlan->patterns[i].mask) ||
7583                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
7584                             pat_len, rdev->wowlan->patterns[i].pattern) ||
7585                     nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
7586                                 rdev->wowlan->patterns[i].pkt_offset))
7587                         return -ENOBUFS;
7588                 nla_nest_end(msg, nl_pat);
7589         }
7590         nla_nest_end(msg, nl_pats);
7591
7592         return 0;
7593 }
7594
7595 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7596                                    struct cfg80211_wowlan_tcp *tcp)
7597 {
7598         struct nlattr *nl_tcp;
7599
7600         if (!tcp)
7601                 return 0;
7602
7603         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7604         if (!nl_tcp)
7605                 return -ENOBUFS;
7606
7607         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7608             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7609             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7610             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7611             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7612             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7613                     tcp->payload_len, tcp->payload) ||
7614             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7615                         tcp->data_interval) ||
7616             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7617                     tcp->wake_len, tcp->wake_data) ||
7618             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7619                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7620                 return -ENOBUFS;
7621
7622         if (tcp->payload_seq.len &&
7623             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7624                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7625                 return -ENOBUFS;
7626
7627         if (tcp->payload_tok.len &&
7628             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7629                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7630                     &tcp->payload_tok))
7631                 return -ENOBUFS;
7632
7633         nla_nest_end(msg, nl_tcp);
7634
7635         return 0;
7636 }
7637
7638 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7639 {
7640         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7641         struct sk_buff *msg;
7642         void *hdr;
7643         u32 size = NLMSG_DEFAULT_SIZE;
7644
7645         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7646             !rdev->wiphy.wowlan.tcp)
7647                 return -EOPNOTSUPP;
7648
7649         if (rdev->wowlan && rdev->wowlan->tcp) {
7650                 /* adjust size to have room for all the data */
7651                 size += rdev->wowlan->tcp->tokens_size +
7652                         rdev->wowlan->tcp->payload_len +
7653                         rdev->wowlan->tcp->wake_len +
7654                         rdev->wowlan->tcp->wake_len / 8;
7655         }
7656
7657         msg = nlmsg_new(size, GFP_KERNEL);
7658         if (!msg)
7659                 return -ENOMEM;
7660
7661         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7662                              NL80211_CMD_GET_WOWLAN);
7663         if (!hdr)
7664                 goto nla_put_failure;
7665
7666         if (rdev->wowlan) {
7667                 struct nlattr *nl_wowlan;
7668
7669                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7670                 if (!nl_wowlan)
7671                         goto nla_put_failure;
7672
7673                 if ((rdev->wowlan->any &&
7674                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7675                     (rdev->wowlan->disconnect &&
7676                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7677                     (rdev->wowlan->magic_pkt &&
7678                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7679                     (rdev->wowlan->gtk_rekey_failure &&
7680                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7681                     (rdev->wowlan->eap_identity_req &&
7682                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7683                     (rdev->wowlan->four_way_handshake &&
7684                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7685                     (rdev->wowlan->rfkill_release &&
7686                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7687                         goto nla_put_failure;
7688
7689                 if (nl80211_send_wowlan_patterns(msg, rdev))
7690                         goto nla_put_failure;
7691
7692                 if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
7693                         goto nla_put_failure;
7694
7695                 nla_nest_end(msg, nl_wowlan);
7696         }
7697
7698         genlmsg_end(msg, hdr);
7699         return genlmsg_reply(msg, info);
7700
7701 nla_put_failure:
7702         nlmsg_free(msg);
7703         return -ENOBUFS;
7704 }
7705
7706 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7707                                     struct nlattr *attr,
7708                                     struct cfg80211_wowlan *trig)
7709 {
7710         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7711         struct cfg80211_wowlan_tcp *cfg;
7712         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7713         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7714         u32 size;
7715         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7716         int err, port;
7717
7718         if (!rdev->wiphy.wowlan.tcp)
7719                 return -EINVAL;
7720
7721         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7722                         nla_data(attr), nla_len(attr),
7723                         nl80211_wowlan_tcp_policy);
7724         if (err)
7725                 return err;
7726
7727         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7728             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7729             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7730             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7731             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7732             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7733             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7734             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7735                 return -EINVAL;
7736
7737         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7738         if (data_size > rdev->wiphy.wowlan.tcp->data_payload_max)
7739                 return -EINVAL;
7740
7741         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7742                         rdev->wiphy.wowlan.tcp->data_interval_max ||
7743             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
7744                 return -EINVAL;
7745
7746         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7747         if (wake_size > rdev->wiphy.wowlan.tcp->wake_payload_max)
7748                 return -EINVAL;
7749
7750         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7751         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7752                 return -EINVAL;
7753
7754         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7755                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7756
7757                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7758                 tokens_size = tokln - sizeof(*tok);
7759
7760                 if (!tok->len || tokens_size % tok->len)
7761                         return -EINVAL;
7762                 if (!rdev->wiphy.wowlan.tcp->tok)
7763                         return -EINVAL;
7764                 if (tok->len > rdev->wiphy.wowlan.tcp->tok->max_len)
7765                         return -EINVAL;
7766                 if (tok->len < rdev->wiphy.wowlan.tcp->tok->min_len)
7767                         return -EINVAL;
7768                 if (tokens_size > rdev->wiphy.wowlan.tcp->tok->bufsize)
7769                         return -EINVAL;
7770                 if (tok->offset + tok->len > data_size)
7771                         return -EINVAL;
7772         }
7773
7774         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7775                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7776                 if (!rdev->wiphy.wowlan.tcp->seq)
7777                         return -EINVAL;
7778                 if (seq->len == 0 || seq->len > 4)
7779                         return -EINVAL;
7780                 if (seq->len + seq->offset > data_size)
7781                         return -EINVAL;
7782         }
7783
7784         size = sizeof(*cfg);
7785         size += data_size;
7786         size += wake_size + wake_mask_size;
7787         size += tokens_size;
7788
7789         cfg = kzalloc(size, GFP_KERNEL);
7790         if (!cfg)
7791                 return -ENOMEM;
7792         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7793         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7794         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7795                ETH_ALEN);
7796         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7797                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7798         else
7799                 port = 0;
7800 #ifdef CONFIG_INET
7801         /* allocate a socket and port for it and use it */
7802         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7803                             IPPROTO_TCP, &cfg->sock, 1);
7804         if (err) {
7805                 kfree(cfg);
7806                 return err;
7807         }
7808         if (inet_csk_get_port(cfg->sock->sk, port)) {
7809                 sock_release(cfg->sock);
7810                 kfree(cfg);
7811                 return -EADDRINUSE;
7812         }
7813         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7814 #else
7815         if (!port) {
7816                 kfree(cfg);
7817                 return -EINVAL;
7818         }
7819         cfg->src_port = port;
7820 #endif
7821
7822         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7823         cfg->payload_len = data_size;
7824         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7825         memcpy((void *)cfg->payload,
7826                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7827                data_size);
7828         if (seq)
7829                 cfg->payload_seq = *seq;
7830         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7831         cfg->wake_len = wake_size;
7832         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7833         memcpy((void *)cfg->wake_data,
7834                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7835                wake_size);
7836         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7837                          data_size + wake_size;
7838         memcpy((void *)cfg->wake_mask,
7839                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7840                wake_mask_size);
7841         if (tok) {
7842                 cfg->tokens_size = tokens_size;
7843                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7844         }
7845
7846         trig->tcp = cfg;
7847
7848         return 0;
7849 }
7850
7851 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7852 {
7853         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7854         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7855         struct cfg80211_wowlan new_triggers = {};
7856         struct cfg80211_wowlan *ntrig;
7857         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
7858         int err, i;
7859         bool prev_enabled = rdev->wowlan;
7860
7861         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7862             !rdev->wiphy.wowlan.tcp)
7863                 return -EOPNOTSUPP;
7864
7865         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7866                 cfg80211_rdev_free_wowlan(rdev);
7867                 rdev->wowlan = NULL;
7868                 goto set_wakeup;
7869         }
7870
7871         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7872                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7873                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7874                         nl80211_wowlan_policy);
7875         if (err)
7876                 return err;
7877
7878         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7879                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7880                         return -EINVAL;
7881                 new_triggers.any = true;
7882         }
7883
7884         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7885                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7886                         return -EINVAL;
7887                 new_triggers.disconnect = true;
7888         }
7889
7890         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7891                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7892                         return -EINVAL;
7893                 new_triggers.magic_pkt = true;
7894         }
7895
7896         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7897                 return -EINVAL;
7898
7899         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7900                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7901                         return -EINVAL;
7902                 new_triggers.gtk_rekey_failure = true;
7903         }
7904
7905         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7906                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7907                         return -EINVAL;
7908                 new_triggers.eap_identity_req = true;
7909         }
7910
7911         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7912                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7913                         return -EINVAL;
7914                 new_triggers.four_way_handshake = true;
7915         }
7916
7917         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7918                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7919                         return -EINVAL;
7920                 new_triggers.rfkill_release = true;
7921         }
7922
7923         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7924                 struct nlattr *pat;
7925                 int n_patterns = 0;
7926                 int rem, pat_len, mask_len, pkt_offset;
7927                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
7928
7929                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7930                                     rem)
7931                         n_patterns++;
7932                 if (n_patterns > wowlan->n_patterns)
7933                         return -EINVAL;
7934
7935                 new_triggers.patterns = kcalloc(n_patterns,
7936                                                 sizeof(new_triggers.patterns[0]),
7937                                                 GFP_KERNEL);
7938                 if (!new_triggers.patterns)
7939                         return -ENOMEM;
7940
7941                 new_triggers.n_patterns = n_patterns;
7942                 i = 0;
7943
7944                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7945                                     rem) {
7946                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
7947                                   nla_data(pat), nla_len(pat), NULL);
7948                         err = -EINVAL;
7949                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
7950                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
7951                                 goto error;
7952                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
7953                         mask_len = DIV_ROUND_UP(pat_len, 8);
7954                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
