net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  41         .name = "nl80211",      /* have users key off the name instead */
  42         .hdrsize = 0,           /* no private header */
  43         .version = 1,           /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* returns ERR_PTR values */
  51 static struct wireless_dev *
  52 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  53 {
  54         struct cfg80211_registered_device *rdev;
  55         struct wireless_dev *result = NULL;
  56         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  57         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  58         u64 wdev_id;
  59         int wiphy_idx = -1;
  60         int ifidx = -1;
  61
  62         assert_cfg80211_lock();
  63
  64         if (!have_ifidx && !have_wdev_id)
  65                 return ERR_PTR(-EINVAL);
  66
  67         if (have_ifidx)
  68                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  69         if (have_wdev_id) {
  70                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  71                 wiphy_idx = wdev_id >> 32;
  72         }
  73
  74         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  75                 struct wireless_dev *wdev;
  76
  77                 if (wiphy_net(&rdev->wiphy) != netns)
  78                         continue;
  79
  80                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  81                         continue;
  82
  83                 mutex_lock(&rdev->devlist_mtx);
  84                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  85                         if (have_ifidx && wdev->netdev &&
  86                             wdev->netdev->ifindex == ifidx) {
  87                                 result = wdev;
  88                                 break;
  89                         }
  90                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  91                                 result = wdev;
  92                                 break;
  93                         }
  94                 }
  95                 mutex_unlock(&rdev->devlist_mtx);
  96
  97                 if (result)
  98                         break;
  99         }
 100
 101         if (result)
 102                 return result;
 103         return ERR_PTR(-ENODEV);
 104 }
 105
 106 static struct cfg80211_registered_device *
 107 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 108 {
 109         struct cfg80211_registered_device *rdev = NULL, *tmp;
 110         struct net_device *netdev;
 111
 112         assert_cfg80211_lock();
 113
 114         if (!attrs[NL80211_ATTR_WIPHY] &&
 115             !attrs[NL80211_ATTR_IFINDEX] &&
 116             !attrs[NL80211_ATTR_WDEV])
 117                 return ERR_PTR(-EINVAL);
 118
 119         if (attrs[NL80211_ATTR_WIPHY])
 120                 rdev = cfg80211_rdev_by_wiphy_idx(
 121                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 122
 123         if (attrs[NL80211_ATTR_WDEV]) {
 124                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 125                 struct wireless_dev *wdev;
 126                 bool found = false;
 127
 128                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 129                 if (tmp) {
 130                         /* make sure wdev exists */
 131                         mutex_lock(&tmp->devlist_mtx);
 132                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 133                                 if (wdev->identifier != (u32)wdev_id)
 134                                         continue;
 135                                 found = true;
 136                                 break;
 137                         }
 138                         mutex_unlock(&tmp->devlist_mtx);
 139
 140                         if (!found)
 141                                 tmp = NULL;
 142
 143                         if (rdev && tmp != rdev)
 144                                 return ERR_PTR(-EINVAL);
 145                         rdev = tmp;
 146                 }
 147         }
 148
 149         if (attrs[NL80211_ATTR_IFINDEX]) {
 150                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 151                 netdev = dev_get_by_index(netns, ifindex);
 152                 if (netdev) {
 153                         if (netdev->ieee80211_ptr)
 154                                 tmp = wiphy_to_dev(
 155                                                 netdev->ieee80211_ptr->wiphy);
 156                         else
 157                                 tmp = NULL;
 158
 159                         dev_put(netdev);
 160
 161                         /* not wireless device -- return error */
 162                         if (!tmp)
 163                                 return ERR_PTR(-EINVAL);
 164
 165                         /* mismatch -- return error */
 166                         if (rdev && tmp != rdev)
 167                                 return ERR_PTR(-EINVAL);
 168
 169                         rdev = tmp;
 170                 }
 171         }
 172
 173         if (!rdev)
 174                 return ERR_PTR(-ENODEV);
 175
 176         if (netns != wiphy_net(&rdev->wiphy))
 177                 return ERR_PTR(-ENODEV);
 178
 179         return rdev;
 180 }
 181
 182 /*
 183  * This function returns a pointer to the driver
 184  * that the genl_info item that is passed refers to.
 185  * If successful, it returns non-NULL and also locks
 186  * the driver's mutex!
 187  *
 188  * This means that you need to call cfg80211_unlock_rdev()
 189  * before being allowed to acquire &cfg80211_mutex!
 190  *
 191  * This is necessary because we need to lock the global
 192  * mutex to get an item off the list safely, and then
 193  * we lock the rdev mutex so it doesn't go away under us.
 194  *
 195  * We don't want to keep cfg80211_mutex locked
 196  * for all the time in order to allow requests on
 197  * other interfaces to go through at the same time.
 198  *
 199  * The result of this can be a PTR_ERR and hence must
 200  * be checked with IS_ERR() for errors.
 201  */
 202 static struct cfg80211_registered_device *
 203 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 204 {
 205         struct cfg80211_registered_device *rdev;
 206
 207         mutex_lock(&cfg80211_mutex);
 208         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 209
 210         /* if it is not an error we grab the lock on
 211          * it to assure it won't be going away while
 212          * we operate on it */
 213         if (!IS_ERR(rdev))
 214                 mutex_lock(&rdev->mtx);
 215
 216         mutex_unlock(&cfg80211_mutex);
 217
 218         return rdev;
 219 }
 220
 221 /* policy for the attributes */
 222 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 223         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 224         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 225                                       .len = 20-1 },
 226         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 227
 228         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 229         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 231         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 232         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 233
 234         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 235         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 236         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 237         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 238         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 239
 240         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 241         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 242         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 243
 244         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 245         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 246
 247         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 248         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 249                                     .len = WLAN_MAX_KEY_LEN },
 250         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 251         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 252         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 253         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 254         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 255
 256         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 257         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 258         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 259                                        .len = IEEE80211_MAX_DATA_LEN },
 260         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 261                                        .len = IEEE80211_MAX_DATA_LEN },
 262         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 263         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 264         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 265         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 266                                                .len = NL80211_MAX_SUPP_RATES },
 267         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 268         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 269         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 270         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 271                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 272         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 273
 274         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 275         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 276
 277         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 278         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 280         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 281                                            .len = NL80211_MAX_SUPP_RATES },
 282         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 283
 284         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 285         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 286
 287         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 288
 289         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 290         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 291                               .len = IEEE80211_MAX_DATA_LEN },
 292         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 293         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 294
 295         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 296                                 .len = IEEE80211_MAX_SSID_LEN },
 297         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 298         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 299         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 301         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 302         [NL80211_ATTR_STA_FLAGS2] = {
 303                 .len = sizeof(struct nl80211_sta_flag_update),
 304         },
 305         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 306         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 307         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 308         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 309         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 310         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 311         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 312         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 313         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 314                                  .len = WLAN_PMKID_LEN },
 315         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 316         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 317         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 318         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 319                                  .len = IEEE80211_MAX_DATA_LEN },
 320         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 321         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 323         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 325         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 326         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 328         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 329         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 330         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 331         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 332         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 333         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 335         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 336         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 337         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 338         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 339         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 340                                          .len = IEEE80211_MAX_DATA_LEN },
 341         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 342                                          .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 345         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 348         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 351         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 352         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 353                                       .len = IEEE80211_MAX_DATA_LEN },
 354         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 355         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 356         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 357                 .len = NL80211_HT_CAPABILITY_LEN
 358         },
 359         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 360         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 361         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 362         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 363         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 364         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 366         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 367         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 368         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 369         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 370         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 371 };
 372
 373 /* policy for the key attributes */
 374 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 375         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 376         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 377         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 378         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 379         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 380         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 381         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 382         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 383 };
 384
 385 /* policy for the key default flags */
 386 static const struct nla_policy
 387 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 388         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 389         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 390 };
 391
 392 /* policy for WoWLAN attributes */
 393 static const struct nla_policy
 394 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 395         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 396         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 397         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 398         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 399         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 400         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 401         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 402         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 403         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 404 };
 405
 406 static const struct nla_policy
 407 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 408         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 409         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 410         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 411         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 412         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 413         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 414         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 415                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 416         },
 417         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 418                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 419         },
 420         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 421         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 422         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 423 };
 424
 425 /* policy for GTK rekey offload attributes */
 426 static const struct nla_policy
 427 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 428         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 429         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 430         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 431 };
 432
 433 static const struct nla_policy
 434 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 435         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 436                                                  .len = IEEE80211_MAX_SSID_LEN },
 437         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 438 };
 439
 440 /* ifidx get helper */
 441 static int nl80211_get_ifidx(struct netlink_callback *cb)
 442 {
 443         int res;
 444
 445         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 446                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 447                           nl80211_policy);
 448         if (res)
 449                 return res;
 450
 451         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 452                 return -EINVAL;
 453
 454         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 455         if (!res)
 456                 return -EINVAL;
 457         return res;
 458 }
 459
 460 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 461                                        struct netlink_callback *cb,
 462                                        struct cfg80211_registered_device **rdev,
 463                                        struct net_device **dev)
 464 {
 465         int ifidx = cb->args[0];
 466         int err;
 467
 468         if (!ifidx)
 469                 ifidx = nl80211_get_ifidx(cb);
 470         if (ifidx < 0)
 471                 return ifidx;
 472
 473         cb->args[0] = ifidx;
 474
 475         rtnl_lock();
 476
 477         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 478         if (!*dev) {
 479                 err = -ENODEV;
 480                 goto out_rtnl;
 481         }
 482
 483         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 484         if (IS_ERR(*rdev)) {
 485                 err = PTR_ERR(*rdev);
 486                 goto out_rtnl;
 487         }
 488
 489         return 0;
 490  out_rtnl:
 491         rtnl_unlock();
 492         return err;
 493 }
 494
 495 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 496 {
 497         cfg80211_unlock_rdev(rdev);
 498         rtnl_unlock();
 499 }
 500
 501 /* IE validation */
 502 static bool is_valid_ie_attr(const struct nlattr *attr)
 503 {
 504         const u8 *pos;
 505         int len;
 506
 507         if (!attr)
 508                 return true;
 509
 510         pos = nla_data(attr);
 511         len = nla_len(attr);
 512
 513         while (len) {
 514                 u8 elemlen;
 515
 516                 if (len < 2)
 517                         return false;
 518                 len -= 2;
 519
 520                 elemlen = pos[1];
 521                 if (elemlen > len)
 522                         return false;
 523
 524                 len -= elemlen;
 525                 pos += 2 + elemlen;
 526         }
 527
 528         return true;
 529 }
 530
 531 /* message building helper */
 532 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 533                                    int flags, u8 cmd)
 534 {
 535         /* since there is no private header just add the generic one */
 536         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 537 }
 538
 539 static int nl80211_msg_put_channel(struct sk_buff *msg,
 540                                    struct ieee80211_channel *chan)
 541 {
 542         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 543                         chan->center_freq))
 544                 goto nla_put_failure;
 545
 546         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 547             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 548                 goto nla_put_failure;
 549         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 550             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 551                 goto nla_put_failure;
 552         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 553             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 554                 goto nla_put_failure;
 555         if (chan->flags & IEEE80211_CHAN_RADAR) {
 556                 u32 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 557                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 558                         goto nla_put_failure;
 559                 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 560                                 chan->dfs_state))
 561                         goto nla_put_failure;
 562                 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, time))
 563                         goto nla_put_failure;
 564         }
 565         if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 566             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 567                 goto nla_put_failure;
 568         if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 569             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 570                 goto nla_put_failure;
 571         if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 572             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 573                 goto nla_put_failure;
 574         if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 575             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 576                 goto nla_put_failure;
 577
 578         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 579                         DBM_TO_MBM(chan->max_power)))
 580                 goto nla_put_failure;
 581
 582         return 0;
 583
 584  nla_put_failure:
 585         return -ENOBUFS;
 586 }
 587
 588 /* netlink command implementations */
 589
 590 struct key_parse {
 591         struct key_params p;
 592         int idx;
 593         int type;
 594         bool def, defmgmt;
 595         bool def_uni, def_multi;
 596 };
 597
 598 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 599 {
 600         struct nlattr *tb[NL80211_KEY_MAX + 1];
 601         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 602                                    nl80211_key_policy);
 603         if (err)
 604                 return err;
 605
 606         k->def = !!tb[NL80211_KEY_DEFAULT];
 607         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 608
 609         if (k->def) {
 610                 k->def_uni = true;
 611                 k->def_multi = true;
 612         }
 613         if (k->defmgmt)
 614                 k->def_multi = true;
 615
 616         if (tb[NL80211_KEY_IDX])
 617                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 618
 619         if (tb[NL80211_KEY_DATA]) {
 620                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 621                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 622         }
 623
 624         if (tb[NL80211_KEY_SEQ]) {
 625                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 626                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 627         }
 628
 629         if (tb[NL80211_KEY_CIPHER])
 630                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 631
 632         if (tb[NL80211_KEY_TYPE]) {
 633                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 634                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 635                         return -EINVAL;
 636         }
 637
 638         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 639                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 640                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 641                                        tb[NL80211_KEY_DEFAULT_TYPES],
 642                                        nl80211_key_default_policy);
 643                 if (err)
 644                         return err;
 645
 646                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 647                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 648         }
 649
 650         return 0;
 651 }
 652
 653 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 654 {
 655         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 656                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 657                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 658         }
 659
 660         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 661                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 662                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 663         }
 664
 665         if (info->attrs[NL80211_ATTR_KEY_IDX])
 666                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 667
 668         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 669                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 670
 671         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 672         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 673
 674         if (k->def) {
 675                 k->def_uni = true;
 676                 k->def_multi = true;
 677         }
 678         if (k->defmgmt)
 679                 k->def_multi = true;
 680
 681         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 682                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 683                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 684                         return -EINVAL;
 685         }
 686
 687         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 688                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 689                 int err = nla_parse_nested(
 690                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 691                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 692                                 nl80211_key_default_policy);
 693                 if (err)
 694                         return err;
 695
 696                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 697                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 698         }
 699
 700         return 0;
 701 }
 702
 703 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 704 {
 705         int err;
 706
 707         memset(k, 0, sizeof(*k));
 708         k->idx = -1;
 709         k->type = -1;
 710
 711         if (info->attrs[NL80211_ATTR_KEY])
 712                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 713         else
 714                 err = nl80211_parse_key_old(info, k);
 715
 716         if (err)
 717                 return err;
 718
 719         if (k->def && k->defmgmt)
 720                 return -EINVAL;
 721
 722         if (k->defmgmt) {
 723                 if (k->def_uni || !k->def_multi)
 724                         return -EINVAL;
 725         }
 726
 727         if (k->idx != -1) {
 728                 if (k->defmgmt) {
 729                         if (k->idx < 4 || k->idx > 5)
 730                                 return -EINVAL;
 731                 } else if (k->def) {
 732                         if (k->idx < 0 || k->idx > 3)
 733                                 return -EINVAL;
 734                 } else {
 735                         if (k->idx < 0 || k->idx > 5)
 736                                 return -EINVAL;
 737                 }
 738         }
 739
 740         return 0;
 741 }
 742
 743 static struct cfg80211_cached_keys *
 744 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 745                        struct nlattr *keys, bool *no_ht)
 746 {
 747         struct key_parse parse;
 748         struct nlattr *key;
 749         struct cfg80211_cached_keys *result;
 750         int rem, err, def = 0;
 751
 752         result = kzalloc(sizeof(*result), GFP_KERNEL);
 753         if (!result)
 754                 return ERR_PTR(-ENOMEM);
 755
 756         result->def = -1;
 757         result->defmgmt = -1;
 758
 759         nla_for_each_nested(key, keys, rem) {
 760                 memset(&parse, 0, sizeof(parse));
 761                 parse.idx = -1;
 762
 763                 err = nl80211_parse_key_new(key, &parse);
 764                 if (err)
 765                         goto error;
 766                 err = -EINVAL;
 767                 if (!parse.p.key)
 768                         goto error;
 769                 if (parse.idx < 0 || parse.idx > 4)
 770                         goto error;
 771                 if (parse.def) {
 772                         if (def)
 773                                 goto error;
 774                         def = 1;
 775                         result->def = parse.idx;
 776                         if (!parse.def_uni || !parse.def_multi)
 777                                 goto error;
 778                 } else if (parse.defmgmt)
 779                         goto error;
 780                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 781                                                      parse.idx, false, NULL);
 782                 if (err)
 783                         goto error;
 784                 result->params[parse.idx].cipher = parse.p.cipher;
 785                 result->params[parse.idx].key_len = parse.p.key_len;
 786                 result->params[parse.idx].key = result->data[parse.idx];
 787                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 788
 789                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 790                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 791                         if (no_ht)
 792                                 *no_ht = true;
 793                 }
 794         }
 795
 796         return result;
 797  error:
 798         kfree(result);
 799         return ERR_PTR(err);
 800 }
 801
 802 static int nl80211_key_allowed(struct wireless_dev *wdev)
 803 {
 804         ASSERT_WDEV_LOCK(wdev);
 805
 806         switch (wdev->iftype) {
 807         case NL80211_IFTYPE_AP:
 808         case NL80211_IFTYPE_AP_VLAN:
 809         case NL80211_IFTYPE_P2P_GO:
 810         case NL80211_IFTYPE_MESH_POINT:
 811                 break;
 812         case NL80211_IFTYPE_ADHOC:
 813                 if (!wdev->current_bss)
 814                         return -ENOLINK;
 815                 break;
 816         case NL80211_IFTYPE_STATION:
 817         case NL80211_IFTYPE_P2P_CLIENT:
 818                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 819                         return -ENOLINK;
 820                 break;
 821         default:
 822                 return -EINVAL;
 823         }
 824
 825         return 0;
 826 }
 827
 828 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 829 {
 830         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 831         int i;
 832
 833         if (!nl_modes)
 834                 goto nla_put_failure;
 835
 836         i = 0;
 837         while (ifmodes) {
 838                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 839                         goto nla_put_failure;
 840                 ifmodes >>= 1;
 841                 i++;
 842         }
 843
 844         nla_nest_end(msg, nl_modes);
 845         return 0;
 846
 847 nla_put_failure:
 848         return -ENOBUFS;
 849 }
 850
 851 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 852                                           struct sk_buff *msg)
 853 {
 854         struct nlattr *nl_combis;
 855         int i, j;
 856
 857         nl_combis = nla_nest_start(msg,
 858                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 859         if (!nl_combis)
 860                 goto nla_put_failure;
 861
 862         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 863                 const struct ieee80211_iface_combination *c;
 864                 struct nlattr *nl_combi, *nl_limits;
 865
 866                 c = &wiphy->iface_combinations[i];
 867
 868                 nl_combi = nla_nest_start(msg, i + 1);
 869                 if (!nl_combi)
 870                         goto nla_put_failure;
 871
 872                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 873                 if (!nl_limits)
 874                         goto nla_put_failure;
 875
 876                 for (j = 0; j < c->n_limits; j++) {
 877                         struct nlattr *nl_limit;
 878
 879                         nl_limit = nla_nest_start(msg, j + 1);
 880                         if (!nl_limit)
 881                                 goto nla_put_failure;
 882                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 883                                         c->limits[j].max))
 884                                 goto nla_put_failure;
 885                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 886                                                 c->limits[j].types))
 887                                 goto nla_put_failure;
 888                         nla_nest_end(msg, nl_limit);
 889                 }
 890
 891                 nla_nest_end(msg, nl_limits);
 892
 893                 if (c->beacon_int_infra_match &&
 894                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 895                         goto nla_put_failure;
 896                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 897                                 c->num_different_channels) ||
 898                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 899                                 c->max_interfaces))
 900                         goto nla_put_failure;
 901                 if (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 902                                 c->radar_detect_widths))
 903                         goto nla_put_failure;
 904
 905                 nla_nest_end(msg, nl_combi);
 906         }
 907
 908         nla_nest_end(msg, nl_combis);
 909
 910         return 0;
 911 nla_put_failure:
 912         return -ENOBUFS;
 913 }
 914
 915 #ifdef CONFIG_PM
 916 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 917                                         struct sk_buff *msg)
 918 {
 919         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan.tcp;
 920         struct nlattr *nl_tcp;
 921
 922         if (!tcp)
 923                 return 0;
 924
 925         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 926         if (!nl_tcp)
 927                 return -ENOBUFS;
 928
 929         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 930                         tcp->data_payload_max))
 931                 return -ENOBUFS;
 932
 933         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 934                         tcp->data_payload_max))
 935                 return -ENOBUFS;
 936
 937         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 938                 return -ENOBUFS;
 939
 940         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 941                                 sizeof(*tcp->tok), tcp->tok))
 942                 return -ENOBUFS;
 943
 944         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 945                         tcp->data_interval_max))
 946                 return -ENOBUFS;
 947
 948         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 949                         tcp->wake_payload_max))
 950                 return -ENOBUFS;
 951
 952         nla_nest_end(msg, nl_tcp);
 953         return 0;
 954 }
 955 #endif
 956
 957 static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
 958                               struct cfg80211_registered_device *dev)
 959 {
 960         void *hdr;
 961         struct nlattr *nl_bands, *nl_band;
 962         struct nlattr *nl_freqs, *nl_freq;
 963         struct nlattr *nl_rates, *nl_rate;
 964         struct nlattr *nl_cmds;
 965         enum ieee80211_band band;
 966         struct ieee80211_channel *chan;
 967         struct ieee80211_rate *rate;
 968         int i;
 969         const struct ieee80211_txrx_stypes *mgmt_stypes =
 970                                 dev->wiphy.mgmt_stypes;
 971
 972         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
 973         if (!hdr)
 974                 return -1;
 975
 976         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
 977             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
 978             nla_put_u32(msg, NL80211_ATTR_GENERATION,
 979                         cfg80211_rdev_list_generation) ||
 980             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 981                        dev->wiphy.retry_short) ||
 982             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 983                        dev->wiphy.retry_long) ||
 984             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 985                         dev->wiphy.frag_threshold) ||
 986             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 987                         dev->wiphy.rts_threshold) ||
 988             nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 989                        dev->wiphy.coverage_class) ||
 990             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 991                        dev->wiphy.max_scan_ssids) ||
 992             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 993                        dev->wiphy.max_sched_scan_ssids) ||
 994             nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 995                         dev->wiphy.max_scan_ie_len) ||
 996             nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 997                         dev->wiphy.max_sched_scan_ie_len) ||
 998             nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 999                        dev->wiphy.max_match_sets))
1000                 goto nla_put_failure;
1001
1002         if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1003             nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1004                 goto nla_put_failure;
1005         if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1006             nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1007                 goto nla_put_failure;
1008         if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1009             nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1010                 goto nla_put_failure;
1011         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1012             nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1013                 goto nla_put_failure;
1014         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1015             nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1016                 goto nla_put_failure;
1017         if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1018             nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1019                 goto nla_put_failure;
1020
1021         if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1022                     sizeof(u32) * dev->wiphy.n_cipher_suites,
1023                     dev->wiphy.cipher_suites))
1024                 goto nla_put_failure;
1025
1026         if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1027                        dev->wiphy.max_num_pmkids))
1028                 goto nla_put_failure;
1029
1030         if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1031             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1032                 goto nla_put_failure;
1033
1034         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1035                         dev->wiphy.available_antennas_tx) ||
1036             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1037                         dev->wiphy.available_antennas_rx))
1038                 goto nla_put_failure;
1039
1040         if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1041             nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1042                         dev->wiphy.probe_resp_offload))
1043                 goto nla_put_failure;
1044
1045         if ((dev->wiphy.available_antennas_tx ||
1046              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
1047                 u32 tx_ant = 0, rx_ant = 0;
1048                 int res;
1049                 res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1050                 if (!res) {
1051                         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
1052                                         tx_ant) ||
1053                             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
1054                                         rx_ant))
1055                                 goto nla_put_failure;
1056                 }
1057         }
1058
1059         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1060                                 dev->wiphy.interface_modes))
1061                 goto nla_put_failure;
1062
1063         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1064         if (!nl_bands)
1065                 goto nla_put_failure;
1066
1067         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
1068                 if (!dev->wiphy.bands[band])
1069                         continue;
1070
1071                 nl_band = nla_nest_start(msg, band);
1072                 if (!nl_band)
1073                         goto nla_put_failure;
1074
1075                 /* add HT info */
1076                 if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
1077                     (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1078                              sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
1079                              &dev->wiphy.bands[band]->ht_cap.mcs) ||
1080                      nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1081                                  dev->wiphy.bands[band]->ht_cap.cap) ||
1082                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1083                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
1084                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1085                                 dev->wiphy.bands[band]->ht_cap.ampdu_density)))
1086                         goto nla_put_failure;
1087
1088                 /* add VHT info */
1089                 if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
1090                     (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1091                              sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
1092                              &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
1093                      nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1094                                  dev->wiphy.bands[band]->vht_cap.cap)))
1095                         goto nla_put_failure;
1096
1097                 /* add frequencies */
1098                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
1099                 if (!nl_freqs)
1100                         goto nla_put_failure;
1101
1102                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
1103                         nl_freq = nla_nest_start(msg, i);
1104                         if (!nl_freq)
1105                                 goto nla_put_failure;
1106
1107                         chan = &dev->wiphy.bands[band]->channels[i];
1108
1109                         if (nl80211_msg_put_channel(msg, chan))
1110                                 goto nla_put_failure;
1111
1112                         nla_nest_end(msg, nl_freq);
1113                 }
1114
1115                 nla_nest_end(msg, nl_freqs);
1116
1117                 /* add bitrates */
1118                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1119                 if (!nl_rates)
1120                         goto nla_put_failure;
1121
1122                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
1123                         nl_rate = nla_nest_start(msg, i);
1124                         if (!nl_rate)
1125                                 goto nla_put_failure;
1126
1127                         rate = &dev->wiphy.bands[band]->bitrates[i];
1128                         if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1129                                         rate->bitrate))
1130                                 goto nla_put_failure;
1131                         if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1132                             nla_put_flag(msg,
1133                                          NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1134                                 goto nla_put_failure;
1135
1136                         nla_nest_end(msg, nl_rate);
1137                 }
1138
1139                 nla_nest_end(msg, nl_rates);
1140
1141                 nla_nest_end(msg, nl_band);
1142         }
1143         nla_nest_end(msg, nl_bands);
1144
1145         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1146         if (!nl_cmds)
1147                 goto nla_put_failure;
1148
1149         i = 0;
1150 #define CMD(op, n)                                              \
1151          do {                                                   \
1152                 if (dev->ops->op) {                             \
1153                         i++;                                    \
1154                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1155                                 goto nla_put_failure;           \
1156                 }                                               \
1157         } while (0)
1158
1159         CMD(add_virtual_intf, NEW_INTERFACE);
1160         CMD(change_virtual_intf, SET_INTERFACE);
1161         CMD(add_key, NEW_KEY);
1162         CMD(start_ap, START_AP);
1163         CMD(add_station, NEW_STATION);
1164         CMD(add_mpath, NEW_MPATH);
1165         CMD(update_mesh_config, SET_MESH_CONFIG);
1166         CMD(change_bss, SET_BSS);
1167         CMD(auth, AUTHENTICATE);
1168         CMD(assoc, ASSOCIATE);
1169         CMD(deauth, DEAUTHENTICATE);
1170         CMD(disassoc, DISASSOCIATE);
1171         CMD(join_ibss, JOIN_IBSS);
1172         CMD(join_mesh, JOIN_MESH);
1173         CMD(set_pmksa, SET_PMKSA);
1174         CMD(del_pmksa, DEL_PMKSA);
1175         CMD(flush_pmksa, FLUSH_PMKSA);
1176         if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1177                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1178         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1179         CMD(mgmt_tx, FRAME);
1180         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1181         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1182                 i++;
1183                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1184                         goto nla_put_failure;
1185         }
1186         if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1187             dev->ops->join_mesh) {
1188                 i++;
1189                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1190                         goto nla_put_failure;
1191         }
1192         CMD(set_wds_peer, SET_WDS_PEER);
1193         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1194                 CMD(tdls_mgmt, TDLS_MGMT);
1195                 CMD(tdls_oper, TDLS_OPER);
1196         }
1197         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1198                 CMD(sched_scan_start, START_SCHED_SCAN);
1199         CMD(probe_client, PROBE_CLIENT);
1200         CMD(set_noack_map, SET_NOACK_MAP);
1201         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1202                 i++;
1203                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1204                         goto nla_put_failure;
1205         }
1206         CMD(start_p2p_device, START_P2P_DEVICE);
1207         CMD(set_mcast_rate, SET_MCAST_RATE);
1208
1209 #ifdef CONFIG_NL80211_TESTMODE
1210         CMD(testmode_cmd, TESTMODE);
1211 #endif
1212
1213 #undef CMD
1214
1215         if (dev->ops->connect || dev->ops->auth) {
1216                 i++;
1217                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1218                         goto nla_put_failure;
1219         }
1220
1221         if (dev->ops->disconnect || dev->ops->deauth) {
1222                 i++;
1223                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1224                         goto nla_put_failure;
1225         }
1226
1227         nla_nest_end(msg, nl_cmds);
1228
1229         if (dev->ops->remain_on_channel &&
1230             (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1231             nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1232                         dev->wiphy.max_remain_on_channel_duration))
1233                 goto nla_put_failure;
1234
1235         if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1236             nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1237                 goto nla_put_failure;
1238
1239         if (mgmt_stypes) {
1240                 u16 stypes;
1241                 struct nlattr *nl_ftypes, *nl_ifs;
1242                 enum nl80211_iftype ift;
1243
1244                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1245                 if (!nl_ifs)
1246                         goto nla_put_failure;
1247
1248                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1249                         nl_ftypes = nla_nest_start(msg, ift);
1250                         if (!nl_ftypes)
1251                                 goto nla_put_failure;
1252                         i = 0;
1253                         stypes = mgmt_stypes[ift].tx;
1254                         while (stypes) {
1255                                 if ((stypes & 1) &&
1256                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1257                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1258                                         goto nla_put_failure;
1259                                 stypes >>= 1;
1260                                 i++;
1261                         }
1262                         nla_nest_end(msg, nl_ftypes);
1263                 }
1264
1265                 nla_nest_end(msg, nl_ifs);
1266
1267                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1268                 if (!nl_ifs)
1269                         goto nla_put_failure;
1270
1271                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1272                         nl_ftypes = nla_nest_start(msg, ift);
1273                         if (!nl_ftypes)
1274                                 goto nla_put_failure;
1275                         i = 0;
1276                         stypes = mgmt_stypes[ift].rx;
1277                         while (stypes) {
1278                                 if ((stypes & 1) &&
1279                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1280                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1281                                         goto nla_put_failure;
1282                                 stypes >>= 1;
1283                                 i++;
1284                         }
1285                         nla_nest_end(msg, nl_ftypes);
1286                 }
1287                 nla_nest_end(msg, nl_ifs);
1288         }
1289
1290 #ifdef CONFIG_PM
1291         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
1292                 struct nlattr *nl_wowlan;
1293
1294                 nl_wowlan = nla_nest_start(msg,
1295                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1296                 if (!nl_wowlan)
1297                         goto nla_put_failure;
1298
1299                 if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1300                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1301                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1302                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1303                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1304                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1305                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1306                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1307                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1308                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1309                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1310                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1311                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1312                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1313                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1314                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1315                     goto nla_put_failure;
1316                 if (dev->wiphy.wowlan.n_patterns) {
1317                         struct nl80211_wowlan_pattern_support pat = {
1318                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
1319                                 .min_pattern_len =
1320                                         dev->wiphy.wowlan.pattern_min_len,
1321                                 .max_pattern_len =
1322                                         dev->wiphy.wowlan.pattern_max_len,
1323                                 .max_pkt_offset =
1324                                         dev->wiphy.wowlan.max_pkt_offset,
1325                         };
1326                         if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1327                                     sizeof(pat), &pat))
1328                                 goto nla_put_failure;
1329                 }
1330
1331                 if (nl80211_send_wowlan_tcp_caps(dev, msg))
1332                         goto nla_put_failure;
1333
1334                 nla_nest_end(msg, nl_wowlan);
1335         }
1336 #endif
1337
1338         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1339                                 dev->wiphy.software_iftypes))
1340                 goto nla_put_failure;
1341
1342         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1343                 goto nla_put_failure;
1344
1345         if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1346             nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1347                         dev->wiphy.ap_sme_capa))
1348                 goto nla_put_failure;
1349
1350         if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
1351                         dev->wiphy.features))
1352                 goto nla_put_failure;
1353
1354         if (dev->wiphy.ht_capa_mod_mask &&
1355             nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1356                     sizeof(*dev->wiphy.ht_capa_mod_mask),
1357                     dev->wiphy.ht_capa_mod_mask))
1358                 goto nla_put_failure;
1359
1360         if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1361             dev->wiphy.max_acl_mac_addrs &&
1362             nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1363                         dev->wiphy.max_acl_mac_addrs))
1364                 goto nla_put_failure;
1365
1366         return genlmsg_end(msg, hdr);
1367
1368  nla_put_failure:
1369         genlmsg_cancel(msg, hdr);
1370         return -EMSGSIZE;
1371 }
1372
1373 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1374 {
1375         int idx = 0;
1376         int start = cb->args[0];
1377         struct cfg80211_registered_device *dev;
1378
1379         mutex_lock(&cfg80211_mutex);
1380         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1381                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1382                         continue;
1383                 if (++idx <= start)
1384                         continue;
1385                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).portid,
1386                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1387                                        dev) < 0) {
1388                         idx--;
1389                         break;
1390                 }
1391         }
1392         mutex_unlock(&cfg80211_mutex);
1393
1394         cb->args[0] = idx;
1395
1396         return skb->len;
1397 }
1398
1399 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1400 {
1401         struct sk_buff *msg;
1402         struct cfg80211_registered_device *dev = info->user_ptr[0];
1403
1404         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1405         if (!msg)
1406                 return -ENOMEM;
1407
1408         if (nl80211_send_wiphy(msg, info->snd_portid, info->snd_seq, 0, dev) < 0) {
1409                 nlmsg_free(msg);
1410                 return -ENOBUFS;
1411         }
1412
1413         return genlmsg_reply(msg, info);
1414 }
1415
1416 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1417         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1418         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1419         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1420         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1421         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1422 };
1423
1424 static int parse_txq_params(struct nlattr *tb[],
1425                             struct ieee80211_txq_params *txq_params)
1426 {
1427         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1428             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1429             !tb[NL80211_TXQ_ATTR_AIFS])
1430                 return -EINVAL;
1431
1432         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1433         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1434         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1435         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1436         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1437
1438         if (txq_params->ac >= NL80211_NUM_ACS)
1439                 return -EINVAL;
1440
1441         return 0;
1442 }
1443
1444 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1445 {
1446         /*
1447          * You can only set the channel explicitly for WDS interfaces,
1448          * all others have their channel managed via their respective
1449          * "establish a connection" command (connect, join, ...)