7955                             mask_len)
7956                                 goto error;
7957                         if (pat_len > wowlan->pattern_max_len ||
7958                             pat_len < wowlan->pattern_min_len)
7959                                 goto error;
7960
7961                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
7962                                 pkt_offset = 0;
7963                         else
7964                                 pkt_offset = nla_get_u32(
7965                                         pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
7966                         if (pkt_offset > wowlan->max_pkt_offset)
7967                                 goto error;
7968                         new_triggers.patterns[i].pkt_offset = pkt_offset;
7969
7970                         new_triggers.patterns[i].mask =
7971                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
7972                         if (!new_triggers.patterns[i].mask) {
7973                                 err = -ENOMEM;
7974                                 goto error;
7975                         }
7976                         new_triggers.patterns[i].pattern =
7977                                 new_triggers.patterns[i].mask + mask_len;
7978                         memcpy(new_triggers.patterns[i].mask,
7979                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
7980                                mask_len);
7981                         new_triggers.patterns[i].pattern_len = pat_len;
7982                         memcpy(new_triggers.patterns[i].pattern,
7983                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
7984                                pat_len);
7985                         i++;
7986                 }
7987         }
7988
7989         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
7990                 err = nl80211_parse_wowlan_tcp(
7991                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
7992                         &new_triggers);
7993                 if (err)
7994                         goto error;
7995         }
7996
7997         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
7998         if (!ntrig) {
7999                 err = -ENOMEM;
8000                 goto error;
8001         }
8002         cfg80211_rdev_free_wowlan(rdev);
8003         rdev->wowlan = ntrig;
8004
8005  set_wakeup:
8006         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
8007                 rdev_set_wakeup(rdev, rdev->wowlan);
8008
8009         return 0;
8010  error:
8011         for (i = 0; i < new_triggers.n_patterns; i++)
8012                 kfree(new_triggers.patterns[i].mask);
8013         kfree(new_triggers.patterns);
8014         if (new_triggers.tcp && new_triggers.tcp->sock)
8015                 sock_release(new_triggers.tcp->sock);
8016         kfree(new_triggers.tcp);
8017         return err;
8018 }
8019 #endif
8020
8021 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8022 {
8023         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8024         struct net_device *dev = info->user_ptr[1];
8025         struct wireless_dev *wdev = dev->ieee80211_ptr;
8026         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8027         struct cfg80211_gtk_rekey_data rekey_data;
8028         int err;
8029
8030         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8031                 return -EINVAL;
8032
8033         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8034                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8035                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8036                         nl80211_rekey_policy);
8037         if (err)
8038                 return err;
8039
8040         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8041                 return -ERANGE;
8042         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8043                 return -ERANGE;
8044         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8045                 return -ERANGE;
8046
8047         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8048                NL80211_KEK_LEN);
8049         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8050                NL80211_KCK_LEN);
8051         memcpy(rekey_data.replay_ctr,
8052                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8053                NL80211_REPLAY_CTR_LEN);
8054
8055         wdev_lock(wdev);
8056         if (!wdev->current_bss) {
8057                 err = -ENOTCONN;
8058                 goto out;
8059         }
8060
8061         if (!rdev->ops->set_rekey_data) {
8062                 err = -EOPNOTSUPP;
8063                 goto out;
8064         }
8065
8066         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8067  out:
8068         wdev_unlock(wdev);
8069         return err;
8070 }
8071
8072 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8073                                              struct genl_info *info)
8074 {
8075         struct net_device *dev = info->user_ptr[1];
8076         struct wireless_dev *wdev = dev->ieee80211_ptr;
8077
8078         if (wdev->iftype != NL80211_IFTYPE_AP &&
8079             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8080                 return -EINVAL;
8081
8082         if (wdev->ap_unexpected_nlportid)
8083                 return -EBUSY;
8084
8085         wdev->ap_unexpected_nlportid = info->snd_portid;
8086         return 0;
8087 }
8088
8089 static int nl80211_probe_client(struct sk_buff *skb,
8090                                 struct genl_info *info)
8091 {
8092         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8093         struct net_device *dev = info->user_ptr[1];
8094         struct wireless_dev *wdev = dev->ieee80211_ptr;
8095         struct sk_buff *msg;
8096         void *hdr;
8097         const u8 *addr;
8098         u64 cookie;
8099         int err;
8100
8101         if (wdev->iftype != NL80211_IFTYPE_AP &&
8102             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8103                 return -EOPNOTSUPP;
8104
8105         if (!info->attrs[NL80211_ATTR_MAC])
8106                 return -EINVAL;
8107
8108         if (!rdev->ops->probe_client)
8109                 return -EOPNOTSUPP;
8110
8111         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8112         if (!msg)
8113                 return -ENOMEM;
8114
8115         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8116                              NL80211_CMD_PROBE_CLIENT);
8117
8118         if (IS_ERR(hdr)) {
8119                 err = PTR_ERR(hdr);
8120                 goto free_msg;
8121         }
8122
8123         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8124
8125         err = rdev_probe_client(rdev, dev, addr, &cookie);
8126         if (err)
8127                 goto free_msg;
8128
8129         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8130                 goto nla_put_failure;
8131
8132         genlmsg_end(msg, hdr);
8133
8134         return genlmsg_reply(msg, info);
8135
8136  nla_put_failure:
8137         err = -ENOBUFS;
8138  free_msg:
8139         nlmsg_free(msg);
8140         return err;
8141 }
8142
8143 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8144 {
8145         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8146         struct cfg80211_beacon_registration *reg, *nreg;
8147         int rv;
8148
8149         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8150                 return -EOPNOTSUPP;
8151
8152         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8153         if (!nreg)
8154                 return -ENOMEM;
8155
8156         /* First, check if already registered. */
8157         spin_lock_bh(&rdev->beacon_registrations_lock);
8158         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8159                 if (reg->nlportid == info->snd_portid) {
8160                         rv = -EALREADY;
8161                         goto out_err;
8162                 }
8163         }
8164         /* Add it to the list */
8165         nreg->nlportid = info->snd_portid;
8166         list_add(&nreg->list, &rdev->beacon_registrations);
8167
8168         spin_unlock_bh(&rdev->beacon_registrations_lock);
8169
8170         return 0;
8171 out_err:
8172         spin_unlock_bh(&rdev->beacon_registrations_lock);
8173         kfree(nreg);
8174         return rv;
8175 }
8176
8177 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8178 {
8179         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8180         struct wireless_dev *wdev = info->user_ptr[1];
8181         int err;
8182
8183         if (!rdev->ops->start_p2p_device)
8184                 return -EOPNOTSUPP;
8185
8186         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8187                 return -EOPNOTSUPP;
8188
8189         if (wdev->p2p_started)
8190                 return 0;
8191
8192         mutex_lock(&rdev->devlist_mtx);
8193         err = cfg80211_can_add_interface(rdev, wdev->iftype);
8194         mutex_unlock(&rdev->devlist_mtx);
8195         if (err)
8196                 return err;
8197
8198         err = rdev_start_p2p_device(rdev, wdev);
8199         if (err)
8200                 return err;
8201
8202         wdev->p2p_started = true;
8203         mutex_lock(&rdev->devlist_mtx);
8204         rdev->opencount++;
8205         mutex_unlock(&rdev->devlist_mtx);
8206
8207         return 0;
8208 }
8209
8210 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8211 {
8212         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8213         struct wireless_dev *wdev = info->user_ptr[1];
8214
8215         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8216                 return -EOPNOTSUPP;
8217
8218         if (!rdev->ops->stop_p2p_device)
8219                 return -EOPNOTSUPP;
8220
8221         mutex_lock(&rdev->devlist_mtx);
8222         mutex_lock(&rdev->sched_scan_mtx);
8223         cfg80211_stop_p2p_device(rdev, wdev);
8224         mutex_unlock(&rdev->sched_scan_mtx);
8225         mutex_unlock(&rdev->devlist_mtx);
8226
8227         return 0;
8228 }
8229
8230 static int nl80211_get_protocol_features(struct sk_buff *skb,
8231                                          struct genl_info *info)
8232 {
8233         void *hdr;
8234         struct sk_buff *msg;
8235
8236         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8237         if (!msg)
8238                 return -ENOMEM;
8239
8240         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8241                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8242         if (!hdr)
8243                 goto nla_put_failure;
8244
8245         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8246                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8247                 goto nla_put_failure;
8248
8249         genlmsg_end(msg, hdr);
8250         return genlmsg_reply(msg, info);
8251
8252  nla_put_failure:
8253         kfree_skb(msg);
8254         return -ENOBUFS;
8255 }
8256
8257 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
8258 {
8259         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8260         struct cfg80211_update_ft_ies_params ft_params;
8261         struct net_device *dev = info->user_ptr[1];
8262
8263         if (!rdev->ops->update_ft_ies)
8264                 return -EOPNOTSUPP;
8265
8266         if (!info->attrs[NL80211_ATTR_MDID] ||
8267             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8268                 return -EINVAL;
8269
8270         memset(&ft_params, 0, sizeof(ft_params));
8271         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
8272         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8273         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8274
8275         return rdev_update_ft_ies(rdev, dev, &ft_params);
8276 }
8277
8278 static int nl80211_crit_protocol_start(struct sk_buff *skb,
8279                                        struct genl_info *info)
8280 {
8281         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8282         struct wireless_dev *wdev = info->user_ptr[1];
8283         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
8284         u16 duration;
8285         int ret;
8286
8287         if (!rdev->ops->crit_proto_start)
8288                 return -EOPNOTSUPP;
8289
8290         if (WARN_ON(!rdev->ops->crit_proto_stop))
8291                 return -EINVAL;
8292
8293         if (rdev->crit_proto_nlportid)
8294                 return -EBUSY;
8295
8296         /* determine protocol if provided */
8297         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
8298                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
8299
8300         if (proto >= NUM_NL80211_CRIT_PROTO)
8301                 return -EINVAL;
8302
8303         /* timeout must be provided */
8304         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
8305                 return -EINVAL;
8306
8307         duration =
8308                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
8309
8310         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
8311                 return -ERANGE;
8312
8313         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
8314         if (!ret)
8315                 rdev->crit_proto_nlportid = info->snd_portid;
8316
8317         return ret;
8318 }
8319
8320 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
8321                                       struct genl_info *info)
8322 {
8323         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8324         struct wireless_dev *wdev = info->user_ptr[1];
8325
8326         if (!rdev->ops->crit_proto_stop)
8327                 return -EOPNOTSUPP;
8328
8329         if (rdev->crit_proto_nlportid) {
8330                 rdev->crit_proto_nlportid = 0;
8331                 rdev_crit_proto_stop(rdev, wdev);
8332         }
8333         return 0;
8334 }
8335
8336 #define NL80211_FLAG_NEED_WIPHY         0x01
8337 #define NL80211_FLAG_NEED_NETDEV        0x02
8338 #define NL80211_FLAG_NEED_RTNL          0x04
8339 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
8340 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
8341                                          NL80211_FLAG_CHECK_NETDEV_UP)
8342 #define NL80211_FLAG_NEED_WDEV          0x10
8343 /* If a netdev is associated, it must be UP, P2P must be started */
8344 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
8345                                          NL80211_FLAG_CHECK_NETDEV_UP)
8346
8347 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
8348                             struct genl_info *info)
8349 {
8350         struct cfg80211_registered_device *rdev;
8351         struct wireless_dev *wdev;
8352         struct net_device *dev;
8353         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
8354
8355         if (rtnl)
8356                 rtnl_lock();
8357
8358         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
8359                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8360                 if (IS_ERR(rdev)) {
8361                         if (rtnl)
8362                                 rtnl_unlock();
8363                         return PTR_ERR(rdev);
8364                 }
8365                 info->user_ptr[0] = rdev;
8366         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
8367                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8368                 mutex_lock(&cfg80211_mutex);
8369                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
8370                                                   info->attrs);
8371                 if (IS_ERR(wdev)) {
8372                         mutex_unlock(&cfg80211_mutex);
8373                         if (rtnl)
8374                                 rtnl_unlock();
8375                         return PTR_ERR(wdev);
8376                 }
8377
8378                 dev = wdev->netdev;
8379                 rdev = wiphy_to_dev(wdev->wiphy);
8380
8381                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
8382                         if (!dev) {
8383                                 mutex_unlock(&cfg80211_mutex);
8384                                 if (rtnl)
8385                                         rtnl_unlock();
8386                                 return -EINVAL;
8387                         }
8388
8389                         info->user_ptr[1] = dev;
8390                 } else {
8391                         info->user_ptr[1] = wdev;
8392                 }
8393
8394                 if (dev) {
8395                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
8396                             !netif_running(dev)) {
8397                                 mutex_unlock(&cfg80211_mutex);
8398                                 if (rtnl)
8399                                         rtnl_unlock();
8400                                 return -ENETDOWN;
8401                         }
8402
8403                         dev_hold(dev);
8404                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
8405                         if (!wdev->p2p_started) {
8406                                 mutex_unlock(&cfg80211_mutex);
8407                                 if (rtnl)
8408                                         rtnl_unlock();
8409                                 return -ENETDOWN;
8410                         }
8411                 }
8412
8413                 cfg80211_lock_rdev(rdev);
8414
8415                 mutex_unlock(&cfg80211_mutex);
8416
8417                 info->user_ptr[0] = rdev;
8418         }
8419
8420         return 0;
8421 }
8422
8423 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
8424                               struct genl_info *info)
8425 {
8426         if (info->user_ptr[0])
8427                 cfg80211_unlock_rdev(info->user_ptr[0]);
8428         if (info->user_ptr[1]) {
8429                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
8430                         struct wireless_dev *wdev = info->user_ptr[1];
8431
8432                         if (wdev->netdev)
8433                                 dev_put(wdev->netdev);
8434                 } else {
8435                         dev_put(info->user_ptr[1]);
8436                 }
8437         }
8438         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
8439                 rtnl_unlock();
8440 }
8441
8442 static struct genl_ops nl80211_ops[] = {
8443         {
8444                 .cmd = NL80211_CMD_GET_WIPHY,
8445                 .doit = nl80211_get_wiphy,
8446                 .dumpit = nl80211_dump_wiphy,
8447                 .policy = nl80211_policy,
8448                 /* can be retrieved by unprivileged users */
8449                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
8450         },
8451         {
8452                 .cmd = NL80211_CMD_SET_WIPHY,
8453                 .doit = nl80211_set_wiphy,
8454                 .policy = nl80211_policy,
8455                 .flags = GENL_ADMIN_PERM,
8456                 .internal_flags = NL80211_FLAG_NEED_RTNL,
8457         },
8458         {
8459                 .cmd = NL80211_CMD_GET_INTERFACE,
8460                 .doit = nl80211_get_interface,
8461                 .dumpit = nl80211_dump_interface,
8462                 .policy = nl80211_policy,
8463                 /* can be retrieved by unprivileged users */
8464                 .internal_flags = NL80211_FLAG_NEED_WDEV,
8465         },
8466         {
8467                 .cmd = NL80211_CMD_SET_INTERFACE,
8468                 .doit = nl80211_set_interface,
8469                 .policy = nl80211_policy,
8470                 .flags = GENL_ADMIN_PERM,
8471                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8472                                   NL80211_FLAG_NEED_RTNL,
8473         },
8474         {
8475                 .cmd = NL80211_CMD_NEW_INTERFACE,
8476                 .doit = nl80211_new_interface,
8477                 .policy = nl80211_policy,
8478                 .flags = GENL_ADMIN_PERM,
8479                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8480                                   NL80211_FLAG_NEED_RTNL,
8481         },
8482         {
8483                 .cmd = NL80211_CMD_DEL_INTERFACE,
8484                 .doit = nl80211_del_interface,
8485                 .policy = nl80211_policy,
8486                 .flags = GENL_ADMIN_PERM,
8487                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8488                                   NL80211_FLAG_NEED_RTNL,
8489         },
8490         {
8491                 .cmd = NL80211_CMD_GET_KEY,
8492                 .doit = nl80211_get_key,
8493                 .policy = nl80211_policy,
8494                 .flags = GENL_ADMIN_PERM,
8495                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8496                                   NL80211_FLAG_NEED_RTNL,
8497         },
8498         {
8499                 .cmd = NL80211_CMD_SET_KEY,
8500                 .doit = nl80211_set_key,
8501                 .policy = nl80211_policy,
8502                 .flags = GENL_ADMIN_PERM,
8503                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8504                                   NL80211_FLAG_NEED_RTNL,
8505         },
8506         {
8507                 .cmd = NL80211_CMD_NEW_KEY,
8508                 .doit = nl80211_new_key,
8509                 .policy = nl80211_policy,
8510                 .flags = GENL_ADMIN_PERM,
8511                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8512                                   NL80211_FLAG_NEED_RTNL,
8513         },
8514         {
8515                 .cmd = NL80211_CMD_DEL_KEY,
8516                 .doit = nl80211_del_key,
8517                 .policy = nl80211_policy,
8518                 .flags = GENL_ADMIN_PERM,
8519                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8520                                   NL80211_FLAG_NEED_RTNL,
8521         },
8522         {
8523                 .cmd = NL80211_CMD_SET_BEACON,
8524                 .policy = nl80211_policy,
8525                 .flags = GENL_ADMIN_PERM,
8526                 .doit = nl80211_set_beacon,
8527                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8528                                   NL80211_FLAG_NEED_RTNL,
8529         },
8530         {
8531                 .cmd = NL80211_CMD_START_AP,
8532                 .policy = nl80211_policy,
8533                 .flags = GENL_ADMIN_PERM,
8534                 .doit = nl80211_start_ap,
8535                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8536                                   NL80211_FLAG_NEED_RTNL,
8537         },
8538         {
8539                 .cmd = NL80211_CMD_STOP_AP,
8540                 .policy = nl80211_policy,
8541                 .flags = GENL_ADMIN_PERM,
8542                 .doit = nl80211_stop_ap,
8543                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8544                                   NL80211_FLAG_NEED_RTNL,
8545         },
8546         {
8547                 .cmd = NL80211_CMD_GET_STATION,
8548                 .doit = nl80211_get_station,
8549                 .dumpit = nl80211_dump_station,
8550                 .policy = nl80211_policy,
8551                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8552                                   NL80211_FLAG_NEED_RTNL,
8553         },
8554         {
8555                 .cmd = NL80211_CMD_SET_STATION,
8556                 .doit = nl80211_set_station,
8557                 .policy = nl80211_policy,
8558                 .flags = GENL_ADMIN_PERM,
8559                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8560                                   NL80211_FLAG_NEED_RTNL,
8561         },
8562         {
8563                 .cmd = NL80211_CMD_NEW_STATION,
8564                 .doit = nl80211_new_station,
8565                 .policy = nl80211_policy,
8566                 .flags = GENL_ADMIN_PERM,
8567                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8568                                   NL80211_FLAG_NEED_RTNL,
8569         },
8570         {
8571                 .cmd = NL80211_CMD_DEL_STATION,
8572                 .doit = nl80211_del_station,
8573                 .policy = nl80211_policy,
8574                 .flags = GENL_ADMIN_PERM,
8575                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8576                                   NL80211_FLAG_NEED_RTNL,
8577         },
8578         {
8579                 .cmd = NL80211_CMD_GET_MPATH,
8580                 .doit = nl80211_get_mpath,
8581                 .dumpit = nl80211_dump_mpath,
8582                 .policy = nl80211_policy,
8583                 .flags = GENL_ADMIN_PERM,
8584                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8585                                   NL80211_FLAG_NEED_RTNL,
8586         },
8587         {
8588                 .cmd = NL80211_CMD_SET_MPATH,
8589                 .doit = nl80211_set_mpath,
8590                 .policy = nl80211_policy,
8591                 .flags = GENL_ADMIN_PERM,
8592                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8593                                   NL80211_FLAG_NEED_RTNL,
8594         },
8595         {
8596                 .cmd = NL80211_CMD_NEW_MPATH,
8597                 .doit = nl80211_new_mpath,
8598                 .policy = nl80211_policy,
8599                 .flags = GENL_ADMIN_PERM,
8600                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8601                                   NL80211_FLAG_NEED_RTNL,
8602         },
8603         {
8604                 .cmd = NL80211_CMD_DEL_MPATH,
8605                 .doit = nl80211_del_mpath,
8606                 .policy = nl80211_policy,
8607                 .flags = GENL_ADMIN_PERM,
8608                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8609                                   NL80211_FLAG_NEED_RTNL,
8610         },
8611         {
8612                 .cmd = NL80211_CMD_SET_BSS,
8613                 .doit = nl80211_set_bss,
8614                 .policy = nl80211_policy,
8615                 .flags = GENL_ADMIN_PERM,
8616                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8617                                   NL80211_FLAG_NEED_RTNL,
8618         },
8619         {
8620                 .cmd = NL80211_CMD_GET_REG,
8621                 .doit = nl80211_get_reg,
8622                 .policy = nl80211_policy,
8623                 /* can be retrieved by unprivileged users */
8624         },
8625         {
8626                 .cmd = NL80211_CMD_SET_REG,
8627                 .doit = nl80211_set_reg,
8628                 .policy = nl80211_policy,
8629                 .flags = GENL_ADMIN_PERM,
8630         },
8631         {
8632                 .cmd = NL80211_CMD_REQ_SET_REG,
8633                 .doit = nl80211_req_set_reg,
8634                 .policy = nl80211_policy,
8635                 .flags = GENL_ADMIN_PERM,
8636         },
8637         {
8638                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
8639                 .doit = nl80211_get_mesh_config,
8640                 .policy = nl80211_policy,
8641                 /* can be retrieved by unprivileged users */
8642                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8643                                   NL80211_FLAG_NEED_RTNL,
8644         },
8645         {
8646                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
8647                 .doit = nl80211_update_mesh_config,
8648                 .policy = nl80211_policy,
8649                 .flags = GENL_ADMIN_PERM,
8650                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8651                                   NL80211_FLAG_NEED_RTNL,
8652         },
8653         {
8654                 .cmd = NL80211_CMD_TRIGGER_SCAN,
8655                 .doit = nl80211_trigger_scan,
8656                 .policy = nl80211_policy,
8657                 .flags = GENL_ADMIN_PERM,
8658                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8659                                   NL80211_FLAG_NEED_RTNL,
8660         },
8661         {
8662                 .cmd = NL80211_CMD_GET_SCAN,
8663                 .policy = nl80211_policy,
8664                 .dumpit = nl80211_dump_scan,
8665         },
8666         {
8667                 .cmd = NL80211_CMD_START_SCHED_SCAN,
8668                 .doit = nl80211_start_sched_scan,
8669                 .policy = nl80211_policy,
8670                 .flags = GENL_ADMIN_PERM,
8671                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8672                                   NL80211_FLAG_NEED_RTNL,
8673         },
8674         {
8675                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
8676                 .doit = nl80211_stop_sched_scan,
8677                 .policy = nl80211_policy,
8678                 .flags = GENL_ADMIN_PERM,
8679                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8680                                   NL80211_FLAG_NEED_RTNL,
8681         },
8682         {
8683                 .cmd = NL80211_CMD_AUTHENTICATE,
8684                 .doit = nl80211_authenticate,
8685                 .policy = nl80211_policy,
8686                 .flags = GENL_ADMIN_PERM,
8687                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8688                                   NL80211_FLAG_NEED_RTNL,
8689         },
8690         {
8691                 .cmd = NL80211_CMD_ASSOCIATE,
8692                 .doit = nl80211_associate,
8693                 .policy = nl80211_policy,
8694                 .flags = GENL_ADMIN_PERM,
8695                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8696                                   NL80211_FLAG_NEED_RTNL,
8697         },
8698         {
8699                 .cmd = NL80211_CMD_DEAUTHENTICATE,
8700                 .doit = nl80211_deauthenticate,
8701                 .policy = nl80211_policy,
8702                 .flags = GENL_ADMIN_PERM,
8703                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8704                                   NL80211_FLAG_NEED_RTNL,
8705         },
8706         {
8707                 .cmd = NL80211_CMD_DISASSOCIATE,
8708                 .doit = nl80211_disassociate,
8709                 .policy = nl80211_policy,
8710                 .flags = GENL_ADMIN_PERM,
8711                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8712                                   NL80211_FLAG_NEED_RTNL,
8713         },
8714         {
8715                 .cmd = NL80211_CMD_JOIN_IBSS,
8716                 .doit = nl80211_join_ibss,
8717                 .policy = nl80211_policy,
8718                 .flags = GENL_ADMIN_PERM,
8719                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8720                                   NL80211_FLAG_NEED_RTNL,
8721         },
8722         {
8723                 .cmd = NL80211_CMD_LEAVE_IBSS,
8724                 .doit = nl80211_leave_ibss,
8725                 .policy = nl80211_policy,
8726                 .flags = GENL_ADMIN_PERM,
8727                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8728                                   NL80211_FLAG_NEED_RTNL,
8729         },
8730 #ifdef CONFIG_NL80211_TESTMODE
8731         {
8732                 .cmd = NL80211_CMD_TESTMODE,
8733                 .doit = nl80211_testmode_do,
8734                 .dumpit = nl80211_testmode_dump,
8735                 .policy = nl80211_policy,
8736                 .flags = GENL_ADMIN_PERM,
8737                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8738                                   NL80211_FLAG_NEED_RTNL,
8739         },
8740 #endif
8741         {
8742                 .cmd = NL80211_CMD_CONNECT,
8743                 .doit = nl80211_connect,
8744                 .policy = nl80211_policy,
8745                 .flags = GENL_ADMIN_PERM,
8746                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8747                                   NL80211_FLAG_NEED_RTNL,
8748         },
8749         {
8750                 .cmd = NL80211_CMD_DISCONNECT,
8751                 .doit = nl80211_disconnect,
8752                 .policy = nl80211_policy,
8753                 .flags = GENL_ADMIN_PERM,