1450          *
1451          * For AP/GO and mesh mode, the channel can be set with the
1452          * channel userspace API, but is only stored and passed to the
1453          * low-level driver when the AP starts or the mesh is joined.
1454          * This is for backward compatibility, userspace can also give
1455          * the channel in the start-ap or join-mesh commands instead.
1456          *
1457          * Monitors are special as they are normally slaved to
1458          * whatever else is going on, so they have their own special
1459          * operation to set the monitor channel if possible.
1460          */
1461         return !wdev ||
1462                 wdev->iftype == NL80211_IFTYPE_AP ||
1463                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1464                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1465                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1466 }
1467
1468 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1469                                  struct genl_info *info,
1470                                  struct cfg80211_chan_def *chandef)
1471 {
1472         u32 control_freq;
1473
1474         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1475                 return -EINVAL;
1476
1477         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1478
1479         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1480         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1481         chandef->center_freq1 = control_freq;
1482         chandef->center_freq2 = 0;
1483
1484         /* Primary channel not allowed */
1485         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1486                 return -EINVAL;
1487
1488         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1489                 enum nl80211_channel_type chantype;
1490
1491                 chantype = nla_get_u32(
1492                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1493
1494                 switch (chantype) {
1495                 case NL80211_CHAN_NO_HT:
1496                 case NL80211_CHAN_HT20:
1497                 case NL80211_CHAN_HT40PLUS:
1498                 case NL80211_CHAN_HT40MINUS:
1499                         cfg80211_chandef_create(chandef, chandef->chan,
1500                                                 chantype);
1501                         break;
1502                 default:
1503                         return -EINVAL;
1504                 }
1505         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1506                 chandef->width =
1507                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1508                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1509                         chandef->center_freq1 =
1510                                 nla_get_u32(
1511                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1512                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1513                         chandef->center_freq2 =
1514                                 nla_get_u32(
1515                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1516         }
1517
1518         if (!cfg80211_chandef_valid(chandef))
1519                 return -EINVAL;
1520
1521         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1522                                      IEEE80211_CHAN_DISABLED))
1523                 return -EINVAL;
1524
1525         return 0;
1526 }
1527
1528 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1529                                  struct wireless_dev *wdev,
1530                                  struct genl_info *info)
1531 {
1532         struct cfg80211_chan_def chandef;
1533         int result;
1534         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1535
1536         if (wdev)
1537                 iftype = wdev->iftype;
1538
1539         if (!nl80211_can_set_dev_channel(wdev))
1540                 return -EOPNOTSUPP;
1541
1542         result = nl80211_parse_chandef(rdev, info, &chandef);
1543         if (result)
1544                 return result;
1545
1546         mutex_lock(&rdev->devlist_mtx);
1547         switch (iftype) {
1548         case NL80211_IFTYPE_AP:
1549         case NL80211_IFTYPE_P2P_GO:
1550                 if (wdev->beacon_interval) {
1551                         result = -EBUSY;
1552                         break;
1553                 }
1554                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1555                         result = -EINVAL;
1556                         break;
1557                 }
1558                 wdev->preset_chandef = chandef;
1559                 result = 0;
1560                 break;
1561         case NL80211_IFTYPE_MESH_POINT:
1562                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1563                 break;
1564         case NL80211_IFTYPE_MONITOR:
1565                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1566                 break;
1567         default:
1568                 result = -EINVAL;
1569         }
1570         mutex_unlock(&rdev->devlist_mtx);
1571
1572         return result;
1573 }
1574
1575 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1576 {
1577         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1578         struct net_device *netdev = info->user_ptr[1];
1579
1580         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1581 }
1582
1583 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1584 {
1585         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1586         struct net_device *dev = info->user_ptr[1];
1587         struct wireless_dev *wdev = dev->ieee80211_ptr;
1588         const u8 *bssid;
1589
1590         if (!info->attrs[NL80211_ATTR_MAC])
1591                 return -EINVAL;
1592
1593         if (netif_running(dev))
1594                 return -EBUSY;
1595
1596         if (!rdev->ops->set_wds_peer)
1597                 return -EOPNOTSUPP;
1598
1599         if (wdev->iftype != NL80211_IFTYPE_WDS)
1600                 return -EOPNOTSUPP;
1601
1602         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1603         return rdev_set_wds_peer(rdev, dev, bssid);
1604 }
1605
1606
1607 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1608 {
1609         struct cfg80211_registered_device *rdev;
1610         struct net_device *netdev = NULL;
1611         struct wireless_dev *wdev;
1612         int result = 0, rem_txq_params = 0;
1613         struct nlattr *nl_txq_params;
1614         u32 changed;
1615         u8 retry_short = 0, retry_long = 0;
1616         u32 frag_threshold = 0, rts_threshold = 0;
1617         u8 coverage_class = 0;
1618
1619         /*
1620          * Try to find the wiphy and netdev. Normally this
1621          * function shouldn't need the netdev, but this is
1622          * done for backward compatibility -- previously
1623          * setting the channel was done per wiphy, but now
1624          * it is per netdev. Previous userland like hostapd
1625          * also passed a netdev to set_wiphy, so that it is
1626          * possible to let that go to the right netdev!
1627          */
1628         mutex_lock(&cfg80211_mutex);
1629
1630         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1631                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1632
1633                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1634                 if (netdev && netdev->ieee80211_ptr) {
1635                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1636                         mutex_lock(&rdev->mtx);
1637                 } else
1638                         netdev = NULL;
1639         }
1640
1641         if (!netdev) {
1642                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1643                                                   info->attrs);
1644                 if (IS_ERR(rdev)) {
1645                         mutex_unlock(&cfg80211_mutex);
1646                         return PTR_ERR(rdev);
1647                 }
1648                 wdev = NULL;
1649                 netdev = NULL;
1650                 result = 0;
1651
1652                 mutex_lock(&rdev->mtx);
1653         } else
1654                 wdev = netdev->ieee80211_ptr;
1655
1656         /*
1657          * end workaround code, by now the rdev is available
1658          * and locked, and wdev may or may not be NULL.
1659          */
1660
1661         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1662                 result = cfg80211_dev_rename(
1663                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1664
1665         mutex_unlock(&cfg80211_mutex);
1666
1667         if (result)
1668                 goto bad_res;
1669
1670         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1671                 struct ieee80211_txq_params txq_params;
1672                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1673
1674                 if (!rdev->ops->set_txq_params) {
1675                         result = -EOPNOTSUPP;
1676                         goto bad_res;
1677                 }
1678
1679                 if (!netdev) {
1680                         result = -EINVAL;
1681                         goto bad_res;
1682                 }
1683
1684                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1685                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1686                         result = -EINVAL;
1687                         goto bad_res;
1688                 }
1689
1690                 if (!netif_running(netdev)) {
1691                         result = -ENETDOWN;
1692                         goto bad_res;
1693                 }
1694
1695                 nla_for_each_nested(nl_txq_params,
1696                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1697                                     rem_txq_params) {
1698                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1699                                   nla_data(nl_txq_params),
1700                                   nla_len(nl_txq_params),
1701                                   txq_params_policy);
1702                         result = parse_txq_params(tb, &txq_params);
1703                         if (result)
1704                                 goto bad_res;
1705
1706                         result = rdev_set_txq_params(rdev, netdev,
1707                                                      &txq_params);
1708                         if (result)
1709                                 goto bad_res;
1710                 }
1711         }
1712
1713         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1714                 result = __nl80211_set_channel(rdev,
1715                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1716                                 info);
1717                 if (result)
1718                         goto bad_res;
1719         }
1720
1721         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1722                 struct wireless_dev *txp_wdev = wdev;
1723                 enum nl80211_tx_power_setting type;
1724                 int idx, mbm = 0;
1725
1726                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1727                         txp_wdev = NULL;
1728
1729                 if (!rdev->ops->set_tx_power) {
1730                         result = -EOPNOTSUPP;
1731                         goto bad_res;
1732                 }
1733
1734                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1735                 type = nla_get_u32(info->attrs[idx]);
1736
1737                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1738                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1739                         result = -EINVAL;
1740                         goto bad_res;
1741                 }
1742
1743                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1744                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1745                         mbm = nla_get_u32(info->attrs[idx]);
1746                 }
1747
1748                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1749                 if (result)
1750                         goto bad_res;
1751         }
1752
1753         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1754             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1755                 u32 tx_ant, rx_ant;
1756                 if ((!rdev->wiphy.available_antennas_tx &&
1757                      !rdev->wiphy.available_antennas_rx) ||
1758                     !rdev->ops->set_antenna) {
1759                         result = -EOPNOTSUPP;
1760                         goto bad_res;
1761                 }
1762
1763                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1764                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1765
1766                 /* reject antenna configurations which don't match the
1767                  * available antenna masks, except for the "all" mask */
1768                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1769                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1770                         result = -EINVAL;
1771                         goto bad_res;
1772                 }
1773
1774                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1775                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1776
1777                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
1778                 if (result)
1779                         goto bad_res;
1780         }
1781
1782         changed = 0;
1783
1784         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1785                 retry_short = nla_get_u8(
1786                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1787                 if (retry_short == 0) {
1788                         result = -EINVAL;
1789                         goto bad_res;
1790                 }
1791                 changed |= WIPHY_PARAM_RETRY_SHORT;
1792         }
1793
1794         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1795                 retry_long = nla_get_u8(
1796                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1797                 if (retry_long == 0) {
1798                         result = -EINVAL;
1799                         goto bad_res;
1800                 }
1801                 changed |= WIPHY_PARAM_RETRY_LONG;
1802         }
1803
1804         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1805                 frag_threshold = nla_get_u32(
1806                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1807                 if (frag_threshold < 256) {
1808                         result = -EINVAL;
1809                         goto bad_res;
1810                 }
1811                 if (frag_threshold != (u32) -1) {
1812                         /*
1813                          * Fragments (apart from the last one) are required to
1814                          * have even length. Make the fragmentation code
1815                          * simpler by stripping LSB should someone try to use
1816                          * odd threshold value.