8754                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8755                                   NL80211_FLAG_NEED_RTNL,
8756         },
8757         {
8758                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
8759                 .doit = nl80211_wiphy_netns,
8760                 .policy = nl80211_policy,
8761                 .flags = GENL_ADMIN_PERM,
8762                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8763                                   NL80211_FLAG_NEED_RTNL,
8764         },
8765         {
8766                 .cmd = NL80211_CMD_GET_SURVEY,
8767                 .policy = nl80211_policy,
8768                 .dumpit = nl80211_dump_survey,
8769         },
8770         {
8771                 .cmd = NL80211_CMD_SET_PMKSA,
8772                 .doit = nl80211_setdel_pmksa,
8773                 .policy = nl80211_policy,
8774                 .flags = GENL_ADMIN_PERM,
8775                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8776                                   NL80211_FLAG_NEED_RTNL,
8777         },
8778         {
8779                 .cmd = NL80211_CMD_DEL_PMKSA,
8780                 .doit = nl80211_setdel_pmksa,
8781                 .policy = nl80211_policy,
8782                 .flags = GENL_ADMIN_PERM,
8783                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8784                                   NL80211_FLAG_NEED_RTNL,
8785         },
8786         {
8787                 .cmd = NL80211_CMD_FLUSH_PMKSA,
8788                 .doit = nl80211_flush_pmksa,
8789                 .policy = nl80211_policy,
8790                 .flags = GENL_ADMIN_PERM,
8791                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8792                                   NL80211_FLAG_NEED_RTNL,
8793         },
8794         {
8795                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
8796                 .doit = nl80211_remain_on_channel,
8797                 .policy = nl80211_policy,
8798                 .flags = GENL_ADMIN_PERM,
8799                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8800                                   NL80211_FLAG_NEED_RTNL,
8801         },
8802         {
8803                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8804                 .doit = nl80211_cancel_remain_on_channel,
8805                 .policy = nl80211_policy,
8806                 .flags = GENL_ADMIN_PERM,
8807                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8808                                   NL80211_FLAG_NEED_RTNL,
8809         },
8810         {
8811                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
8812                 .doit = nl80211_set_tx_bitrate_mask,
8813                 .policy = nl80211_policy,
8814                 .flags = GENL_ADMIN_PERM,
8815                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8816                                   NL80211_FLAG_NEED_RTNL,
8817         },
8818         {
8819                 .cmd = NL80211_CMD_REGISTER_FRAME,
8820                 .doit = nl80211_register_mgmt,
8821                 .policy = nl80211_policy,
8822                 .flags = GENL_ADMIN_PERM,
8823                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8824                                   NL80211_FLAG_NEED_RTNL,
8825         },
8826         {
8827                 .cmd = NL80211_CMD_FRAME,
8828                 .doit = nl80211_tx_mgmt,
8829                 .policy = nl80211_policy,
8830                 .flags = GENL_ADMIN_PERM,
8831                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8832                                   NL80211_FLAG_NEED_RTNL,
8833         },
8834         {
8835                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
8836                 .doit = nl80211_tx_mgmt_cancel_wait,
8837                 .policy = nl80211_policy,
8838                 .flags = GENL_ADMIN_PERM,
8839                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8840                                   NL80211_FLAG_NEED_RTNL,
8841         },
8842         {
8843                 .cmd = NL80211_CMD_SET_POWER_SAVE,
8844                 .doit = nl80211_set_power_save,
8845                 .policy = nl80211_policy,
8846                 .flags = GENL_ADMIN_PERM,
8847                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8848                                   NL80211_FLAG_NEED_RTNL,
8849         },
8850         {
8851                 .cmd = NL80211_CMD_GET_POWER_SAVE,
8852                 .doit = nl80211_get_power_save,
8853                 .policy = nl80211_policy,
8854                 /* can be retrieved by unprivileged users */
8855                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8856                                   NL80211_FLAG_NEED_RTNL,
8857         },
8858         {
8859                 .cmd = NL80211_CMD_SET_CQM,
8860                 .doit = nl80211_set_cqm,
8861                 .policy = nl80211_policy,
8862                 .flags = GENL_ADMIN_PERM,
8863                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8864                                   NL80211_FLAG_NEED_RTNL,
8865         },
8866         {
8867                 .cmd = NL80211_CMD_SET_CHANNEL,
8868                 .doit = nl80211_set_channel,
8869                 .policy = nl80211_policy,
8870                 .flags = GENL_ADMIN_PERM,
8871                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8872                                   NL80211_FLAG_NEED_RTNL,
8873         },
8874         {
8875                 .cmd = NL80211_CMD_SET_WDS_PEER,
8876                 .doit = nl80211_set_wds_peer,
8877                 .policy = nl80211_policy,
8878                 .flags = GENL_ADMIN_PERM,
8879                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8880                                   NL80211_FLAG_NEED_RTNL,
8881         },
8882         {
8883                 .cmd = NL80211_CMD_JOIN_MESH,
8884                 .doit = nl80211_join_mesh,
8885                 .policy = nl80211_policy,
8886                 .flags = GENL_ADMIN_PERM,
8887                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8888                                   NL80211_FLAG_NEED_RTNL,
8889         },
8890         {
8891                 .cmd = NL80211_CMD_LEAVE_MESH,
8892                 .doit = nl80211_leave_mesh,
8893                 .policy = nl80211_policy,
8894                 .flags = GENL_ADMIN_PERM,
8895                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8896                                   NL80211_FLAG_NEED_RTNL,
8897         },
8898 #ifdef CONFIG_PM
8899         {
8900                 .cmd = NL80211_CMD_GET_WOWLAN,
8901                 .doit = nl80211_get_wowlan,
8902                 .policy = nl80211_policy,
8903                 /* can be retrieved by unprivileged users */
8904                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8905                                   NL80211_FLAG_NEED_RTNL,
8906         },
8907         {
8908                 .cmd = NL80211_CMD_SET_WOWLAN,
8909                 .doit = nl80211_set_wowlan,
8910                 .policy = nl80211_policy,
8911                 .flags = GENL_ADMIN_PERM,
8912                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8913                                   NL80211_FLAG_NEED_RTNL,
8914         },
8915 #endif
8916         {
8917                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
8918                 .doit = nl80211_set_rekey_data,
8919                 .policy = nl80211_policy,
8920                 .flags = GENL_ADMIN_PERM,
8921                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8922                                   NL80211_FLAG_NEED_RTNL,
8923         },
8924         {
8925                 .cmd = NL80211_CMD_TDLS_MGMT,
8926                 .doit = nl80211_tdls_mgmt,
8927                 .policy = nl80211_policy,
8928                 .flags = GENL_ADMIN_PERM,
8929                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8930                                   NL80211_FLAG_NEED_RTNL,
8931         },
8932         {
8933                 .cmd = NL80211_CMD_TDLS_OPER,
8934                 .doit = nl80211_tdls_oper,
8935                 .policy = nl80211_policy,
8936                 .flags = GENL_ADMIN_PERM,
8937                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8938                                   NL80211_FLAG_NEED_RTNL,
8939         },
8940         {
8941                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
8942                 .doit = nl80211_register_unexpected_frame,
8943                 .policy = nl80211_policy,
8944                 .flags = GENL_ADMIN_PERM,
8945                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8946                                   NL80211_FLAG_NEED_RTNL,
8947         },
8948         {
8949                 .cmd = NL80211_CMD_PROBE_CLIENT,
8950                 .doit = nl80211_probe_client,
8951                 .policy = nl80211_policy,
8952                 .flags = GENL_ADMIN_PERM,
8953                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8954                                   NL80211_FLAG_NEED_RTNL,
8955         },
8956         {
8957                 .cmd = NL80211_CMD_REGISTER_BEACONS,
8958                 .doit = nl80211_register_beacons,
8959                 .policy = nl80211_policy,
8960                 .flags = GENL_ADMIN_PERM,
8961                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8962                                   NL80211_FLAG_NEED_RTNL,
8963         },
8964         {
8965                 .cmd = NL80211_CMD_SET_NOACK_MAP,
8966                 .doit = nl80211_set_noack_map,
8967                 .policy = nl80211_policy,
8968                 .flags = GENL_ADMIN_PERM,
8969                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8970                                   NL80211_FLAG_NEED_RTNL,
8971         },
8972         {
8973                 .cmd = NL80211_CMD_START_P2P_DEVICE,
8974                 .doit = nl80211_start_p2p_device,
8975                 .policy = nl80211_policy,
8976                 .flags = GENL_ADMIN_PERM,
8977                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8978                                   NL80211_FLAG_NEED_RTNL,
8979         },
8980         {
8981                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
8982                 .doit = nl80211_stop_p2p_device,
8983                 .policy = nl80211_policy,
8984                 .flags = GENL_ADMIN_PERM,
8985                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8986                                   NL80211_FLAG_NEED_RTNL,
8987         },
8988         {
8989                 .cmd = NL80211_CMD_SET_MCAST_RATE,
8990                 .doit = nl80211_set_mcast_rate,
8991                 .policy = nl80211_policy,
8992                 .flags = GENL_ADMIN_PERM,
8993                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8994                                   NL80211_FLAG_NEED_RTNL,
8995         },
8996         {
8997                 .cmd = NL80211_CMD_SET_MAC_ACL,
8998                 .doit = nl80211_set_mac_acl,
8999                 .policy = nl80211_policy,
9000                 .flags = GENL_ADMIN_PERM,
9001                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9002                                   NL80211_FLAG_NEED_RTNL,
9003         },
9004         {
9005                 .cmd = NL80211_CMD_RADAR_DETECT,
9006                 .doit = nl80211_start_radar_detection,
9007                 .policy = nl80211_policy,
9008                 .flags = GENL_ADMIN_PERM,
9009                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9010                                   NL80211_FLAG_NEED_RTNL,
9011         },
9012         {
9013                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
9014                 .doit = nl80211_get_protocol_features,
9015                 .policy = nl80211_policy,
9016         },
9017         {
9018                 .cmd = NL80211_CMD_UPDATE_FT_IES,
9019                 .doit = nl80211_update_ft_ies,
9020                 .policy = nl80211_policy,
9021                 .flags = GENL_ADMIN_PERM,
9022                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9023                                   NL80211_FLAG_NEED_RTNL,
9024         },
9025         {
9026                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
9027                 .doit = nl80211_crit_protocol_start,
9028                 .policy = nl80211_policy,
9029                 .flags = GENL_ADMIN_PERM,
9030                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9031                                   NL80211_FLAG_NEED_RTNL,
9032         },
9033         {
9034                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
9035                 .doit = nl80211_crit_protocol_stop,
9036                 .policy = nl80211_policy,
9037                 .flags = GENL_ADMIN_PERM,
9038                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9039                                   NL80211_FLAG_NEED_RTNL,
9040         }
9041 };
9042
9043 static struct genl_multicast_group nl80211_mlme_mcgrp = {
9044         .name = "mlme",
9045 };
9046
9047 /* multicast groups */
9048 static struct genl_multicast_group nl80211_config_mcgrp = {
9049         .name = "config",
9050 };
9051 static struct genl_multicast_group nl80211_scan_mcgrp = {
9052         .name = "scan",
9053 };
9054 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
9055         .name = "regulatory",
9056 };
9057
9058 /* notification functions */
9059
9060 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
9061 {
9062         struct sk_buff *msg;
9063
9064         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9065         if (!msg)
9066                 return;
9067
9068         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0,
9069                                false, NULL, NULL, NULL) < 0) {
9070                 nlmsg_free(msg);
9071                 return;
9072         }
9073
9074         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9075                                 nl80211_config_mcgrp.id, GFP_KERNEL);
9076 }
9077
9078 static int nl80211_add_scan_req(struct sk_buff *msg,
9079                                 struct cfg80211_registered_device *rdev)
9080 {
9081         struct cfg80211_scan_request *req = rdev->scan_req;
9082         struct nlattr *nest;
9083         int i;
9084
9085         lockdep_assert_held(&rdev->sched_scan_mtx);
9086
9087         if (WARN_ON(!req))
9088                 return 0;
9089
9090         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
9091         if (!nest)
9092                 goto nla_put_failure;
9093         for (i = 0; i < req->n_ssids; i++) {
9094                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
9095                         goto nla_put_failure;
9096         }
9097         nla_nest_end(msg, nest);
9098
9099         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9100         if (!nest)
9101                 goto nla_put_failure;
9102         for (i = 0; i < req->n_channels; i++) {
9103                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9104                         goto nla_put_failure;
9105         }
9106         nla_nest_end(msg, nest);
9107
9108         if (req->ie &&
9109             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
9110                 goto nla_put_failure;
9111
9112         if (req->flags)
9113                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
9114
9115         return 0;
9116  nla_put_failure:
9117         return -ENOBUFS;
9118 }
9119
9120 static int nl80211_send_scan_msg(struct sk_buff *msg,
9121                                  struct cfg80211_registered_device *rdev,
9122                                  struct wireless_dev *wdev,
9123                                  u32 portid, u32 seq, int flags,
9124                                  u32 cmd)
9125 {
9126         void *hdr;
9127
9128         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9129         if (!hdr)