1817                          */
1818                         frag_threshold &= ~0x1;
1819                 }
1820                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1821         }
1822
1823         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1824                 rts_threshold = nla_get_u32(
1825                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1826                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1827         }
1828
1829         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1830                 coverage_class = nla_get_u8(
1831                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1832                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1833         }
1834
1835         if (changed) {
1836                 u8 old_retry_short, old_retry_long;
1837                 u32 old_frag_threshold, old_rts_threshold;
1838                 u8 old_coverage_class;
1839
1840                 if (!rdev->ops->set_wiphy_params) {
1841                         result = -EOPNOTSUPP;
1842                         goto bad_res;
1843                 }
1844
1845                 old_retry_short = rdev->wiphy.retry_short;
1846                 old_retry_long = rdev->wiphy.retry_long;
1847                 old_frag_threshold = rdev->wiphy.frag_threshold;
1848                 old_rts_threshold = rdev->wiphy.rts_threshold;
1849                 old_coverage_class = rdev->wiphy.coverage_class;
1850
1851                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1852                         rdev->wiphy.retry_short = retry_short;
1853                 if (changed & WIPHY_PARAM_RETRY_LONG)
1854                         rdev->wiphy.retry_long = retry_long;
1855                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1856                         rdev->wiphy.frag_threshold = frag_threshold;
1857                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1858                         rdev->wiphy.rts_threshold = rts_threshold;
1859                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1860                         rdev->wiphy.coverage_class = coverage_class;
1861
1862                 result = rdev_set_wiphy_params(rdev, changed);
1863                 if (result) {
1864                         rdev->wiphy.retry_short = old_retry_short;
1865                         rdev->wiphy.retry_long = old_retry_long;
1866                         rdev->wiphy.frag_threshold = old_frag_threshold;
1867                         rdev->wiphy.rts_threshold = old_rts_threshold;
1868                         rdev->wiphy.coverage_class = old_coverage_class;
1869                 }
1870         }
1871
1872  bad_res:
1873         mutex_unlock(&rdev->mtx);
1874         if (netdev)
1875                 dev_put(netdev);
1876         return result;
1877 }
1878
1879 static inline u64 wdev_id(struct wireless_dev *wdev)
1880 {
1881         return (u64)wdev->identifier |
1882                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
1883 }
1884
1885 static int nl80211_send_chandef(struct sk_buff *msg,
1886                                  struct cfg80211_chan_def *chandef)
1887 {
1888         WARN_ON(!cfg80211_chandef_valid(chandef));
1889
1890         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
1891                         chandef->chan->center_freq))
1892                 return -ENOBUFS;
1893         switch (chandef->width) {
1894         case NL80211_CHAN_WIDTH_20_NOHT:
1895         case NL80211_CHAN_WIDTH_20:
1896         case NL80211_CHAN_WIDTH_40:
1897                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
1898                                 cfg80211_get_chandef_type(chandef)))
1899                         return -ENOBUFS;
1900                 break;
1901         default:
1902                 break;
1903         }
1904         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
1905                 return -ENOBUFS;
1906         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
1907                 return -ENOBUFS;
1908         if (chandef->center_freq2 &&
1909             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
1910                 return -ENOBUFS;
1911         return 0;
1912 }
1913
1914 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
1915                               struct cfg80211_registered_device *rdev,
1916                               struct wireless_dev *wdev)
1917 {
1918         struct net_device *dev = wdev->netdev;
1919         void *hdr;
1920
1921         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1922         if (!hdr)
1923                 return -1;
1924
1925         if (dev &&
1926             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
1927              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
1928                 goto nla_put_failure;
1929
1930         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1931             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
1932             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
1933             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
1934             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1935                         rdev->devlist_generation ^
1936                         (cfg80211_rdev_list_generation << 2)))
1937                 goto nla_put_failure;
1938
1939         if (rdev->ops->get_channel) {
1940                 int ret;
1941                 struct cfg80211_chan_def chandef;
1942
1943                 ret = rdev_get_channel(rdev, wdev, &chandef);
1944                 if (ret == 0) {
1945                         if (nl80211_send_chandef(msg, &chandef))
1946                                 goto nla_put_failure;
1947                 }
1948         }
1949
1950         if (wdev->ssid_len) {
1951                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
1952                         goto nla_put_failure;
1953         }
1954
1955         return genlmsg_end(msg, hdr);
1956
1957  nla_put_failure:
1958         genlmsg_cancel(msg, hdr);
1959         return -EMSGSIZE;
1960 }
1961
1962 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1963 {
1964         int wp_idx = 0;
1965         int if_idx = 0;
1966         int wp_start = cb->args[0];
1967         int if_start = cb->args[1];
1968         struct cfg80211_registered_device *rdev;
1969         struct wireless_dev *wdev;
1970
1971         mutex_lock(&cfg80211_mutex);
1972         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1973                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1974                         continue;
1975                 if (wp_idx < wp_start) {
1976                         wp_idx++;
1977                         continue;
1978                 }
1979                 if_idx = 0;
1980
1981                 mutex_lock(&rdev->devlist_mtx);
1982                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
1983                         if (if_idx < if_start) {
1984                                 if_idx++;
1985                                 continue;
1986                         }
1987                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
1988                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1989                                                rdev, wdev) < 0) {
1990                                 mutex_unlock(&rdev->devlist_mtx);
1991                                 goto out;
1992                         }
1993                         if_idx++;
1994                 }
1995                 mutex_unlock(&rdev->devlist_mtx);
1996
1997                 wp_idx++;
1998         }
1999  out:
2000         mutex_unlock(&cfg80211_mutex);
2001
2002         cb->args[0] = wp_idx;
2003         cb->args[1] = if_idx;
2004
2005         return skb->len;
2006 }
2007
2008 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2009 {
2010         struct sk_buff *msg;
2011         struct cfg80211_registered_device *dev = info->user_ptr[0];
2012         struct wireless_dev *wdev = info->user_ptr[1];
2013
2014         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2015         if (!msg)
2016                 return -ENOMEM;
2017
2018         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2019                                dev, wdev) < 0) {
2020                 nlmsg_free(msg);
2021                 return -ENOBUFS;
2022         }
2023
2024         return genlmsg_reply(msg, info);
2025 }
2026
2027 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2028         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2029         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2030         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2031         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2032         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2033 };
2034
2035 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2036 {
2037         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2038         int flag;
2039
2040         *mntrflags = 0;
2041
2042         if (!nla)
2043                 return -EINVAL;
2044
2045         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2046                              nla, mntr_flags_policy))
2047                 return -EINVAL;
2048
2049         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2050                 if (flags[flag])
2051                         *mntrflags |= (1<<flag);
2052
2053         return 0;
2054 }
2055
2056 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2057                                struct net_device *netdev, u8 use_4addr,
2058                                enum nl80211_iftype iftype)
2059 {
2060         if (!use_4addr) {
2061                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2062                         return -EBUSY;
2063                 return 0;
2064         }
2065
2066         switch (iftype) {
2067         case NL80211_IFTYPE_AP_VLAN:
2068                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2069                         return 0;
2070                 break;
2071         case NL80211_IFTYPE_STATION:
2072                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2073                         return 0;
2074                 break;
2075         default:
2076                 break;
2077         }
2078
2079         return -EOPNOTSUPP;
2080 }
2081
2082 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2083 {
2084         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2085         struct vif_params params;
2086         int err;
2087         enum nl80211_iftype otype, ntype;
2088         struct net_device *dev = info->user_ptr[1];
2089         u32 _flags, *flags = NULL;
2090         bool change = false;
2091
2092         memset(&params, 0, sizeof(params));
2093
2094         otype = ntype = dev->ieee80211_ptr->iftype;
2095
2096         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2097                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2098                 if (otype != ntype)
2099                         change = true;
2100                 if (ntype > NL80211_IFTYPE_MAX)
2101                         return -EINVAL;
2102         }
2103
2104         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2105                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2106
2107                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2108                         return -EINVAL;
2109                 if (netif_running(dev))
2110                         return -EBUSY;
2111
2112                 wdev_lock(wdev);
2113                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2114                              IEEE80211_MAX_MESH_ID_LEN);
2115                 wdev->mesh_id_up_len =
2116                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2117                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2118                        wdev->mesh_id_up_len);
2119                 wdev_unlock(wdev);
2120         }
2121
2122         if (info->attrs[NL80211_ATTR_4ADDR]) {
2123                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2124                 change = true;
2125                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2126                 if (err)
2127                         return err;
2128         } else {
2129                 params.use_4addr = -1;
2130         }
2131
2132         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2133                 if (ntype != NL80211_IFTYPE_MONITOR)
2134                         return -EINVAL;
2135                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2136                                           &_flags);
2137                 if (err)
2138                         return err;
2139
2140                 flags = &_flags;
2141                 change = true;
2142         }
2143
2144         if (change)
2145                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2146         else
2147                 err = 0;
2148
2149         if (!err && params.use_4addr != -1)
2150                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2151
2152         return err;
2153 }
2154
2155 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2156 {
2157         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2158         struct vif_params params;
2159         struct wireless_dev *wdev;
2160         struct sk_buff *msg;
2161         int err;
2162         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2163         u32 flags;
2164
2165         memset(&params, 0, sizeof(params));
2166
2167         if (!info->attrs[NL80211_ATTR_IFNAME])
2168                 return -EINVAL;
2169
2170         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2171                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2172                 if (type > NL80211_IFTYPE_MAX)
2173                         return -EINVAL;
2174         }
2175
2176         if (!rdev->ops->add_virtual_intf ||
2177             !(rdev->wiphy.interface_modes & (1 << type)))
2178                 return -EOPNOTSUPP;
2179
2180         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2181                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2182                            ETH_ALEN);
2183                 if (!is_valid_ether_addr(params.macaddr))
2184                         return -EADDRNOTAVAIL;
2185         }
2186
2187         if (info->attrs[NL80211_ATTR_4ADDR]) {
2188                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2189                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2190                 if (err)
2191                         return err;
2192         }
2193
2194         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2195         if (!msg)
2196                 return -ENOMEM;
2197
2198         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2199                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2200                                   &flags);
2201         wdev = rdev_add_virtual_intf(rdev,
2202                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2203                                 type, err ? NULL : &flags, &params);
2204         if (IS_ERR(wdev)) {
2205                 nlmsg_free(msg);
2206                 return PTR_ERR(wdev);
2207         }
2208
2209         switch (type) {
2210         case NL80211_IFTYPE_MESH_POINT:
2211                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2212                         break;
2213                 wdev_lock(wdev);
2214                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2215                              IEEE80211_MAX_MESH_ID_LEN);
2216                 wdev->mesh_id_up_len =
2217                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2218                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2219                        wdev->mesh_id_up_len);
2220                 wdev_unlock(wdev);
2221                 break;
2222         case NL80211_IFTYPE_P2P_DEVICE:
2223                 /*
2224                  * P2P Device doesn't have a netdev, so doesn't go
2225                  * through the netdev notifier and must be added here
2226                  */
2227                 mutex_init(&wdev->mtx);
2228                 INIT_LIST_HEAD(&wdev->event_list);
2229                 spin_lock_init(&wdev->event_lock);
2230                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2231                 spin_lock_init(&wdev->mgmt_registrations_lock);
2232
2233                 mutex_lock(&rdev->devlist_mtx);
2234                 wdev->identifier = ++rdev->wdev_id;
2235                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2236                 rdev->devlist_generation++;
2237                 mutex_unlock(&rdev->devlist_mtx);
2238                 break;
2239         default:
2240                 break;
2241         }
2242
2243         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2244                                rdev, wdev) < 0) {
2245                 nlmsg_free(msg);
2246                 return -ENOBUFS;
2247         }
2248
2249         return genlmsg_reply(msg, info);
2250 }
2251
2252 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2253 {
2254         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2255         struct wireless_dev *wdev = info->user_ptr[1];
2256
2257         if (!rdev->ops->del_virtual_intf)
2258                 return -EOPNOTSUPP;
2259
2260         /*
2261          * If we remove a wireless device without a netdev then clear
2262          * user_ptr[1] so that nl80211_post_doit won't dereference it
2263          * to check if it needs to do dev_put(). Otherwise it crashes
2264          * since the wdev has been freed, unlike with a netdev where
2265          * we need the dev_put() for the netdev to really be freed.
2266          */
2267         if (!wdev->netdev)
2268                 info->user_ptr[1] = NULL;
2269
2270         return rdev_del_virtual_intf(rdev, wdev);
2271 }
2272
2273 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2274 {
2275         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2276         struct net_device *dev = info->user_ptr[1];
2277         u16 noack_map;
2278
2279         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2280                 return -EINVAL;
2281
2282         if (!rdev->ops->set_noack_map)
2283                 return -EOPNOTSUPP;
2284
2285         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2286
2287         return rdev_set_noack_map(rdev, dev, noack_map);
2288 }
2289
2290 struct get_key_cookie {
2291         struct sk_buff *msg;
2292         int error;
2293         int idx;
2294 };
2295
2296 static void get_key_callback(void *c, struct key_params *params)
2297 {
2298         struct nlattr *key;
2299         struct get_key_cookie *cookie = c;
2300
2301         if ((params->key &&
2302              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2303                      params->key_len, params->key)) ||
2304             (params->seq &&
2305              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2306                      params->seq_len, params->seq)) ||
2307             (params->cipher &&
2308              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2309                          params->cipher)))
2310                 goto nla_put_failure;
2311
2312         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2313         if (!key)
2314                 goto nla_put_failure;
2315
2316         if ((params->key &&
2317              nla_put(cookie->msg, NL80211_KEY_DATA,
2318                      params->key_len, params->key)) ||
2319             (params->seq &&
2320              nla_put(cookie->msg, NL80211_KEY_SEQ,
2321                      params->seq_len, params->seq)) ||
2322             (params->cipher &&
2323              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2324                          params->cipher)))
2325                 goto nla_put_failure;
2326
2327         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2328                 goto nla_put_failure;
2329
2330         nla_nest_end(cookie->msg, key);
2331
2332         return;
2333  nla_put_failure:
2334         cookie->error = 1;
2335 }
2336
2337 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2338 {
2339         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2340         int err;
2341         struct net_device *dev = info->user_ptr[1];
2342         u8 key_idx = 0;
2343         const u8 *mac_addr = NULL;
2344         bool pairwise;
2345         struct get_key_cookie cookie = {
2346                 .error = 0,
2347         };
2348         void *hdr;
2349         struct sk_buff *msg;
2350
2351         if (info->attrs[NL80211_ATTR_KEY_IDX])
2352                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2353
2354         if (key_idx > 5)
2355                 return -EINVAL;
2356
2357         if (info->attrs[NL80211_ATTR_MAC])
2358                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2359
2360         pairwise = !!mac_addr;
2361         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2362                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2363                 if (kt >= NUM_NL80211_KEYTYPES)
2364                         return -EINVAL;
2365                 if (kt != NL80211_KEYTYPE_GROUP &&
2366                     kt != NL80211_KEYTYPE_PAIRWISE)
2367                         return -EINVAL;
2368                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2369         }
2370
2371         if (!rdev->ops->get_key)
2372                 return -EOPNOTSUPP;
2373
2374         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2375         if (!msg)
2376                 return -ENOMEM;
2377
2378         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2379                              NL80211_CMD_NEW_KEY);
2380         if (IS_ERR(hdr))
2381                 return PTR_ERR(hdr);
2382
2383         cookie.msg = msg;
2384         cookie.idx = key_idx;
2385
2386         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2387             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2388                 goto nla_put_failure;
2389         if (mac_addr &&
2390             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2391                 goto nla_put_failure;
2392
2393         if (pairwise && mac_addr &&
2394             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2395                 return -ENOENT;
2396
2397         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2398                            get_key_callback);
2399
2400         if (err)
2401                 goto free_msg;
2402
2403         if (cookie.error)
2404                 goto nla_put_failure;
2405
2406         genlmsg_end(msg, hdr);
2407         return genlmsg_reply(msg, info);
2408
2409  nla_put_failure:
2410         err = -ENOBUFS;
2411  free_msg:
2412         nlmsg_free(msg);
2413         return err;
2414 }
2415
2416 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2417 {
2418         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2419         struct key_parse key;
2420         int err;
2421         struct net_device *dev = info->user_ptr[1];
2422
2423         err = nl80211_parse_key(info, &key);
2424         if (err)
2425                 return err;
2426
2427         if (key.idx < 0)
2428                 return -EINVAL;
2429
2430         /* only support setting default key */
2431         if (!key.def && !key.defmgmt)
2432                 return -EINVAL;
2433
2434         wdev_lock(dev->ieee80211_ptr);
2435
2436         if (key.def) {
2437                 if (!rdev->ops->set_default_key) {
2438                         err = -EOPNOTSUPP;
2439                         goto out;
2440                 }
2441
2442                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2443                 if (err)
2444                         goto out;
2445
2446                 err = rdev_set_default_key(rdev, dev, key.idx,
2447                                                  key.def_uni, key.def_multi);
2448
2449                 if (err)
2450                         goto out;
2451
2452 #ifdef CONFIG_CFG80211_WEXT
2453                 dev->ieee80211_ptr->wext.default_key = key.idx;
2454 #endif
2455         } else {
2456                 if (key.def_uni || !key.def_multi) {
2457                         err = -EINVAL;
2458                         goto out;
2459                 }
2460
2461                 if (!rdev->ops->set_default_mgmt_key) {
2462                         err = -EOPNOTSUPP;
2463                         goto out;
2464                 }
2465
2466                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2467                 if (err)
2468                         goto out;
2469
2470                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2471                 if (err)
2472                         goto out;
2473
2474 #ifdef CONFIG_CFG80211_WEXT
2475                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2476 #endif
2477         }
2478
2479  out:
2480         wdev_unlock(dev->ieee80211_ptr);
2481
2482         return err;
2483 }
2484
2485 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2486 {
2487         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2488         int err;
2489         struct net_device *dev = info->user_ptr[1];
2490         struct key_parse key;
2491         const u8 *mac_addr = NULL;
2492
2493         err = nl80211_parse_key(info, &key);
2494         if (err)
2495                 return err;
2496
2497         if (!key.p.key)
2498                 return -EINVAL;
2499
2500         if (info->attrs[NL80211_ATTR_MAC])
2501                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2502
2503         if (key.type == -1) {
2504                 if (mac_addr)
2505                         key.type = NL80211_KEYTYPE_PAIRWISE;
2506                 else
2507                         key.type = NL80211_KEYTYPE_GROUP;
2508         }
2509
2510         /* for now */
2511         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2512             key.type != NL80211_KEYTYPE_GROUP)
2513                 return -EINVAL;
2514
2515         if (!rdev->ops->add_key)
2516                 return -EOPNOTSUPP;
2517
2518         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2519                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2520                                            mac_addr))
2521                 return -EINVAL;
2522
2523         wdev_lock(dev->ieee80211_ptr);
2524         err = nl80211_key_allowed(dev->ieee80211_ptr);
2525         if (!err)
2526                 err = rdev_add_key(rdev, dev, key.idx,
2527                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2528                                     mac_addr, &key.p);
2529         wdev_unlock(dev->ieee80211_ptr);
2530
2531         return err;
2532 }
2533
2534 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2535 {
2536         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2537         int err;
2538         struct net_device *dev = info->user_ptr[1];
2539         u8 *mac_addr = NULL;
2540         struct key_parse key;
2541
2542         err = nl80211_parse_key(info, &key);
2543         if (err)
2544                 return err;
2545
2546         if (info->attrs[NL80211_ATTR_MAC])
2547                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2548
2549         if (key.type == -1) {
2550                 if (mac_addr)
2551                         key.type = NL80211_KEYTYPE_PAIRWISE;
2552                 else
2553                         key.type = NL80211_KEYTYPE_GROUP;
2554         }
2555
2556         /* for now */
2557         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2558             key.type != NL80211_KEYTYPE_GROUP)
2559                 return -EINVAL;
2560
2561         if (!rdev->ops->del_key)
2562                 return -EOPNOTSUPP;
2563
2564         wdev_lock(dev->ieee80211_ptr);
2565         err = nl80211_key_allowed(dev->ieee80211_ptr);
2566
2567         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2568             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2569                 err = -ENOENT;
2570
2571         if (!err)
2572                 err = rdev_del_key(rdev, dev, key.idx,
2573                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2574                                    mac_addr);
2575
2576 #ifdef CONFIG_CFG80211_WEXT
2577         if (!err) {
2578                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2579                         dev->ieee80211_ptr->wext.default_key = -1;
2580                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2581                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2582         }
2583 #endif
2584         wdev_unlock(dev->ieee80211_ptr);
2585
2586         return err;
2587 }
2588
2589 /* This function returns an error or the number of nested attributes */
2590 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2591 {
2592         struct nlattr *attr;
2593         int n_entries = 0, tmp;
2594
2595         nla_for_each_nested(attr, nl_attr, tmp) {
2596                 if (nla_len(attr) != ETH_ALEN)
2597                         return -EINVAL;
2598
2599                 n_entries++;
2600         }
2601
2602         return n_entries;
2603 }
2604
2605 /*
2606  * This function parses ACL information and allocates memory for ACL data.
2607  * On successful return, the calling function is responsible to free the
2608  * ACL buffer returned by this function.
2609  */
2610 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2611                                                 struct genl_info *info)
2612 {
2613         enum nl80211_acl_policy acl_policy;
2614         struct nlattr *attr;
2615         struct cfg80211_acl_data *acl;
2616         int i = 0, n_entries, tmp;
2617
2618         if (!wiphy->max_acl_mac_addrs)
2619                 return ERR_PTR(-EOPNOTSUPP);
2620
2621         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2622                 return ERR_PTR(-EINVAL);
2623
2624         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2625         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2626             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2627                 return ERR_PTR(-EINVAL);
2628
2629         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2630                 return ERR_PTR(-EINVAL);
2631
2632         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2633         if (n_entries < 0)
2634                 return ERR_PTR(n_entries);
2635
2636         if (n_entries > wiphy->max_acl_mac_addrs)
2637                 return ERR_PTR(-ENOTSUPP);
2638
2639         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2640                       GFP_KERNEL);
2641         if (!acl)
2642                 return ERR_PTR(-ENOMEM);
2643
2644         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2645                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2646                 i++;
2647         }
2648
2649         acl->n_acl_entries = n_entries;
2650         acl->acl_policy = acl_policy;
2651
2652         return acl;
2653 }
2654
2655 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2656 {
2657         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2658         struct net_device *dev = info->user_ptr[1];
2659         struct cfg80211_acl_data *acl;
2660         int err;
2661
2662         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2663             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2664                 return -EOPNOTSUPP;
2665
2666         if (!dev->ieee80211_ptr->beacon_interval)
2667                 return -EINVAL;
2668
2669         acl = parse_acl_data(&rdev->wiphy, info);
2670         if (IS_ERR(acl))
2671                 return PTR_ERR(acl);
2672
2673         err = rdev_set_mac_acl(rdev, dev, acl);
2674
2675         kfree(acl);
2676
2677         return err;
2678 }
2679
2680 static int nl80211_parse_beacon(struct genl_info *info,
2681                                 struct cfg80211_beacon_data *bcn)
2682 {
2683         bool haveinfo = false;
2684
2685         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2686             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2687             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2688             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2689                 return -EINVAL;
2690
2691         memset(bcn, 0, sizeof(*bcn));
2692
2693         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2694                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2695                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2696                 if (!bcn->head_len)
2697                         return -EINVAL;
2698                 haveinfo = true;
2699         }
2700
2701         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2702                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2703                 bcn->tail_len =
2704                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2705                 haveinfo = true;
2706         }
2707
2708         if (!haveinfo)
2709                 return -EINVAL;
2710
2711         if (info->attrs[NL80211_ATTR_IE]) {
2712                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2713                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2714         }
2715
2716         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2717                 bcn->proberesp_ies =
2718                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2719                 bcn->proberesp_ies_len =
2720                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2721         }
2722
2723         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2724                 bcn->assocresp_ies =
2725                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2726                 bcn->assocresp_ies_len =
2727                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2728         }
2729
2730         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2731                 bcn->probe_resp =
2732                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2733                 bcn->probe_resp_len =
2734                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2735         }
2736
2737         return 0;
2738 }
2739
2740 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2741                                    struct cfg80211_ap_settings *params)
2742 {
2743         struct wireless_dev *wdev;
2744         bool ret = false;
2745
2746         mutex_lock(&rdev->devlist_mtx);
2747
2748         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2749                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2750                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2751                         continue;
2752
2753                 if (!wdev->preset_chandef.chan)
2754                         continue;
2755
2756                 params->chandef = wdev->preset_chandef;
2757                 ret = true;
2758                 break;
2759         }
2760
2761         mutex_unlock(&rdev->devlist_mtx);
2762
2763         return ret;
2764 }
2765
2766 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
2767                                     enum nl80211_auth_type auth_type,
2768                                     enum nl80211_commands cmd)
2769 {
2770         if (auth_type > NL80211_AUTHTYPE_MAX)
2771                 return false;
2772
2773         switch (cmd) {
2774         case NL80211_CMD_AUTHENTICATE:
2775                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
2776                     auth_type == NL80211_AUTHTYPE_SAE)
2777                         return false;
2778                 return true;
2779         case NL80211_CMD_CONNECT:
2780         case NL80211_CMD_START_AP:
2781                 /* SAE not supported yet */
2782                 if (auth_type == NL80211_AUTHTYPE_SAE)
2783                         return false;
2784                 return true;
2785         default:
2786                 return false;
2787         }
2788 }
2789
2790 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2791 {
2792         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2793         struct net_device *dev = info->user_ptr[1];
2794         struct wireless_dev *wdev = dev->ieee80211_ptr;
2795         struct cfg80211_ap_settings params;
2796         int err;
2797         u8 radar_detect_width = 0;
2798
2799         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2800             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2801                 return -EOPNOTSUPP;
2802
2803         if (!rdev->ops->start_ap)
2804                 return -EOPNOTSUPP;
2805
2806         if (wdev->beacon_interval)
2807                 return -EALREADY;
2808
2809         memset(&params, 0, sizeof(params));
2810
2811         /* these are required for START_AP */
2812         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2813             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2814             !info->attrs[NL80211_ATTR_BEACON_HEAD])
2815                 return -EINVAL;
2816
2817         err = nl80211_parse_beacon(info, &params.beacon);
2818         if (err)
2819                 return err;
2820
2821         params.beacon_interval =
2822                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2823         params.dtim_period =
2824                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2825
2826         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
2827         if (err)
2828                 return err;
2829
2830         /*
2831          * In theory, some of these attributes should be required here
2832          * but since they were not used when the command was originally
2833          * added, keep them optional for old user space programs to let
2834          * them continue to work with drivers that do not need the
2835          * additional information -- drivers must check!
2836          */
2837         if (info->attrs[NL80211_ATTR_SSID]) {
2838                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2839                 params.ssid_len =
2840                         nla_len(info->attrs[NL80211_ATTR_SSID]);
2841                 if (params.ssid_len == 0 ||
2842                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
2843                         return -EINVAL;
2844         }
2845
2846         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2847                 params.hidden_ssid = nla_get_u32(
2848                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2849                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
2850                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
2851                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2852                         return -EINVAL;
2853         }
2854
2855         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2856
2857         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2858                 params.auth_type = nla_get_u32(
2859                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
2860                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
2861                                              NL80211_CMD_START_AP))
2862                         return -EINVAL;
2863         } else
2864                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2865
2866         err = nl80211_crypto_settings(rdev, info, &params.crypto,
2867                                       NL80211_MAX_NR_CIPHER_SUITES);
2868         if (err)
2869                 return err;
2870
2871         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
2872                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
2873                         return -EOPNOTSUPP;
2874                 params.inactivity_timeout = nla_get_u16(
2875                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
2876         }
2877
2878         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
2879                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2880                         return -EINVAL;
2881                 params.p2p_ctwindow =
2882                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
2883                 if (params.p2p_ctwindow > 127)
2884                         return -EINVAL;
2885                 if (params.p2p_ctwindow != 0 &&
2886                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
2887                         return -EINVAL;
2888         }
2889
2890         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
2891                 u8 tmp;
2892
2893                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2894                         return -EINVAL;
2895                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
2896                 if (tmp > 1)
2897                         return -EINVAL;
2898                 params.p2p_opp_ps = tmp;
2899                 if (params.p2p_opp_ps != 0 &&
2900                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
2901                         return -EINVAL;
2902         }
2903
2904         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2905                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
2906                 if (err)
2907                         return err;
2908         } else if (wdev->preset_chandef.chan) {
2909                 params.chandef = wdev->preset_chandef;
2910         } else if (!nl80211_get_ap_channel(rdev, &params))
2911                 return -EINVAL;
2912
2913         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
2914                 return -EINVAL;
2915
2916         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
2917         if (err < 0)
2918                 return err;
2919         if (err) {
2920                 radar_detect_width = BIT(params.chandef.width);
2921                 params.radar_required = true;
2922         }
2923
2924         mutex_lock(&rdev->devlist_mtx);
2925         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
2926                                            params.chandef.chan,
2927                                            CHAN_MODE_SHARED,
2928                                            radar_detect_width);
2929         mutex_unlock(&rdev->devlist_mtx);
2930
2931         if (err)
2932                 return err;
2933
2934         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
2935                 params.acl = parse_acl_data(&rdev->wiphy, info);
2936                 if (IS_ERR(params.acl))
2937                         return PTR_ERR(params.acl);
2938         }
2939
2940         err = rdev_start_ap(rdev, dev, &params);
2941         if (!err) {
2942                 wdev->preset_chandef = params.chandef;
2943                 wdev->beacon_interval = params.beacon_interval;
2944                 wdev->channel = params.chandef.chan;
2945                 wdev->ssid_len = params.ssid_len;
2946                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
2947         }
2948
2949         kfree(params.acl);
2950
2951         return err;
2952 }
2953
2954 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
2955 {
2956         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2957         struct net_device *dev = info->user_ptr[1];
2958         struct wireless_dev *wdev = dev->ieee80211_ptr;
2959         struct cfg80211_beacon_data params;
2960         int err;
2961
2962         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2963             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2964                 return -EOPNOTSUPP;
2965
2966         if (!rdev->ops->change_beacon)
2967                 return -EOPNOTSUPP;
2968
2969         if (!wdev->beacon_interval)
2970                 return -EINVAL;
2971
2972         err = nl80211_parse_beacon(info, &params);
2973         if (err)
2974                 return err;
2975
2976         return rdev_change_beacon(rdev, dev, &params);
2977 }
2978
2979 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
2980 {
2981         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2982         struct net_device *dev = info->user_ptr[1];
2983
2984         return cfg80211_stop_ap(rdev, dev);
2985 }
2986
2987 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2988         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2989         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2990         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2991         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2992         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2993         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2994 };
2995
2996 static int parse_station_flags(struct genl_info *info,
2997                                enum nl80211_iftype iftype,
2998                                struct station_parameters *params)
2999 {
3000         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3001         struct nlattr *nla;
3002         int flag;
3003
3004         /*
3005          * Try parsing the new attribute first so userspace
3006          * can specify both for older kernels.
3007          */
3008         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3009         if (nla) {
3010                 struct nl80211_sta_flag_update *sta_flags;
3011
3012                 sta_flags = nla_data(nla);
3013                 params->sta_flags_mask = sta_flags->mask;
3014                 params->sta_flags_set = sta_flags->set;
3015                 if ((params->sta_flags_mask |
3016                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3017                         return -EINVAL;
3018                 return 0;
3019         }
3020
3021         /* if present, parse the old attribute */
3022
3023         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3024         if (!nla)
3025                 return 0;
3026
3027         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3028                              nla, sta_flags_policy))
3029                 return -EINVAL;
3030
3031         /*
3032          * Only allow certain flags for interface types so that
3033          * other attributes are silently ignored. Remember that
3034          * this is backward compatibility code with old userspace
3035          * and shouldn't be hit in other cases anyway.