9130                 return -1;
9131
9132         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9133             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9134                                          wdev->netdev->ifindex)) ||
9135             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9136                 goto nla_put_failure;
9137
9138         /* ignore errors and send incomplete event anyway */
9139         nl80211_add_scan_req(msg, rdev);
9140
9141         return genlmsg_end(msg, hdr);
9142
9143  nla_put_failure:
9144         genlmsg_cancel(msg, hdr);
9145         return -EMSGSIZE;
9146 }
9147
9148 static int
9149 nl80211_send_sched_scan_msg(struct sk_buff *msg,
9150                             struct cfg80211_registered_device *rdev,
9151                             struct net_device *netdev,
9152                             u32 portid, u32 seq, int flags, u32 cmd)
9153 {
9154         void *hdr;
9155
9156         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9157         if (!hdr)
9158                 return -1;
9159
9160         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9161             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9162                 goto nla_put_failure;
9163
9164         return genlmsg_end(msg, hdr);
9165
9166  nla_put_failure:
9167         genlmsg_cancel(msg, hdr);
9168         return -EMSGSIZE;
9169 }
9170
9171 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
9172                              struct wireless_dev *wdev)
9173 {
9174         struct sk_buff *msg;
9175
9176         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9177         if (!msg)
9178                 return;
9179
9180         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9181                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
9182                 nlmsg_free(msg);
9183                 return;
9184         }
9185
9186         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9187                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9188 }
9189
9190 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
9191                             struct wireless_dev *wdev)
9192 {
9193         struct sk_buff *msg;
9194
9195         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9196         if (!msg)
9197                 return;
9198
9199         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9200                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
9201                 nlmsg_free(msg);
9202                 return;
9203         }
9204
9205         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9206                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9207 }
9208
9209 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
9210                                struct wireless_dev *wdev)
9211 {
9212         struct sk_buff *msg;
9213
9214         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9215         if (!msg)
9216                 return;
9217
9218         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
9219                                   NL80211_CMD_SCAN_ABORTED) < 0) {
9220                 nlmsg_free(msg);
9221                 return;
9222         }
9223
9224         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9225                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9226 }
9227
9228 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
9229                                      struct net_device *netdev)
9230 {
9231         struct sk_buff *msg;
9232
9233         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9234         if (!msg)
9235                 return;
9236
9237         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
9238                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
9239                 nlmsg_free(msg);
9240                 return;
9241         }
9242
9243         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9244                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9245 }
9246
9247 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
9248                              struct net_device *netdev, u32 cmd)
9249 {
9250         struct sk_buff *msg;
9251
9252         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9253         if (!msg)
9254                 return;
9255
9256         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
9257                 nlmsg_free(msg);
9258                 return;
9259         }
9260
9261         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9262                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
9263 }
9264
9265 /*
9266  * This can happen on global regulatory changes or device specific settings
9267  * based on custom world regulatory domains.
9268  */
9269 void nl80211_send_reg_change_event(struct regulatory_request *request)
9270 {
9271         struct sk_buff *msg;
9272         void *hdr;
9273
9274         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9275         if (!msg)
9276                 return;
9277
9278         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
9279         if (!hdr) {
9280                 nlmsg_free(msg);
9281                 return;
9282         }
9283
9284         /* Userspace can always count this one always being set */
9285         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
9286                 goto nla_put_failure;
9287
9288         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
9289                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9290                                NL80211_REGDOM_TYPE_WORLD))
9291                         goto nla_put_failure;
9292         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
9293                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9294                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
9295                         goto nla_put_failure;
9296         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
9297                    request->intersect) {
9298                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9299                                NL80211_REGDOM_TYPE_INTERSECTION))
9300                         goto nla_put_failure;
9301         } else {
9302                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
9303                                NL80211_REGDOM_TYPE_COUNTRY) ||
9304                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
9305                                    request->alpha2))
9306                         goto nla_put_failure;
9307         }
9308
9309         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
9310             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
9311                 goto nla_put_failure;
9312
9313         genlmsg_end(msg, hdr);
9314
9315         rcu_read_lock();
9316         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9317                                 GFP_ATOMIC);
9318         rcu_read_unlock();
9319
9320         return;
9321
9322 nla_put_failure:
9323         genlmsg_cancel(msg, hdr);
9324         nlmsg_free(msg);
9325 }
9326
9327 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
9328                                     struct net_device *netdev,
9329                                     const u8 *buf, size_t len,
9330                                     enum nl80211_commands cmd, gfp_t gfp)
9331 {
9332         struct sk_buff *msg;
9333         void *hdr;
9334
9335         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9336         if (!msg)
9337                 return;
9338
9339         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9340         if (!hdr) {
9341                 nlmsg_free(msg);
9342                 return;
9343         }
9344
9345         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9346             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9347             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9348                 goto nla_put_failure;
9349
9350         genlmsg_end(msg, hdr);
9351
9352         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9353                                 nl80211_mlme_mcgrp.id, gfp);
9354         return;
9355
9356  nla_put_failure:
9357         genlmsg_cancel(msg, hdr);
9358         nlmsg_free(msg);
9359 }
9360
9361 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
9362                           struct net_device *netdev, const u8 *buf,
9363                           size_t len, gfp_t gfp)
9364 {
9365         nl80211_send_mlme_event(rdev, netdev, buf, len,
9366                                 NL80211_CMD_AUTHENTICATE, gfp);
9367 }
9368
9369 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
9370                            struct net_device *netdev, const u8 *buf,
9371                            size_t len, gfp_t gfp)
9372 {
9373         nl80211_send_mlme_event(rdev, netdev, buf, len,
9374                                 NL80211_CMD_ASSOCIATE, gfp);
9375 }
9376
9377 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
9378                          struct net_device *netdev, const u8 *buf,
9379                          size_t len, gfp_t gfp)
9380 {
9381         nl80211_send_mlme_event(rdev, netdev, buf, len,
9382                                 NL80211_CMD_DEAUTHENTICATE, gfp);
9383 }
9384
9385 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
9386                            struct net_device *netdev, const u8 *buf,
9387                            size_t len, gfp_t gfp)
9388 {
9389         nl80211_send_mlme_event(rdev, netdev, buf, len,
9390                                 NL80211_CMD_DISASSOCIATE, gfp);
9391 }
9392
9393 void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
9394                                  size_t len)
9395 {
9396         struct wireless_dev *wdev = dev->ieee80211_ptr;
9397         struct wiphy *wiphy = wdev->wiphy;
9398         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9399
9400         trace_cfg80211_send_unprot_deauth(dev);
9401         nl80211_send_mlme_event(rdev, dev, buf, len,
9402                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, GFP_ATOMIC);
9403 }
9404 EXPORT_SYMBOL(cfg80211_send_unprot_deauth);
9405
9406 void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
9407                                    size_t len)
9408 {
9409         struct wireless_dev *wdev = dev->ieee80211_ptr;
9410         struct wiphy *wiphy = wdev->wiphy;
9411         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9412
9413         trace_cfg80211_send_unprot_disassoc(dev);
9414         nl80211_send_mlme_event(rdev, dev, buf, len,
9415                                 NL80211_CMD_UNPROT_DISASSOCIATE, GFP_ATOMIC);
9416 }
9417 EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
9418
9419 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
9420                                       struct net_device *netdev, int cmd,
9421                                       const u8 *addr, gfp_t gfp)
9422 {
9423         struct sk_buff *msg;
9424         void *hdr;
9425
9426         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9427         if (!msg)
9428                 return;
9429
9430         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9431         if (!hdr) {
9432                 nlmsg_free(msg);
9433                 return;
9434         }
9435
9436         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9437             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9438             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
9439             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9440                 goto nla_put_failure;
9441
9442         genlmsg_end(msg, hdr);
9443
9444         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9445                                 nl80211_mlme_mcgrp.id, gfp);
9446         return;
9447
9448  nla_put_failure:
9449         genlmsg_cancel(msg, hdr);
9450         nlmsg_free(msg);
9451 }
9452
9453 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
9454                                struct net_device *netdev, const u8 *addr,
9455                                gfp_t gfp)
9456 {
9457         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
9458                                   addr, gfp);
9459 }
9460
9461 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
9462                                 struct net_device *netdev, const u8 *addr,
9463                                 gfp_t gfp)
9464 {
9465         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
9466                                   addr, gfp);
9467 }
9468
9469 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
9470                                  struct net_device *netdev, const u8 *bssid,
9471                                  const u8 *req_ie, size_t req_ie_len,
9472                                  const u8 *resp_ie, size_t resp_ie_len,
9473                                  u16 status, gfp_t gfp)
9474 {
9475         struct sk_buff *msg;
9476         void *hdr;
9477
9478         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9479         if (!msg)
9480                 return;
9481
9482         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
9483         if (!hdr) {
9484                 nlmsg_free(msg);
9485                 return;
9486         }
9487
9488         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9489             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9490             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
9491             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
9492             (req_ie &&
9493              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9494             (resp_ie &&
9495              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9496                 goto nla_put_failure;
9497
9498         genlmsg_end(msg, hdr);
9499
9500         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9501                                 nl80211_mlme_mcgrp.id, gfp);
9502         return;
9503
9504  nla_put_failure:
9505         genlmsg_cancel(msg, hdr);
9506         nlmsg_free(msg);
9507
9508 }
9509
9510 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
9511                          struct net_device *netdev, const u8 *bssid,
9512                          const u8 *req_ie, size_t req_ie_len,
9513                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
9514 {
9515         struct sk_buff *msg;
9516         void *hdr;
9517
9518         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9519         if (!msg)
9520                 return;
9521
9522         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
9523         if (!hdr) {
9524                 nlmsg_free(msg);
9525                 return;
9526         }
9527
9528         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9529             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9530             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
9531             (req_ie &&
9532              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
9533             (resp_ie &&
9534              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
9535                 goto nla_put_failure;
9536
9537         genlmsg_end(msg, hdr);
9538
9539         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9540                                 nl80211_mlme_mcgrp.id, gfp);
9541         return;
9542
9543  nla_put_failure:
9544         genlmsg_cancel(msg, hdr);
9545         nlmsg_free(msg);
9546
9547 }
9548
9549 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
9550                                struct net_device *netdev, u16 reason,
9551                                const u8 *ie, size_t ie_len, bool from_ap)
9552 {
9553         struct sk_buff *msg;
9554         void *hdr;
9555
9556         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9557         if (!msg)
9558                 return;
9559
9560         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
9561         if (!hdr) {
9562                 nlmsg_free(msg);
9563                 return;
9564         }
9565