3036          */
3037         switch (iftype) {
3038         case NL80211_IFTYPE_AP:
3039         case NL80211_IFTYPE_AP_VLAN:
3040         case NL80211_IFTYPE_P2P_GO:
3041                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3042                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3043                                          BIT(NL80211_STA_FLAG_WME) |
3044                                          BIT(NL80211_STA_FLAG_MFP);
3045                 break;
3046         case NL80211_IFTYPE_P2P_CLIENT:
3047         case NL80211_IFTYPE_STATION:
3048                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3049                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3050                 break;
3051         case NL80211_IFTYPE_MESH_POINT:
3052                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3053                                          BIT(NL80211_STA_FLAG_MFP) |
3054                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3055         default:
3056                 return -EINVAL;
3057         }
3058
3059         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3060                 if (flags[flag]) {
3061                         params->sta_flags_set |= (1<<flag);
3062
3063                         /* no longer support new API additions in old API */
3064                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3065                                 return -EINVAL;
3066                 }
3067         }
3068
3069         return 0;
3070 }
3071
3072 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3073                                  int attr)
3074 {
3075         struct nlattr *rate;
3076         u32 bitrate;
3077         u16 bitrate_compat;
3078
3079         rate = nla_nest_start(msg, attr);
3080         if (!rate)
3081                 return false;
3082
3083         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3084         bitrate = cfg80211_calculate_bitrate(info);
3085         /* report 16-bit bitrate only if we can */
3086         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3087         if (bitrate > 0 &&
3088             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3089                 return false;
3090         if (bitrate_compat > 0 &&
3091             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3092                 return false;
3093
3094         if (info->flags & RATE_INFO_FLAGS_MCS) {
3095                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3096                         return false;
3097                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3098                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3099                         return false;
3100                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3101                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3102                         return false;
3103         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3104                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3105                         return false;
3106                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3107                         return false;
3108                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3109                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3110                         return false;
3111                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3112                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3113                         return false;
3114                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3115                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3116                         return false;
3117                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3118                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3119                         return false;
3120                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3121                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3122                         return false;
3123         }
3124
3125         nla_nest_end(msg, rate);
3126         return true;
3127 }
3128
3129 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3130                                 int flags,
3131                                 struct cfg80211_registered_device *rdev,
3132                                 struct net_device *dev,
3133                                 const u8 *mac_addr, struct station_info *sinfo)
3134 {
3135         void *hdr;
3136         struct nlattr *sinfoattr, *bss_param;
3137
3138         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3139         if (!hdr)
3140                 return -1;
3141
3142         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3143             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3144             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3145                 goto nla_put_failure;
3146
3147         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3148         if (!sinfoattr)
3149                 goto nla_put_failure;
3150         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3151             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3152                         sinfo->connected_time))
3153                 goto nla_put_failure;
3154         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3155             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3156                         sinfo->inactive_time))
3157                 goto nla_put_failure;
3158         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3159                               STATION_INFO_RX_BYTES64)) &&
3160             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3161                         (u32)sinfo->rx_bytes))
3162                 goto nla_put_failure;
3163         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3164                               NL80211_STA_INFO_TX_BYTES64)) &&
3165             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3166                         (u32)sinfo->tx_bytes))
3167                 goto nla_put_failure;
3168         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3169             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3170                         sinfo->rx_bytes))
3171                 goto nla_put_failure;
3172         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3173             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3174                         sinfo->tx_bytes))
3175                 goto nla_put_failure;
3176         if ((sinfo->filled & STATION_INFO_LLID) &&
3177             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3178                 goto nla_put_failure;
3179         if ((sinfo->filled & STATION_INFO_PLID) &&
3180             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3181                 goto nla_put_failure;
3182         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3183             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3184                        sinfo->plink_state))
3185                 goto nla_put_failure;
3186         switch (rdev->wiphy.signal_type) {
3187         case CFG80211_SIGNAL_TYPE_MBM:
3188                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3189                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3190                                sinfo->signal))
3191                         goto nla_put_failure;
3192                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3193                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3194                                sinfo->signal_avg))
3195                         goto nla_put_failure;
3196                 break;
3197         default:
3198                 break;
3199         }
3200         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3201                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3202                                           NL80211_STA_INFO_TX_BITRATE))
3203                         goto nla_put_failure;
3204         }
3205         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3206                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3207                                           NL80211_STA_INFO_RX_BITRATE))
3208                         goto nla_put_failure;
3209         }
3210         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3211             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3212                         sinfo->rx_packets))
3213                 goto nla_put_failure;
3214         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3215             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3216                         sinfo->tx_packets))
3217                 goto nla_put_failure;
3218         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3219             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3220                         sinfo->tx_retries))
3221                 goto nla_put_failure;
3222         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3223             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3224                         sinfo->tx_failed))
3225                 goto nla_put_failure;
3226         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3227             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3228                         sinfo->beacon_loss_count))
3229                 goto nla_put_failure;
3230         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3231             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3232                         sinfo->local_pm))
3233                 goto nla_put_failure;
3234         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3235             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3236                         sinfo->peer_pm))
3237                 goto nla_put_failure;
3238         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3239             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3240                         sinfo->nonpeer_pm))
3241                 goto nla_put_failure;
3242         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3243                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3244                 if (!bss_param)
3245                         goto nla_put_failure;
3246
3247                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3248                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3249                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3250                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3251                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3252                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3253                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3254                                sinfo->bss_param.dtim_period) ||
3255                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3256                                 sinfo->bss_param.beacon_interval))
3257                         goto nla_put_failure;
3258
3259                 nla_nest_end(msg, bss_param);
3260         }
3261         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3262             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3263                     sizeof(struct nl80211_sta_flag_update),
3264                     &sinfo->sta_flags))
3265                 goto nla_put_failure;
3266         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3267                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3268                             sinfo->t_offset))
3269                 goto nla_put_failure;
3270         nla_nest_end(msg, sinfoattr);
3271
3272         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3273             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3274                     sinfo->assoc_req_ies))
3275                 goto nla_put_failure;
3276
3277         return genlmsg_end(msg, hdr);
3278
3279  nla_put_failure:
3280         genlmsg_cancel(msg, hdr);
3281         return -EMSGSIZE;
3282 }
3283
3284 static int nl80211_dump_station(struct sk_buff *skb,
3285                                 struct netlink_callback *cb)
3286 {
3287         struct station_info sinfo;
3288         struct cfg80211_registered_device *dev;
3289         struct net_device *netdev;
3290         u8 mac_addr[ETH_ALEN];
3291         int sta_idx = cb->args[1];
3292         int err;
3293
3294         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3295         if (err)
3296                 return err;
3297
3298         if (!dev->ops->dump_station) {
3299                 err = -EOPNOTSUPP;
3300                 goto out_err;
3301         }
3302
3303         while (1) {
3304                 memset(&sinfo, 0, sizeof(sinfo));
3305                 err = rdev_dump_station(dev, netdev, sta_idx,
3306                                         mac_addr, &sinfo);
3307                 if (err == -ENOENT)
3308                         break;
3309                 if (err)
3310                         goto out_err;
3311
3312                 if (nl80211_send_station(skb,
3313                                 NETLINK_CB(cb->skb).portid,
3314                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3315                                 dev, netdev, mac_addr,
3316                                 &sinfo) < 0)
3317                         goto out;
3318
3319                 sta_idx++;
3320         }
3321
3322
3323  out:
3324         cb->args[1] = sta_idx;
3325         err = skb->len;
3326  out_err:
3327         nl80211_finish_netdev_dump(dev);
3328
3329         return err;
3330 }
3331
3332 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3333 {
3334         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3335         struct net_device *dev = info->user_ptr[1];
3336         struct station_info sinfo;
3337         struct sk_buff *msg;
3338         u8 *mac_addr = NULL;
3339         int err;
3340
3341         memset(&sinfo, 0, sizeof(sinfo));
3342
3343         if (!info->attrs[NL80211_ATTR_MAC])
3344                 return -EINVAL;
3345
3346         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3347
3348         if (!rdev->ops->get_station)
3349                 return -EOPNOTSUPP;
3350
3351         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3352         if (err)
3353                 return err;
3354
3355         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3356         if (!msg)
3357                 return -ENOMEM;
3358
3359         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3360                                  rdev, dev, mac_addr, &sinfo) < 0) {
3361                 nlmsg_free(msg);
3362                 return -ENOBUFS;
3363         }
3364
3365         return genlmsg_reply(msg, info);
3366 }
3367
3368 /*
3369  * Get vlan interface making sure it is running and on the right wiphy.
3370  */
3371 static struct net_device *get_vlan(struct genl_info *info,
3372                                    struct cfg80211_registered_device *rdev)
3373 {
3374         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3375         struct net_device *v;
3376         int ret;
3377
3378         if (!vlanattr)
3379                 return NULL;
3380
3381         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3382         if (!v)
3383                 return ERR_PTR(-ENODEV);
3384
3385         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3386                 ret = -EINVAL;
3387                 goto error;
3388         }
3389
3390         if (!netif_running(v)) {
3391                 ret = -ENETDOWN;
3392                 goto error;
3393         }
3394
3395         return v;
3396  error:
3397         dev_put(v);
3398         return ERR_PTR(ret);
3399 }
3400
3401 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3402 {
3403         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3404         int err;
3405         struct net_device *dev = info->user_ptr[1];
3406         struct station_parameters params;
3407         u8 *mac_addr = NULL;
3408
3409         memset(&params, 0, sizeof(params));
3410
3411         params.listen_interval = -1;
3412         params.plink_state = -1;
3413
3414         if (info->attrs[NL80211_ATTR_STA_AID])
3415                 return -EINVAL;
3416
3417         if (!info->attrs[NL80211_ATTR_MAC])
3418                 return -EINVAL;
3419
3420         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3421
3422         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3423                 params.supported_rates =
3424                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3425                 params.supported_rates_len =
3426                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3427         }
3428
3429         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL] ||
3430             info->attrs[NL80211_ATTR_HT_CAPABILITY])
3431                 return -EINVAL;
3432
3433         if (!rdev->ops->change_station)
3434                 return -EOPNOTSUPP;
3435
3436         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3437                 return -EINVAL;
3438
3439         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3440                 params.plink_action =
3441                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3442
3443         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
3444                 params.plink_state =
3445                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3446
3447         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
3448                 enum nl80211_mesh_power_mode pm = nla_get_u32(
3449                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
3450
3451                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
3452                     pm > NL80211_MESH_POWER_MAX)
3453                         return -EINVAL;
3454
3455                 params.local_pm = pm;
3456         }
3457
3458         switch (dev->ieee80211_ptr->iftype) {
3459         case NL80211_IFTYPE_AP:
3460         case NL80211_IFTYPE_AP_VLAN:
3461         case NL80211_IFTYPE_P2P_GO:
3462                 /* disallow mesh-specific things */
3463                 if (params.plink_action)
3464                         return -EINVAL;
3465                 if (params.local_pm)
3466                         return -EINVAL;
3467
3468                 /* TDLS can't be set, ... */
3469                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3470                         return -EINVAL;
3471                 /*
3472                  * ... but don't bother the driver with it. This works around
3473                  * a hostapd/wpa_supplicant issue -- it always includes the
3474                  * TLDS_PEER flag in the mask even for AP mode.
3475                  */
3476                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3477
3478                 /* accept only the listed bits */
3479                 if (params.sta_flags_mask &
3480                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3481                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3482                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3483                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3484                                   BIT(NL80211_STA_FLAG_WME) |
3485                                   BIT(NL80211_STA_FLAG_MFP)))
3486                         return -EINVAL;
3487
3488                 /* but authenticated/associated only if driver handles it */
3489                 if (!(rdev->wiphy.features &
3490                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3491                     params.sta_flags_mask &
3492                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3493                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3494                         return -EINVAL;
3495
3496                 /* reject other things that can't change */
3497                 if (params.supported_rates)
3498                         return -EINVAL;
3499
3500                 /* must be last in here for error handling */
3501                 params.vlan = get_vlan(info, rdev);
3502                 if (IS_ERR(params.vlan))
3503                         return PTR_ERR(params.vlan);
3504                 break;
3505         case NL80211_IFTYPE_P2P_CLIENT:
3506         case NL80211_IFTYPE_STATION:
3507                 /*
3508                  * Don't allow userspace to change the TDLS_PEER flag,
3509                  * but silently ignore attempts to change it since we
3510                  * don't have state here to verify that it doesn't try
3511                  * to change the flag.
3512                  */
3513                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3514                 /* fall through */
3515         case NL80211_IFTYPE_ADHOC:
3516                 /* disallow things sta doesn't support */
3517                 if (params.plink_action)
3518                         return -EINVAL;
3519                 if (params.local_pm)
3520                         return -EINVAL;
3521                 /* reject any changes other than AUTHORIZED */
3522                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3523                         return -EINVAL;
3524                 break;
3525         case NL80211_IFTYPE_MESH_POINT:
3526                 /* disallow things mesh doesn't support */
3527                 if (params.vlan)
3528                         return -EINVAL;
3529                 if (params.supported_rates)
3530                         return -EINVAL;
3531                 /*
3532                  * No special handling for TDLS here -- the userspace
3533                  * mesh code doesn't have this bug.
3534                  */
3535                 if (params.sta_flags_mask &
3536                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3537                                   BIT(NL80211_STA_FLAG_MFP) |
3538                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3539                         return -EINVAL;
3540                 break;
3541         default:
3542                 return -EOPNOTSUPP;
3543         }
3544
3545         /* be aware of params.vlan when changing code here */
3546
3547         err = rdev_change_station(rdev, dev, mac_addr, &params);
3548
3549         if (params.vlan)
3550                 dev_put(params.vlan);
3551
3552         return err;
3553 }
3554
3555 static struct nla_policy
3556 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3557         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3558         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3559 };
3560
3561 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3562 {
3563         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3564         int err;
3565         struct net_device *dev = info->user_ptr[1];
3566         struct station_parameters params;
3567         u8 *mac_addr = NULL;
3568
3569         memset(&params, 0, sizeof(params));
3570
3571         if (!info->attrs[NL80211_ATTR_MAC])
3572                 return -EINVAL;
3573
3574         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3575                 return -EINVAL;
3576
3577         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3578                 return -EINVAL;
3579
3580         if (!info->attrs[NL80211_ATTR_STA_AID])
3581                 return -EINVAL;
3582
3583         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3584         params.supported_rates =
3585                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3586         params.supported_rates_len =
3587                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3588         params.listen_interval =
3589                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3590
3591         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3592         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3593                 return -EINVAL;
3594
3595         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3596                 params.ht_capa =
3597                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3598
3599         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3600                 params.vht_capa =
3601                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3602
3603         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3604                 params.plink_action =
3605                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3606
3607         if (!rdev->ops->add_station)
3608                 return -EOPNOTSUPP;
3609
3610         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3611                 return -EINVAL;
3612
3613         switch (dev->ieee80211_ptr->iftype) {
3614         case NL80211_IFTYPE_AP:
3615         case NL80211_IFTYPE_AP_VLAN:
3616         case NL80211_IFTYPE_P2P_GO:
3617                 /* parse WME attributes if sta is WME capable */
3618                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
3619                     (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
3620                     info->attrs[NL80211_ATTR_STA_WME]) {
3621                         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3622                         struct nlattr *nla;
3623
3624                         nla = info->attrs[NL80211_ATTR_STA_WME];
3625                         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3626                                                nl80211_sta_wme_policy);
3627                         if (err)
3628                                 return err;
3629
3630                         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3631                                 params.uapsd_queues =
3632                                      nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
3633                         if (params.uapsd_queues &
3634                                         ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3635                                 return -EINVAL;
3636
3637                         if (tb[NL80211_STA_WME_MAX_SP])
3638                                 params.max_sp =
3639                                      nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3640
3641                         if (params.max_sp &
3642                                         ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3643                                 return -EINVAL;
3644
3645                         params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3646                 }
3647                 /* TDLS peers cannot be added */
3648                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3649                         return -EINVAL;
3650                 /* but don't bother the driver with it */
3651                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3652
3653                 /* allow authenticated/associated only if driver handles it */
3654                 if (!(rdev->wiphy.features &
3655                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3656                     params.sta_flags_mask &
3657                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3658                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3659                         return -EINVAL;
3660
3661                 /* must be last in here for error handling */
3662                 params.vlan = get_vlan(info, rdev);
3663                 if (IS_ERR(params.vlan))
3664                         return PTR_ERR(params.vlan);
3665                 break;
3666         case NL80211_IFTYPE_MESH_POINT:
3667                 /* associated is disallowed */
3668                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
3669                         return -EINVAL;
3670                 /* TDLS peers cannot be added */
3671                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3672                         return -EINVAL;
3673                 break;
3674         case NL80211_IFTYPE_STATION:
3675                 /* associated is disallowed */
3676                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
3677                         return -EINVAL;
3678                 /* Only TDLS peers can be added */
3679                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3680                         return -EINVAL;
3681                 /* Can only add if TDLS ... */
3682                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
3683                         return -EOPNOTSUPP;
3684                 /* ... with external setup is supported */
3685                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
3686                         return -EOPNOTSUPP;
3687                 break;
3688         default:
3689                 return -EOPNOTSUPP;
3690         }
3691
3692         /* be aware of params.vlan when changing code here */
3693
3694         err = rdev_add_station(rdev, dev, mac_addr, &params);
3695
3696         if (params.vlan)
3697                 dev_put(params.vlan);
3698         return err;
3699 }
3700
3701 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
3702 {
3703         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3704         struct net_device *dev = info->user_ptr[1];
3705         u8 *mac_addr = NULL;
3706
3707         if (info->attrs[NL80211_ATTR_MAC])
3708                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3709
3710         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3711             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3712             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
3713             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3714                 return -EINVAL;
3715
3716         if (!rdev->ops->del_station)
3717                 return -EOPNOTSUPP;
3718
3719         return rdev_del_station(rdev, dev, mac_addr);
3720 }
3721
3722 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
3723                                 int flags, struct net_device *dev,
3724                                 u8 *dst, u8 *next_hop,
3725                                 struct mpath_info *pinfo)
3726 {
3727         void *hdr;
3728         struct nlattr *pinfoattr;
3729
3730         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3731         if (!hdr)
3732                 return -1;
3733
3734         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3735             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
3736             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
3737             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
3738                 goto nla_put_failure;
3739
3740         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
3741         if (!pinfoattr)
3742                 goto nla_put_failure;
3743         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
3744             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
3745                         pinfo->frame_qlen))
3746                 goto nla_put_failure;
3747         if (((pinfo->filled & MPATH_INFO_SN) &&
3748              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
3749             ((pinfo->filled & MPATH_INFO_METRIC) &&
3750              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
3751                          pinfo->metric)) ||
3752             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
3753              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
3754                          pinfo->exptime)) ||
3755             ((pinfo->filled & MPATH_INFO_FLAGS) &&
3756              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
3757                         pinfo->flags)) ||
3758             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
3759              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
3760                          pinfo->discovery_timeout)) ||
3761             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
3762              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
3763                         pinfo->discovery_retries)))
3764                 goto nla_put_failure;
3765
3766         nla_nest_end(msg, pinfoattr);
3767
3768         return genlmsg_end(msg, hdr);
3769
3770  nla_put_failure:
3771         genlmsg_cancel(msg, hdr);
3772         return -EMSGSIZE;
3773 }
3774
3775 static int nl80211_dump_mpath(struct sk_buff *skb,
3776                               struct netlink_callback *cb)
3777 {
3778         struct mpath_info pinfo;
3779         struct cfg80211_registered_device *dev;
3780         struct net_device *netdev;
3781         u8 dst[ETH_ALEN];
3782         u8 next_hop[ETH_ALEN];
3783         int path_idx = cb->args[1];
3784         int err;
3785
3786         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3787         if (err)
3788                 return err;
3789
3790         if (!dev->ops->dump_mpath) {
3791                 err = -EOPNOTSUPP;
3792                 goto out_err;
3793         }
3794
3795         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
3796                 err = -EOPNOTSUPP;
3797                 goto out_err;
3798         }
3799
3800         while (1) {
3801                 err = rdev_dump_mpath(dev, netdev, path_idx, dst, next_hop,
3802                                       &pinfo);
3803                 if (err == -ENOENT)
3804                         break;
3805                 if (err)
3806                         goto out_err;
3807
3808                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
3809                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
3810                                        netdev, dst, next_hop,
3811                                        &pinfo) < 0)
3812                         goto out;
3813
3814                 path_idx++;
3815         }
3816
3817
3818  out:
3819         cb->args[1] = path_idx;
3820         err = skb->len;
3821  out_err:
3822         nl80211_finish_netdev_dump(dev);
3823         return err;
3824 }
3825
3826 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
3827 {
3828         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3829         int err;
3830         struct net_device *dev = info->user_ptr[1];
3831         struct mpath_info pinfo;
3832         struct sk_buff *msg;
3833         u8 *dst = NULL;
3834         u8 next_hop[ETH_ALEN];
3835
3836         memset(&pinfo, 0, sizeof(pinfo));
3837
3838         if (!info->attrs[NL80211_ATTR_MAC])
3839                 return -EINVAL;
3840
3841         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3842
3843         if (!rdev->ops->get_mpath)
3844                 return -EOPNOTSUPP;
3845
3846         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3847                 return -EOPNOTSUPP;
3848
3849         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
3850         if (err)
3851                 return err;
3852
3853         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3854         if (!msg)
3855                 return -ENOMEM;
3856
3857         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
3858                                  dev, dst, next_hop, &pinfo) < 0) {
3859                 nlmsg_free(msg);
3860                 return -ENOBUFS;
3861         }
3862
3863         return genlmsg_reply(msg, info);
3864 }
3865
3866 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
3867 {
3868         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3869         struct net_device *dev = info->user_ptr[1];
3870         u8 *dst = NULL;
3871         u8 *next_hop = NULL;
3872
3873         if (!info->attrs[NL80211_ATTR_MAC])
3874                 return -EINVAL;
3875
3876         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3877                 return -EINVAL;
3878
3879         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3880         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3881
3882         if (!rdev->ops->change_mpath)
3883                 return -EOPNOTSUPP;
3884
3885         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3886                 return -EOPNOTSUPP;
3887
3888         return rdev_change_mpath(rdev, dev, dst, next_hop);
3889 }
3890
3891 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3892 {
3893         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3894         struct net_device *dev = info->user_ptr[1];
3895         u8 *dst = NULL;
3896         u8 *next_hop = NULL;
3897
3898         if (!info->attrs[NL80211_ATTR_MAC])
3899                 return -EINVAL;
3900
3901         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3902                 return -EINVAL;
3903
3904         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3905         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3906
3907         if (!rdev->ops->add_mpath)
3908                 return -EOPNOTSUPP;
3909
3910         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3911                 return -EOPNOTSUPP;
3912
3913         return rdev_add_mpath(rdev, dev, dst, next_hop);
3914 }
3915
3916 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
3917 {
3918         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3919         struct net_device *dev = info->user_ptr[1];
3920         u8 *dst = NULL;
3921
3922         if (info->attrs[NL80211_ATTR_MAC])
3923                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3924
3925         if (!rdev->ops->del_mpath)
3926                 return -EOPNOTSUPP;
3927
3928         return rdev_del_mpath(rdev, dev, dst);
3929 }
3930
3931 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
3932 {
3933         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3934         struct net_device *dev = info->user_ptr[1];
3935         struct bss_parameters params;
3936
3937         memset(&params, 0, sizeof(params));
3938         /* default to not changing parameters */
3939         params.use_cts_prot = -1;
3940         params.use_short_preamble = -1;
3941         params.use_short_slot_time = -1;
3942         params.ap_isolate = -1;
3943         params.ht_opmode = -1;
3944         params.p2p_ctwindow = -1;
3945         params.p2p_opp_ps = -1;
3946
3947         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
3948                 params.use_cts_prot =
3949                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
3950         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
3951                 params.use_short_preamble =
3952                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
3953         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
3954                 params.use_short_slot_time =
3955                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
3956         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3957                 params.basic_rates =
3958                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3959                 params.basic_rates_len =
3960                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3961         }
3962         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
3963                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
3964         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
3965                 params.ht_opmode =
3966                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
3967
3968         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3969                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3970                         return -EINVAL;
3971                 params.p2p_ctwindow =
3972                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3973                 if (params.p2p_ctwindow < 0)
3974                         return -EINVAL;
3975                 if (params.p2p_ctwindow != 0 &&
3976                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3977                         return -EINVAL;
3978         }
3979
3980         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3981                 u8 tmp;
3982
3983                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3984                         return -EINVAL;
3985                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3986                 if (tmp > 1)
3987                         return -EINVAL;
3988                 params.p2p_opp_ps = tmp;
3989                 if (params.p2p_opp_ps &&
3990                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3991                         return -EINVAL;
3992         }
3993
3994         if (!rdev->ops->change_bss)
3995                 return -EOPNOTSUPP;
3996
3997         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3998             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3999                 return -EOPNOTSUPP;
4000
4001         return rdev_change_bss(rdev, dev, &params);
4002 }
4003
4004 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4005         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4006         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4007         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4008         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4009         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4010         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4011 };
4012
4013 static int parse_reg_rule(struct nlattr *tb[],
4014         struct ieee80211_reg_rule *reg_rule)
4015 {
4016         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4017         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4018
4019         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4020                 return -EINVAL;
4021         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4022                 return -EINVAL;
4023         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4024                 return -EINVAL;
4025         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4026                 return -EINVAL;
4027         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4028                 return -EINVAL;
4029
4030         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4031
4032         freq_range->start_freq_khz =
4033                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4034         freq_range->end_freq_khz =
4035                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4036         freq_range->max_bandwidth_khz =
4037                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4038
4039         power_rule->max_eirp =
4040                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4041
4042         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4043                 power_rule->max_antenna_gain =
4044                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4045
4046         return 0;
4047 }
4048
4049 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4050 {
4051         int r;
4052         char *data = NULL;
4053         enum nl80211_user_reg_hint_type user_reg_hint_type;
4054
4055         /*
4056          * You should only get this when cfg80211 hasn't yet initialized
4057          * completely when built-in to the kernel right between the time
4058          * window between nl80211_init() and regulatory_init(), if that is
4059          * even possible.
4060          */
4061         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4062                 return -EINPROGRESS;
4063
4064         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4065                 return -EINVAL;
4066
4067         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4068
4069         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4070                 user_reg_hint_type =
4071                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4072         else
4073                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4074
4075         switch (user_reg_hint_type) {
4076         case NL80211_USER_REG_HINT_USER:
4077         case NL80211_USER_REG_HINT_CELL_BASE:
4078                 break;
4079         default:
4080                 return -EINVAL;
4081         }
4082
4083         r = regulatory_hint_user(data, user_reg_hint_type);
4084
4085         return r;
4086 }
4087
4088 static int nl80211_get_mesh_config(struct sk_buff *skb,
4089                                    struct genl_info *info)
4090 {
4091         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4092         struct net_device *dev = info->user_ptr[1];
4093         struct wireless_dev *wdev = dev->ieee80211_ptr;
4094         struct mesh_config cur_params;
4095         int err = 0;
4096         void *hdr;
4097         struct nlattr *pinfoattr;
4098         struct sk_buff *msg;
4099
4100         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4101                 return -EOPNOTSUPP;
4102
4103         if (!rdev->ops->get_mesh_config)
4104                 return -EOPNOTSUPP;
4105
4106         wdev_lock(wdev);
4107         /* If not connected, get default parameters */
4108         if (!wdev->mesh_id_len)
4109                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4110         else
4111                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4112         wdev_unlock(wdev);
4113
4114         if (err)
4115                 return err;
4116
4117         /* Draw up a netlink message to send back */
4118         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4119         if (!msg)
4120                 return -ENOMEM;
4121         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4122                              NL80211_CMD_GET_MESH_CONFIG);
4123         if (!hdr)
4124                 goto out;
4125         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4126         if (!pinfoattr)
4127                 goto nla_put_failure;
4128         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4129             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4130                         cur_params.dot11MeshRetryTimeout) ||
4131             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4132                         cur_params.dot11MeshConfirmTimeout) ||
4133             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4134                         cur_params.dot11MeshHoldingTimeout) ||
4135             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4136                         cur_params.dot11MeshMaxPeerLinks) ||
4137             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4138                        cur_params.dot11MeshMaxRetries) ||
4139             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4140                        cur_params.dot11MeshTTL) ||
4141             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4142                        cur_params.element_ttl) ||
4143             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4144                        cur_params.auto_open_plinks) ||
4145             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4146                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4147             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4148                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4149             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4150                         cur_params.path_refresh_time) ||
4151             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4152                         cur_params.min_discovery_timeout) ||
4153             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4154                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4155             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4156                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4157             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4158                         cur_params.dot11MeshHWMPperrMinInterval) ||
4159             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4160                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4161             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4162                        cur_params.dot11MeshHWMPRootMode) ||
4163             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4164                         cur_params.dot11MeshHWMPRannInterval) ||
4165             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4166                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4167             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4168                        cur_params.dot11MeshForwarding) ||
4169             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4170                         cur_params.rssi_threshold) ||
4171             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4172                         cur_params.ht_opmode) ||
4173             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4174                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4175             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4176                         cur_params.dot11MeshHWMProotInterval) ||
4177             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4178                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4179             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4180                         cur_params.power_mode) ||
4181             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4182                         cur_params.dot11MeshAwakeWindowDuration))
4183                 goto nla_put_failure;
4184         nla_nest_end(msg, pinfoattr);
4185         genlmsg_end(msg, hdr);
4186         return genlmsg_reply(msg, info);
4187
4188  nla_put_failure:
4189         genlmsg_cancel(msg, hdr);
4190  out:
4191         nlmsg_free(msg);
4192         return -ENOBUFS;
4193 }
4194