9566         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9567             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9568             (from_ap && reason &&
9569              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
9570             (from_ap &&
9571              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
9572             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
9573                 goto nla_put_failure;
9574
9575         genlmsg_end(msg, hdr);
9576
9577         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9578                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
9579         return;
9580
9581  nla_put_failure:
9582         genlmsg_cancel(msg, hdr);
9583         nlmsg_free(msg);
9584
9585 }
9586
9587 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
9588                              struct net_device *netdev, const u8 *bssid,
9589                              gfp_t gfp)
9590 {
9591         struct sk_buff *msg;
9592         void *hdr;
9593
9594         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9595         if (!msg)
9596                 return;
9597
9598         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
9599         if (!hdr) {
9600                 nlmsg_free(msg);
9601                 return;
9602         }
9603
9604         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9605             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9606             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9607                 goto nla_put_failure;
9608
9609         genlmsg_end(msg, hdr);
9610
9611         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9612                                 nl80211_mlme_mcgrp.id, gfp);
9613         return;
9614
9615  nla_put_failure:
9616         genlmsg_cancel(msg, hdr);
9617         nlmsg_free(msg);
9618 }
9619
9620 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
9621                                         const u8* ie, u8 ie_len, gfp_t gfp)
9622 {
9623         struct wireless_dev *wdev = dev->ieee80211_ptr;
9624         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9625         struct sk_buff *msg;
9626         void *hdr;
9627
9628         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
9629                 return;
9630
9631         trace_cfg80211_notify_new_peer_candidate(dev, addr);
9632
9633         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9634         if (!msg)
9635                 return;
9636
9637         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
9638         if (!hdr) {
9639                 nlmsg_free(msg);
9640                 return;
9641         }
9642
9643         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9644             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9645             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9646             (ie_len && ie &&
9647              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
9648                 goto nla_put_failure;
9649
9650         genlmsg_end(msg, hdr);
9651
9652         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9653                                 nl80211_mlme_mcgrp.id, gfp);
9654         return;
9655
9656  nla_put_failure:
9657         genlmsg_cancel(msg, hdr);
9658         nlmsg_free(msg);
9659 }
9660 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
9661
9662 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
9663                                  struct net_device *netdev, const u8 *addr,
9664                                  enum nl80211_key_type key_type, int key_id,
9665                                  const u8 *tsc, gfp_t gfp)
9666 {
9667         struct sk_buff *msg;
9668         void *hdr;
9669
9670         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9671         if (!msg)
9672                 return;
9673
9674         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
9675         if (!hdr) {
9676                 nlmsg_free(msg);
9677                 return;
9678         }
9679
9680         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9681             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9682             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
9683             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
9684             (key_id != -1 &&
9685              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
9686             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
9687                 goto nla_put_failure;
9688
9689         genlmsg_end(msg, hdr);
9690
9691         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9692                                 nl80211_mlme_mcgrp.id, gfp);
9693         return;
9694
9695  nla_put_failure:
9696         genlmsg_cancel(msg, hdr);
9697         nlmsg_free(msg);
9698 }
9699
9700 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
9701                                     struct ieee80211_channel *channel_before,
9702                                     struct ieee80211_channel *channel_after)
9703 {
9704         struct sk_buff *msg;
9705         void *hdr;
9706         struct nlattr *nl_freq;
9707
9708         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
9709         if (!msg)
9710                 return;
9711
9712         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
9713         if (!hdr) {
9714                 nlmsg_free(msg);
9715                 return;
9716         }
9717
9718         /*
9719          * Since we are applying the beacon hint to a wiphy we know its
9720          * wiphy_idx is valid
9721          */
9722         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9723                 goto nla_put_failure;
9724
9725         /* Before */
9726         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
9727         if (!nl_freq)
9728                 goto nla_put_failure;
9729         if (nl80211_msg_put_channel(msg, channel_before, false))
9730                 goto nla_put_failure;
9731         nla_nest_end(msg, nl_freq);
9732
9733         /* After */
9734         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
9735         if (!nl_freq)
9736                 goto nla_put_failure;
9737         if (nl80211_msg_put_channel(msg, channel_after, false))
9738                 goto nla_put_failure;
9739         nla_nest_end(msg, nl_freq);
9740
9741         genlmsg_end(msg, hdr);
9742
9743         rcu_read_lock();
9744         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9745                                 GFP_ATOMIC);
9746         rcu_read_unlock();
9747
9748         return;
9749
9750 nla_put_failure:
9751         genlmsg_cancel(msg, hdr);
9752         nlmsg_free(msg);
9753 }
9754
9755 static void nl80211_send_remain_on_chan_event(
9756         int cmd, struct cfg80211_registered_device *rdev,
9757         struct wireless_dev *wdev, u64 cookie,
9758         struct ieee80211_channel *chan,
9759         unsigned int duration, gfp_t gfp)
9760 {
9761         struct sk_buff *msg;
9762         void *hdr;
9763
9764         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9765         if (!msg)
9766                 return;
9767
9768         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9769         if (!hdr) {
9770                 nlmsg_free(msg);
9771                 return;
9772         }
9773
9774         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9775             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9776                                          wdev->netdev->ifindex)) ||
9777             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9778             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
9779             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
9780                         NL80211_CHAN_NO_HT) ||
9781             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9782                 goto nla_put_failure;
9783
9784         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
9785             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
9786                 goto nla_put_failure;
9787
9788         genlmsg_end(msg, hdr);
9789
9790         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9791                                 nl80211_mlme_mcgrp.id, gfp);
9792         return;
9793
9794  nla_put_failure:
9795         genlmsg_cancel(msg, hdr);
9796         nlmsg_free(msg);
9797 }
9798
9799 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
9800                                struct ieee80211_channel *chan,
9801                                unsigned int duration, gfp_t gfp)
9802 {
9803         struct wiphy *wiphy = wdev->wiphy;
9804         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9805
9806         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
9807         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
9808                                           rdev, wdev, cookie, chan,
9809                                           duration, gfp);
9810 }
9811 EXPORT_SYMBOL(cfg80211_ready_on_channel);
9812
9813 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
9814                                         struct ieee80211_channel *chan,
9815                                         gfp_t gfp)
9816 {
9817         struct wiphy *wiphy = wdev->wiphy;
9818         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9819
9820         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
9821         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9822                                           rdev, wdev, cookie, chan, 0, gfp);
9823 }
9824 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
9825
9826 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
9827                       struct station_info *sinfo, gfp_t gfp)
9828 {
9829         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9830         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9831         struct sk_buff *msg;
9832
9833         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
9834
9835         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9836         if (!msg)
9837                 return;
9838
9839         if (nl80211_send_station(msg, 0, 0, 0,
9840                                  rdev, dev, mac_addr, sinfo) < 0) {
9841                 nlmsg_free(msg);
9842                 return;
9843         }
9844
9845         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9846                                 nl80211_mlme_mcgrp.id, gfp);
9847 }
9848 EXPORT_SYMBOL(cfg80211_new_sta);
9849
9850 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
9851 {
9852         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9853         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9854         struct sk_buff *msg;
9855         void *hdr;
9856
9857         trace_cfg80211_del_sta(dev, mac_addr);
9858
9859         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9860         if (!msg)
9861                 return;
9862
9863         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
9864         if (!hdr) {
9865                 nlmsg_free(msg);
9866                 return;
9867         }
9868
9869         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9870             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
9871                 goto nla_put_failure;
9872
9873         genlmsg_end(msg, hdr);
9874
9875         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9876                                 nl80211_mlme_mcgrp.id, gfp);
9877         return;
9878
9879  nla_put_failure:
9880         genlmsg_cancel(msg, hdr);
9881         nlmsg_free(msg);
9882 }
9883 EXPORT_SYMBOL(cfg80211_del_sta);
9884
9885 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
9886                           enum nl80211_connect_failed_reason reason,
9887                           gfp_t gfp)
9888 {
9889         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
9890         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9891         struct sk_buff *msg;
9892         void *hdr;
9893
9894         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9895         if (!msg)
9896                 return;
9897
9898         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
9899         if (!hdr) {
9900                 nlmsg_free(msg);
9901                 return;
9902         }
9903
9904         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9905             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
9906             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
9907                 goto nla_put_failure;
9908
9909         genlmsg_end(msg, hdr);
9910
9911         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9912                                 nl80211_mlme_mcgrp.id, gfp);
9913         return;
9914
9915  nla_put_failure:
9916         genlmsg_cancel(msg, hdr);
9917         nlmsg_free(msg);
9918 }
9919 EXPORT_SYMBOL(cfg80211_conn_failed);
9920
9921 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
9922                                        const u8 *addr, gfp_t gfp)
9923 {
9924         struct wireless_dev *wdev = dev->ieee80211_ptr;
9925         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9926         struct sk_buff *msg;
9927         void *hdr;
9928         int err;
9929         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
9930
9931         if (!nlportid)
9932                 return false;
9933
9934         msg = nlmsg_new(100, gfp);
9935         if (!msg)
9936                 return true;
9937
9938         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9939         if (!hdr) {
9940                 nlmsg_free(msg);
9941                 return true;
9942         }
9943
9944         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9945             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9946             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9947                 goto nla_put_failure;
9948
9949         err = genlmsg_end(msg, hdr);
9950         if (err < 0) {
9951                 nlmsg_free(msg);
9952                 return true;
9953         }
9954
9955         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9956         return true;
9957
9958  nla_put_failure:
9959         genlmsg_cancel(msg, hdr);
9960         nlmsg_free(msg);
9961         return true;
9962 }
9963
9964 bool cfg80211_rx_spurious_frame(struct net_device *dev,
9965                                 const u8 *addr, gfp_t gfp)
9966 {
9967         struct wireless_dev *wdev = dev->ieee80211_ptr;
9968         bool ret;
9969
9970         trace_cfg80211_rx_spurious_frame(dev, addr);
9971
9972         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9973                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
9974                 trace_cfg80211_return_bool(false);
9975                 return false;
9976         }
9977         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
9978                                          addr, gfp);
9979         trace_cfg80211_return_bool(ret);
9980         return ret;
9981 }
9982 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
9983
9984 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
9985                                         const u8 *addr, gfp_t gfp)
9986 {
9987         struct wireless_dev *wdev = dev->ieee80211_ptr;
9988         bool ret;
9989
9990         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
9991
9992         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
9993                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
9994                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
9995                 trace_cfg80211_return_bool(false);
9996                 return false;
9997         }
9998         ret = __nl80211_unexpected_frame(dev,
9999                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
10000                                          addr, gfp);
10001         trace_cfg80211_return_bool(ret);
10002         return ret;
10003 }
10004 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
10005
10006 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
10007                       struct wireless_dev *wdev, u32 nlportid,
10008                       int freq, int sig_dbm,
10009                       const u8 *buf, size_t len, gfp_t gfp)
10010 {
10011         struct net_device *netdev = wdev->netdev;
10012         struct sk_buff *msg;
10013         void *hdr;
10014
10015         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10016         if (!msg)
10017                 return -ENOMEM;
10018
10019         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10020         if (!hdr) {
10021                 nlmsg_free(msg);
10022                 return -ENOMEM;
10023         }
10024
10025         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10026             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10027                                         netdev->ifindex)) ||
10028             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10029             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
10030             (sig_dbm &&
10031              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10032             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
10033                 goto nla_put_failure;
10034
10035         genlmsg_end(msg, hdr);
10036
10037         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10038
10039  nla_put_failure:
10040         genlmsg_cancel(msg, hdr);
10041         nlmsg_free(msg);
10042         return -ENOBUFS;
10043 }
10044
10045 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
10046                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
10047 {
10048         struct wiphy *wiphy = wdev->wiphy;
10049         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10050         struct net_device *netdev = wdev->netdev;
10051         struct sk_buff *msg;
10052         void *hdr;
10053
10054         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
10055
10056         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10057         if (!msg)
10058                 return;
10059
10060         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10061         if (!hdr) {
10062                 nlmsg_free(msg);
10063                 return;
10064         }
10065
10066         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10067             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10068                                    netdev->ifindex)) ||
10069             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10070             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10071             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10072             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
10073                 goto nla_put_failure;
10074
10075         genlmsg_end(msg, hdr);
10076
10077         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
10078         return;
10079
10080  nla_put_failure:
10081         genlmsg_cancel(msg, hdr);
10082         nlmsg_free(msg);
10083 }
10084 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10085
10086 void cfg80211_cqm_rssi_notify(struct net_device *dev,
10087                               enum nl80211_cqm_rssi_threshold_event rssi_event,
10088                               gfp_t gfp)
10089 {
10090         struct wireless_dev *wdev = dev->ieee80211_ptr;
10091         struct wiphy *wiphy = wdev->wiphy;
10092         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10093         struct sk_buff *msg;
10094         struct nlattr *pinfoattr;
10095         void *hdr;
10096
10097         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
10098
10099         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10100         if (!msg)
10101                 return;
10102
10103         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10104         if (!hdr) {
10105                 nlmsg_free(msg);
10106                 return;
10107         }
10108
10109         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10110             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10111                 goto nla_put_failure;
10112
10113         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10114         if (!pinfoattr)
10115                 goto nla_put_failure;
10116
10117         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
10118                         rssi_event))
10119                 goto nla_put_failure;
10120
10121         nla_nest_end(msg, pinfoattr);
10122
10123         genlmsg_end(msg, hdr);
10124
10125         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10126                                 nl80211_mlme_mcgrp.id, gfp);
10127         return;
10128
10129  nla_put_failure:
10130         genlmsg_cancel(msg, hdr);
10131         nlmsg_free(msg);
10132 }
10133 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10134
10135 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
10136                                      struct net_device *netdev, const u8 *bssid,
10137                                      const u8 *replay_ctr, gfp_t gfp)
10138 {
10139         struct sk_buff *msg;
10140         struct nlattr *rekey_attr;
10141         void *hdr;
10142
10143         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10144         if (!msg)
10145                 return;
10146
10147         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
10148         if (!hdr) {
10149                 nlmsg_free(msg);
10150                 return;
10151         }
10152
10153         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10154             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10155             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10156                 goto nla_put_failure;
10157
10158         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
10159         if (!rekey_attr)
10160                 goto nla_put_failure;
10161
10162         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
10163                     NL80211_REPLAY_CTR_LEN, replay_ctr))
10164                 goto nla_put_failure;
10165
10166         nla_nest_end(msg, rekey_attr);
10167
10168         genlmsg_end(msg, hdr);
10169
10170         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10171                                 nl80211_mlme_mcgrp.id, gfp);
10172         return;
10173
10174  nla_put_failure:
10175         genlmsg_cancel(msg, hdr);
10176         nlmsg_free(msg);
10177 }
10178
10179 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
10180                                const u8 *replay_ctr, gfp_t gfp)
10181 {
10182         struct wireless_dev *wdev = dev->ieee80211_ptr;
10183         struct wiphy *wiphy = wdev->wiphy;
10184         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10185
10186         trace_cfg80211_gtk_rekey_notify(dev, bssid);
10187         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
10188 }
10189 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
10190
10191 static void
10192 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
10193                                struct net_device *netdev, int index,
10194                                const u8 *bssid, bool preauth, gfp_t gfp)
10195 {
10196         struct sk_buff *msg;
10197         struct nlattr *attr;
10198         void *hdr;
10199
10200         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10201         if (!msg)
10202                 return;
10203
10204         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
10205         if (!hdr) {
10206                 nlmsg_free(msg);
10207                 return;
10208         }
10209
10210         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10211             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10212                 goto nla_put_failure;
10213
10214         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
10215         if (!attr)
10216                 goto nla_put_failure;
10217
10218         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
10219             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
10220             (preauth &&
10221              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
10222                 goto nla_put_failure;
10223
10224         nla_nest_end(msg, attr);
10225
10226         genlmsg_end(msg, hdr);
10227
10228         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10229                                 nl80211_mlme_mcgrp.id, gfp);
10230         return;
10231
10232  nla_put_failure:
10233         genlmsg_cancel(msg, hdr);
10234         nlmsg_free(msg);
10235 }
10236
10237 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
10238                                      const u8 *bssid, bool preauth, gfp_t gfp)
10239 {
10240         struct wireless_dev *wdev = dev->ieee80211_ptr;
10241         struct wiphy *wiphy = wdev->wiphy;
10242         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10243
10244         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
10245         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
10246 }
10247 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
10248
10249 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
10250                                      struct net_device *netdev,
10251                                      struct cfg80211_chan_def *chandef,
10252                                      gfp_t gfp)
10253 {
10254         struct sk_buff *msg;
10255         void *hdr;
10256
10257         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10258         if (!msg)
10259                 return;
10260
10261         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
10262         if (!hdr) {
10263                 nlmsg_free(msg);
10264                 return;
10265         }
10266
10267         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10268                 goto nla_put_failure;
10269
10270         if (nl80211_send_chandef(msg, chandef))
10271                 goto nla_put_failure;
10272
10273         genlmsg_end(msg, hdr);
10274
10275         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10276                                 nl80211_mlme_mcgrp.id, gfp);
10277         return;
10278
10279  nla_put_failure:
10280         genlmsg_cancel(msg, hdr);
10281         nlmsg_free(msg);
10282 }
10283
10284 void cfg80211_ch_switch_notify(struct net_device *dev,
10285                                struct cfg80211_chan_def *chandef)
10286 {
10287         struct wireless_dev *wdev = dev->ieee80211_ptr;
10288         struct wiphy *wiphy = wdev->wiphy;
10289         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10290
10291         trace_cfg80211_ch_switch_notify(dev, chandef);
10292
10293         wdev_lock(wdev);
10294
10295         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10296                     wdev->iftype != NL80211_IFTYPE_P2P_GO))
10297                 goto out;
10298
10299         wdev->channel = chandef->chan;
10300         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
10301 out:
10302         wdev_unlock(wdev);
10303         return;
10304 }
10305 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
10306
10307 void cfg80211_cqm_txe_notify(struct net_device *dev,
10308                              const u8 *peer, u32 num_packets,
10309                              u32 rate, u32 intvl, gfp_t gfp)
10310 {
10311         struct wireless_dev *wdev = dev->ieee80211_ptr;
10312         struct wiphy *wiphy = wdev->wiphy;
10313         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10314         struct sk_buff *msg;
10315         struct nlattr *pinfoattr;
10316         void *hdr;
10317
10318         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10319         if (!msg)
10320                 return;
10321
10322         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10323         if (!hdr) {
10324                 nlmsg_free(msg);
10325                 return;
10326         }
10327
10328         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10329             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10330             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10331                 goto nla_put_failure;
10332
10333         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10334         if (!pinfoattr)
10335                 goto nla_put_failure;
10336
10337         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
10338                 goto nla_put_failure;
10339
10340         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
10341                 goto nla_put_failure;
10342
10343         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
10344                 goto nla_put_failure;
10345
10346         nla_nest_end(msg, pinfoattr);
10347
10348         genlmsg_end(msg, hdr);
10349
10350         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10351                                 nl80211_mlme_mcgrp.id, gfp);
10352         return;
10353
10354  nla_put_failure:
10355         genlmsg_cancel(msg, hdr);
10356         nlmsg_free(msg);
10357 }
10358 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
10359
10360 void
10361 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
10362                      struct cfg80211_chan_def *chandef,
10363                      enum nl80211_radar_event event,
10364                      struct net_device *netdev, gfp_t gfp)
10365 {
10366         struct sk_buff *msg;
10367         void *hdr;
10368
10369         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10370         if (!msg)
10371                 return;
10372
10373         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
10374         if (!hdr) {
10375                 nlmsg_free(msg);
10376                 return;
10377         }
10378
10379         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10380                 goto nla_put_failure;
10381
10382         /* NOP and radar events don't need a netdev parameter */
10383         if (netdev) {
10384                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
10385
10386                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10387                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10388                         goto nla_put_failure;
10389         }
10390
10391         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
10392                 goto nla_put_failure;
10393
10394         if (nl80211_send_chandef(msg, chandef))
10395                 goto nla_put_failure;
10396
10397         if (genlmsg_end(msg, hdr) < 0) {
10398                 nlmsg_free(msg);
10399                 return;
10400         }
10401
10402         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10403                                 nl80211_mlme_mcgrp.id, gfp);
10404         return;
10405
10406  nla_put_failure:
10407         genlmsg_cancel(msg, hdr);
10408         nlmsg_free(msg);
10409 }
10410
10411 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
10412                                  const u8 *peer, u32 num_packets, gfp_t gfp)
10413 {
10414         struct wireless_dev *wdev = dev->ieee80211_ptr;
10415         struct wiphy *wiphy = wdev->wiphy;
10416         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10417         struct sk_buff *msg;
10418         struct nlattr *pinfoattr;
10419         void *hdr;
10420
10421         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
10422
10423         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10424         if (!msg)
10425                 return;
10426
10427         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10428         if (!hdr) {
10429                 nlmsg_free(msg);
10430                 return;
10431         }
10432
10433         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10434             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10435             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
10436                 goto nla_put_failure;
10437
10438         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10439         if (!pinfoattr)
10440                 goto nla_put_failure;
10441
10442         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
10443                 goto nla_put_failure;
10444
10445         nla_nest_end(msg, pinfoattr);
10446
10447         genlmsg_end(msg, hdr);
10448
10449         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10450                                 nl80211_mlme_mcgrp.id, gfp);
10451         return;
10452
10453  nla_put_failure:
10454         genlmsg_cancel(msg, hdr);
10455         nlmsg_free(msg);
10456 }
10457 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
10458
10459 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
10460                            u64 cookie, bool acked, gfp_t gfp)
10461 {
10462         struct wireless_dev *wdev = dev->ieee80211_ptr;
10463         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10464         struct sk_buff *msg;
10465         void *hdr;
10466         int err;
10467
10468         trace_cfg80211_probe_status(dev, addr, cookie, acked);
10469
10470         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10471
10472         if (!msg)
10473                 return;
10474
10475         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
10476         if (!hdr) {
10477                 nlmsg_free(msg);
10478                 return;
10479         }
10480
10481         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10482             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10483             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10484             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10485             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
10486                 goto nla_put_failure;
10487
10488         err = genlmsg_end(msg, hdr);
10489         if (err < 0) {
10490                 nlmsg_free(msg);
10491                 return;
10492         }
10493
10494         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10495                                 nl80211_mlme_mcgrp.id, gfp);
10496         return;
10497
10498  nla_put_failure:
10499         genlmsg_cancel(msg, hdr);
10500         nlmsg_free(msg);
10501 }
10502 EXPORT_SYMBOL(cfg80211_probe_status);
10503
10504 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
10505                                  const u8 *frame, size_t len,
10506                                  int freq, int sig_dbm)
10507 {
10508         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10509         struct sk_buff *msg;
10510         void *hdr;
10511         struct cfg80211_beacon_registration *reg;
10512
10513         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
10514
10515         spin_lock_bh(&rdev->beacon_registrations_lock);
10516         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10517                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
10518                 if (!msg) {
10519                         spin_unlock_bh(&rdev->beacon_registrations_lock);
10520                         return;
10521                 }
10522
10523                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10524                 if (!hdr)
10525                         goto nla_put_failure;
10526
10527                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10528                     (freq &&
10529                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
10530                     (sig_dbm &&
10531                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10532                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
10533                         goto nla_put_failure;
10534
10535                 genlmsg_end(msg, hdr);
10536
10537                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
10538         }
10539         spin_unlock_bh(&rdev->beacon_registrations_lock);
10540         return;
10541
10542  nla_put_failure:
10543         spin_unlock_bh(&rdev->beacon_registrations_lock);
10544         if (hdr)
10545                 genlmsg_cancel(msg, hdr);
10546         nlmsg_free(msg);
10547 }
10548 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
10549
10550 #ifdef CONFIG_PM
10551 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
10552                                    struct cfg80211_wowlan_wakeup *wakeup,
10553                                    gfp_t gfp)
10554 {
10555         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10556         struct sk_buff *msg;
10557         void *hdr;
10558         int err, size = 200;
10559
10560         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
10561
10562         if (wakeup)
10563                 size += wakeup->packet_present_len;
10564
10565         msg = nlmsg_new(size, gfp);
10566         if (!msg)
10567                 return;
10568
10569         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
10570         if (!hdr)
10571                 goto free_msg;
10572
10573         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10574             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10575                 goto free_msg;
10576
10577         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10578                                         wdev->netdev->ifindex))
10579                 goto free_msg;
10580
10581         if (wakeup) {
10582                 struct nlattr *reasons;
10583
10584                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10585
10586                 if (wakeup->disconnect &&
10587                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
10588                         goto free_msg;
10589                 if (wakeup->magic_pkt &&
10590                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
10591                         goto free_msg;
10592                 if (wakeup->gtk_rekey_failure &&
10593                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
10594                         goto free_msg;
10595                 if (wakeup->eap_identity_req &&
10596                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
10597                         goto free_msg;
10598                 if (wakeup->four_way_handshake &&
10599                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
10600                         goto free_msg;
10601                 if (wakeup->rfkill_release &&
10602                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
10603                         goto free_msg;
10604
10605                 if (wakeup->pattern_idx >= 0 &&
10606                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
10607                                 wakeup->pattern_idx))
10608                         goto free_msg;
10609
10610                 if (wakeup->tcp_match)
10611                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
10612
10613                 if (wakeup->tcp_connlost)
10614                         nla_put_flag(msg,
10615                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
10616
10617                 if (wakeup->tcp_nomoretokens)
10618                         nla_put_flag(msg,
10619                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
10620
10621                 if (wakeup->packet) {
10622                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
10623                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
10624
10625                         if (!wakeup->packet_80211) {
10626                                 pkt_attr =
10627                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
10628                                 len_attr =
10629                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
10630                         }
10631
10632                         if (wakeup->packet_len &&
10633                             nla_put_u32(msg, len_attr, wakeup->packet_len))
10634                                 goto free_msg;
10635
10636                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
10637                                     wakeup->packet))
10638                                 goto free_msg;
10639                 }
10640
10641                 nla_nest_end(msg, reasons);
10642         }
10643
10644         err = genlmsg_end(msg, hdr);
10645         if (err < 0)
10646                 goto free_msg;
10647
10648         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10649                                 nl80211_mlme_mcgrp.id, gfp);
10650         return;
10651
10652  free_msg:
10653         nlmsg_free(msg);
10654 }
10655 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
10656 #endif
10657
10658 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
10659                                 enum nl80211_tdls_operation oper,
10660                                 u16 reason_code, gfp_t gfp)
10661 {
10662         struct wireless_dev *wdev = dev->ieee80211_ptr;
10663         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10664         struct sk_buff *msg;
10665         void *hdr;
10666         int err;
10667
10668         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
10669                                          reason_code);
10670
10671         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10672         if (!msg)
10673                 return;
10674
10675         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
10676         if (!hdr) {
10677                 nlmsg_free(msg);
10678                 return;
10679         }
10680
10681         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10682             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10683             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
10684             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
10685             (reason_code > 0 &&
10686              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
10687                 goto nla_put_failure;
10688
10689         err = genlmsg_end(msg, hdr);
10690         if (err < 0) {
10691                 nlmsg_free(msg);
10692                 return;
10693         }
10694
10695         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10696                                 nl80211_mlme_mcgrp.id, gfp);
10697         return;
10698
10699  nla_put_failure:
10700         genlmsg_cancel(msg, hdr);
10701         nlmsg_free(msg);
10702 }
10703 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
10704
10705 static int nl80211_netlink_notify(struct notifier_block * nb,
10706                                   unsigned long state,
10707                                   void *_notify)
10708 {
10709         struct netlink_notify *notify = _notify;
10710         struct cfg80211_registered_device *rdev;
10711         struct wireless_dev *wdev;
10712         struct cfg80211_beacon_registration *reg, *tmp;
10713
10714         if (state != NETLINK_URELEASE)
10715                 return NOTIFY_DONE;
10716
10717         rcu_read_lock();
10718
10719         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
10720                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
10721                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
10722
10723                 spin_lock_bh(&rdev->beacon_registrations_lock);
10724                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
10725                                          list) {
10726                         if (reg->nlportid == notify->portid) {
10727                                 list_del(&reg->list);
10728                                 kfree(reg);
10729                                 break;
10730                         }
10731                 }
10732                 spin_unlock_bh(&rdev->beacon_registrations_lock);
10733         }
10734
10735         rcu_read_unlock();
10736
10737         return NOTIFY_DONE;
10738 }
10739
10740 static struct notifier_block nl80211_netlink_notifier = {
10741         .notifier_call = nl80211_netlink_notify,
10742 };
10743
10744 void cfg80211_ft_event(struct net_device *netdev,
10745                        struct cfg80211_ft_event_params *ft_event)
10746 {
10747         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
10748         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10749         struct sk_buff *msg;
10750         void *hdr;
10751         int err;
10752
10753         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
10754
10755         if (!ft_event->target_ap)
10756                 return;
10757
10758         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10759         if (!msg)
10760                 return;
10761
10762         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
10763         if (!hdr) {
10764                 nlmsg_free(msg);
10765                 return;
10766         }
10767
10768         nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
10769         nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
10770         nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
10771         if (ft_event->ies)
10772                 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
10773         if (ft_event->ric_ies)
10774                 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
10775                         ft_event->ric_ies);
10776
10777         err = genlmsg_end(msg, hdr);
10778         if (err < 0) {
10779                 nlmsg_free(msg);
10780                 return;
10781         }
10782
10783         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
10784                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
10785 }
10786 EXPORT_SYMBOL(cfg80211_ft_event);
10787
10788 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
10789 {
10790         struct cfg80211_registered_device *rdev;
10791         struct sk_buff *msg;
10792         void *hdr;
10793         u32 nlportid;
10794
10795         rdev = wiphy_to_dev(wdev->wiphy);
10796         if (!rdev->crit_proto_nlportid)
10797                 return;
10798
10799         nlportid = rdev->crit_proto_nlportid;
10800         rdev->crit_proto_nlportid = 0;
10801
10802         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10803         if (!msg)
10804                 return;
10805
10806         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
10807         if (!hdr)
10808                 goto nla_put_failure;
10809
10810         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10811             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10812                 goto nla_put_failure;
10813
10814         genlmsg_end(msg, hdr);
10815
10816         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10817         return;
10818
10819  nla_put_failure:
10820         if (hdr)
10821                 genlmsg_cancel(msg, hdr);
10822         nlmsg_free(msg);
10823
10824 }
10825 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
10826
10827 /* initialisation/exit functions */
10828
10829 int nl80211_init(void)
10830 {
10831         int err;
10832
10833         err = genl_register_family_with_ops(&nl80211_fam,
10834                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
10835         if (err)
10836                 return err;
10837
10838         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
10839         if (err)
10840                 goto err_out;
10841
10842         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
10843         if (err)
10844                 goto err_out;
10845
10846         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
10847         if (err)
10848                 goto err_out;
10849
10850         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
10851         if (err)
10852                 goto err_out;
10853
10854 #ifdef CONFIG_NL80211_TESTMODE
10855         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
10856         if (err)
10857                 goto err_out;
10858 #endif
10859
10860         err = netlink_register_notifier(&nl80211_netlink_notifier);
10861         if (err)
10862                 goto err_out;
10863
10864         return 0;
10865  err_out:
10866         genl_unregister_family(&nl80211_fam);
10867         return err;
10868 }
10869
10870 void nl80211_exit(void)
10871 {
10872         netlink_unregister_notifier(&nl80211_netlink_notifier);
10873         genl_unregister_family(&nl80211_fam);
10874 }