4195 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4196         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4197         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4198         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4199         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4200         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4201         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4202         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4203         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4204         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4205         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4206         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4207         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4208         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4209         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4210         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4211         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4212         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4213         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4214         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4215         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4216         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4217         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4218         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4219         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4220         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4221         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4222         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4223 };
4224
4225 static const struct nla_policy
4226         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4227         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4228         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4229         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4230         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4231         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4232                                     .len = IEEE80211_MAX_DATA_LEN },
4233         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4234 };
4235
4236 static int nl80211_parse_mesh_config(struct genl_info *info,
4237                                      struct mesh_config *cfg,
4238                                      u32 *mask_out)
4239 {
4240         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4241         u32 mask = 0;
4242
4243 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4244 do {                                                                        \
4245         if (tb[attr]) {                                                     \
4246                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4247                         return -EINVAL;                                     \
4248                 cfg->param = fn(tb[attr]);                                  \
4249                 mask |= (1 << (attr - 1));                                  \
4250         }                                                                   \
4251 } while (0)
4252
4253
4254         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4255                 return -EINVAL;
4256         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4257                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4258                              nl80211_meshconf_params_policy))
4259                 return -EINVAL;
4260
4261         /* This makes sure that there aren't more than 32 mesh config
4262          * parameters (otherwise our bitfield scheme would not work.) */
4263         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4264
4265         /* Fill in the params struct */
4266         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4267                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4268                                   nla_get_u16);
4269         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4270                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4271                                   nla_get_u16);
4272         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4273                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4274                                   nla_get_u16);
4275         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4276                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4277                                   nla_get_u16);
4278         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4279                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4280                                   nla_get_u8);
4281         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4282                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4283         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4284                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4285                                   nla_get_u8);
4286         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4287                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4288                                   nla_get_u8);
4289         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4290                                   1, 255, mask,
4291                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4292                                   nla_get_u32);
4293         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4294                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4295                                   nla_get_u8);
4296         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4297                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4298                                   nla_get_u32);
4299         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4300                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4301                                   nla_get_u16);
4302         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4303                                   1, 65535, mask,
4304                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4305                                   nla_get_u32);
4306         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4307                                   1, 65535, mask,
4308                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4309                                   nla_get_u16);
4310         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4311                                   1, 65535, mask,
4312                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4313                                   nla_get_u16);
4314         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4315                                   dot11MeshHWMPnetDiameterTraversalTime,
4316                                   1, 65535, mask,
4317                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4318                                   nla_get_u16);
4319         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4320                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4321                                   nla_get_u8);
4322         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4323                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4324                                   nla_get_u16);
4325         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4326                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4327                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4328                                   nla_get_u8);
4329         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4330                                   mask, NL80211_MESHCONF_FORWARDING,
4331                                   nla_get_u8);
4332         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, 1, 255,
4333                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4334                                   nla_get_u32);
4335         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4336                                   mask, NL80211_MESHCONF_HT_OPMODE,
4337                                   nla_get_u16);
4338         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4339                                   1, 65535, mask,
4340                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4341                                   nla_get_u32);
4342         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4343                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4344                                   nla_get_u16);
4345         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4346                                   dot11MeshHWMPconfirmationInterval,
4347                                   1, 65535, mask,
4348                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4349                                   nla_get_u16);
4350         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4351                                   NL80211_MESH_POWER_ACTIVE,
4352                                   NL80211_MESH_POWER_MAX,
4353                                   mask, NL80211_MESHCONF_POWER_MODE,
4354                                   nla_get_u32);
4355         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4356                                   0, 65535, mask,
4357                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4358         if (mask_out)
4359                 *mask_out = mask;
4360
4361         return 0;
4362
4363 #undef FILL_IN_MESH_PARAM_IF_SET
4364 }
4365
4366 static int nl80211_parse_mesh_setup(struct genl_info *info,
4367                                      struct mesh_setup *setup)
4368 {
4369         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4370
4371         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4372                 return -EINVAL;
4373         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4374                              info->attrs[NL80211_ATTR_MESH_SETUP],
4375                              nl80211_mesh_setup_params_policy))
4376                 return -EINVAL;
4377
4378         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4379                 setup->sync_method =
4380                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4381                  IEEE80211_SYNC_METHOD_VENDOR :
4382                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4383
4384         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4385                 setup->path_sel_proto =
4386                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4387                  IEEE80211_PATH_PROTOCOL_VENDOR :
4388                  IEEE80211_PATH_PROTOCOL_HWMP;
4389
4390         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4391                 setup->path_metric =
4392                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4393                  IEEE80211_PATH_METRIC_VENDOR :
4394                  IEEE80211_PATH_METRIC_AIRTIME;
4395
4396
4397         if (tb[NL80211_MESH_SETUP_IE]) {
4398                 struct nlattr *ieattr =
4399                         tb[NL80211_MESH_SETUP_IE];
4400                 if (!is_valid_ie_attr(ieattr))
4401                         return -EINVAL;
4402                 setup->ie = nla_data(ieattr);
4403                 setup->ie_len = nla_len(ieattr);
4404         }
4405         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4406         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4407
4408         return 0;
4409 }
4410
4411 static int nl80211_update_mesh_config(struct sk_buff *skb,
4412                                       struct genl_info *info)
4413 {
4414         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4415         struct net_device *dev = info->user_ptr[1];
4416         struct wireless_dev *wdev = dev->ieee80211_ptr;
4417         struct mesh_config cfg;
4418         u32 mask;
4419         int err;
4420
4421         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4422                 return -EOPNOTSUPP;
4423
4424         if (!rdev->ops->update_mesh_config)
4425                 return -EOPNOTSUPP;
4426
4427         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4428         if (err)
4429                 return err;
4430
4431         wdev_lock(wdev);
4432         if (!wdev->mesh_id_len)
4433                 err = -ENOLINK;
4434
4435         if (!err)
4436                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4437
4438         wdev_unlock(wdev);
4439
4440         return err;
4441 }
4442
4443 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4444 {
4445         const struct ieee80211_regdomain *regdom;
4446         struct sk_buff *msg;
4447         void *hdr = NULL;
4448         struct nlattr *nl_reg_rules;
4449         unsigned int i;
4450         int err = -EINVAL;
4451
4452         mutex_lock(&cfg80211_mutex);
4453
4454         if (!cfg80211_regdomain)
4455                 goto out;
4456
4457         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4458         if (!msg) {
4459                 err = -ENOBUFS;
4460                 goto out;
4461         }
4462
4463         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4464                              NL80211_CMD_GET_REG);
4465         if (!hdr)
4466                 goto put_failure;
4467
4468         if (reg_last_request_cell_base() &&
4469             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4470                         NL80211_USER_REG_HINT_CELL_BASE))
4471                 goto nla_put_failure;
4472
4473         rcu_read_lock();
4474         regdom = rcu_dereference(cfg80211_regdomain);
4475
4476         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
4477             (regdom->dfs_region &&
4478              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
4479                 goto nla_put_failure_rcu;
4480
4481         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4482         if (!nl_reg_rules)
4483                 goto nla_put_failure_rcu;
4484
4485         for (i = 0; i < regdom->n_reg_rules; i++) {
4486                 struct nlattr *nl_reg_rule;
4487                 const struct ieee80211_reg_rule *reg_rule;
4488                 const struct ieee80211_freq_range *freq_range;
4489                 const struct ieee80211_power_rule *power_rule;
4490
4491                 reg_rule = &regdom->reg_rules[i];
4492                 freq_range = &reg_rule->freq_range;
4493                 power_rule = &reg_rule->power_rule;
4494
4495                 nl_reg_rule = nla_nest_start(msg, i);
4496                 if (!nl_reg_rule)
4497                         goto nla_put_failure_rcu;
4498
4499                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4500                                 reg_rule->flags) ||
4501                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4502                                 freq_range->start_freq_khz) ||
4503                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4504                                 freq_range->end_freq_khz) ||
4505                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4506                                 freq_range->max_bandwidth_khz) ||
4507                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4508                                 power_rule->max_antenna_gain) ||
4509                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4510                                 power_rule->max_eirp))
4511                         goto nla_put_failure_rcu;
4512
4513                 nla_nest_end(msg, nl_reg_rule);
4514         }
4515         rcu_read_unlock();
4516
4517         nla_nest_end(msg, nl_reg_rules);
4518
4519         genlmsg_end(msg, hdr);
4520         err = genlmsg_reply(msg, info);
4521         goto out;
4522
4523 nla_put_failure_rcu:
4524         rcu_read_unlock();
4525 nla_put_failure:
4526         genlmsg_cancel(msg, hdr);
4527 put_failure:
4528         nlmsg_free(msg);
4529         err = -EMSGSIZE;
4530 out:
4531         mutex_unlock(&cfg80211_mutex);
4532         return err;
4533 }
4534
4535 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4536 {
4537         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4538         struct nlattr *nl_reg_rule;
4539         char *alpha2 = NULL;
4540         int rem_reg_rules = 0, r = 0;
4541         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4542         u8 dfs_region = 0;
4543         struct ieee80211_regdomain *rd = NULL;
4544
4545         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4546                 return -EINVAL;
4547
4548         if (!info->attrs[NL80211_ATTR_REG_RULES])
4549                 return -EINVAL;
4550
4551         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4552
4553         if (info->attrs[NL80211_ATTR_DFS_REGION])
4554                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4555
4556         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4557                             rem_reg_rules) {
4558                 num_rules++;
4559                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4560                         return -EINVAL;
4561         }
4562
4563         size_of_regd = sizeof(struct ieee80211_regdomain) +
4564                        num_rules * sizeof(struct ieee80211_reg_rule);
4565
4566         rd = kzalloc(size_of_regd, GFP_KERNEL);
4567         if (!rd)
4568                 return -ENOMEM;
4569
4570         rd->n_reg_rules = num_rules;
4571         rd->alpha2[0] = alpha2[0];
4572         rd->alpha2[1] = alpha2[1];
4573
4574         /*
4575          * Disable DFS master mode if the DFS region was
4576          * not supported or known on this kernel.
4577          */
4578         if (reg_supported_dfs_region(dfs_region))
4579                 rd->dfs_region = dfs_region;
4580
4581         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4582                             rem_reg_rules) {
4583                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4584                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4585                           reg_rule_policy);
4586                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4587                 if (r)
4588                         goto bad_reg;
4589
4590                 rule_idx++;
4591
4592                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
4593                         r = -EINVAL;
4594                         goto bad_reg;
4595                 }
4596         }
4597
4598         mutex_lock(&cfg80211_mutex);
4599
4600         r = set_regdom(rd);
4601         /* set_regdom took ownership */
4602         rd = NULL;
4603         mutex_unlock(&cfg80211_mutex);
4604
4605  bad_reg:
4606         kfree(rd);
4607         return r;
4608 }
4609
4610 static int validate_scan_freqs(struct nlattr *freqs)
4611 {
4612         struct nlattr *attr1, *attr2;
4613         int n_channels = 0, tmp1, tmp2;
4614
4615         nla_for_each_nested(attr1, freqs, tmp1) {
4616                 n_channels++;
4617                 /*
4618                  * Some hardware has a limited channel list for
4619                  * scanning, and it is pretty much nonsensical
4620                  * to scan for a channel twice, so disallow that
4621                  * and don't require drivers to check that the
4622                  * channel list they get isn't longer than what
4623                  * they can scan, as long as they can scan all
4624                  * the channels they registered at once.
4625                  */
4626                 nla_for_each_nested(attr2, freqs, tmp2)
4627                         if (attr1 != attr2 &&
4628                             nla_get_u32(attr1) == nla_get_u32(attr2))
4629                                 return 0;
4630         }
4631
4632         return n_channels;
4633 }
4634
4635 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4636 {
4637         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4638         struct wireless_dev *wdev = info->user_ptr[1];
4639         struct cfg80211_scan_request *request;
4640         struct nlattr *attr;
4641         struct wiphy *wiphy;
4642         int err, tmp, n_ssids = 0, n_channels, i;
4643         size_t ie_len;
4644
4645         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4646                 return -EINVAL;
4647
4648         wiphy = &rdev->wiphy;
4649
4650         if (!rdev->ops->scan)
4651                 return -EOPNOTSUPP;
4652
4653         if (rdev->scan_req)
4654                 return -EBUSY;
4655
4656         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4657                 n_channels = validate_scan_freqs(
4658                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4659                 if (!n_channels)
4660                         return -EINVAL;
4661         } else {
4662                 enum ieee80211_band band;
4663                 n_channels = 0;
4664
4665                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4666                         if (wiphy->bands[band])
4667                                 n_channels += wiphy->bands[band]->n_channels;
4668         }
4669
4670         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4671                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4672                         n_ssids++;
4673
4674         if (n_ssids > wiphy->max_scan_ssids)
4675                 return -EINVAL;
4676
4677         if (info->attrs[NL80211_ATTR_IE])
4678                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4679         else
4680                 ie_len = 0;
4681
4682         if (ie_len > wiphy->max_scan_ie_len)
4683                 return -EINVAL;
4684
4685         request = kzalloc(sizeof(*request)
4686                         + sizeof(*request->ssids) * n_ssids
4687                         + sizeof(*request->channels) * n_channels
4688                         + ie_len, GFP_KERNEL);
4689         if (!request)
4690                 return -ENOMEM;
4691
4692         if (n_ssids)
4693                 request->ssids = (void *)&request->channels[n_channels];
4694         request->n_ssids = n_ssids;
4695         if (ie_len) {
4696                 if (request->ssids)
4697                         request->ie = (void *)(request->ssids + n_ssids);
4698                 else
4699                         request->ie = (void *)(request->channels + n_channels);
4700         }
4701
4702         i = 0;
4703         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4704                 /* user specified, bail out if channel not found */
4705                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
4706                         struct ieee80211_channel *chan;
4707
4708                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4709
4710                         if (!chan) {
4711                                 err = -EINVAL;
4712                                 goto out_free;
4713                         }
4714
4715                         /* ignore disabled channels */
4716                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4717                                 continue;
4718
4719                         request->channels[i] = chan;
4720                         i++;
4721                 }
4722         } else {
4723                 enum ieee80211_band band;
4724
4725                 /* all channels */
4726                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4727                         int j;
4728                         if (!wiphy->bands[band])
4729                                 continue;
4730                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4731                                 struct ieee80211_channel *chan;
4732
4733                                 chan = &wiphy->bands[band]->channels[j];
4734
4735                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4736                                         continue;
4737
4738                                 request->channels[i] = chan;
4739                                 i++;
4740                         }
4741                 }
4742         }
4743
4744         if (!i) {
4745                 err = -EINVAL;
4746                 goto out_free;
4747         }
4748
4749         request->n_channels = i;
4750
4751         i = 0;
4752         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4753                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
4754                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4755                                 err = -EINVAL;
4756                                 goto out_free;
4757                         }
4758                         request->ssids[i].ssid_len = nla_len(attr);
4759                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
4760                         i++;
4761                 }
4762         }
4763
4764         if (info->attrs[NL80211_ATTR_IE]) {
4765                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4766                 memcpy((void *)request->ie,
4767                        nla_data(info->attrs[NL80211_ATTR_IE]),
4768                        request->ie_len);
4769         }
4770
4771         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
4772                 if (wiphy->bands[i])
4773                         request->rates[i] =
4774                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
4775
4776         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
4777                 nla_for_each_nested(attr,
4778                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
4779                                     tmp) {
4780                         enum ieee80211_band band = nla_type(attr);
4781
4782                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4783                                 err = -EINVAL;
4784                                 goto out_free;
4785                         }
4786                         err = ieee80211_get_ratemask(wiphy->bands[band],
4787                                                      nla_data(attr),
4788                                                      nla_len(attr),
4789                                                      &request->rates[band]);
4790                         if (err)
4791                                 goto out_free;
4792                 }
4793         }
4794
4795         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4796                 request->flags = nla_get_u32(
4797                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4798                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4799                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4800                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4801                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4802                         err = -EOPNOTSUPP;
4803                         goto out_free;
4804                 }
4805         }
4806
4807         request->no_cck =
4808                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
4809
4810         request->wdev = wdev;
4811         request->wiphy = &rdev->wiphy;
4812         request->scan_start = jiffies;
4813
4814         rdev->scan_req = request;
4815         err = rdev_scan(rdev, request);
4816
4817         if (!err) {
4818                 nl80211_send_scan_start(rdev, wdev);
4819                 if (wdev->netdev)
4820                         dev_hold(wdev->netdev);
4821         } else {
4822  out_free:
4823                 rdev->scan_req = NULL;
4824                 kfree(request);
4825         }
4826
4827         return err;
4828 }
4829
4830 static int nl80211_start_sched_scan(struct sk_buff *skb,
4831                                     struct genl_info *info)
4832 {
4833         struct cfg80211_sched_scan_request *request;
4834         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4835         struct net_device *dev = info->user_ptr[1];
4836         struct nlattr *attr;
4837         struct wiphy *wiphy;
4838         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
4839         u32 interval;
4840         enum ieee80211_band band;
4841         size_t ie_len;
4842         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
4843
4844         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4845             !rdev->ops->sched_scan_start)
4846                 return -EOPNOTSUPP;
4847
4848         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4849                 return -EINVAL;
4850
4851         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
4852                 return -EINVAL;
4853
4854         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
4855         if (interval == 0)
4856                 return -EINVAL;
4857
4858         wiphy = &rdev->wiphy;
4859
4860         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4861                 n_channels = validate_scan_freqs(
4862                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4863                 if (!n_channels)
4864                         return -EINVAL;
4865         } else {
4866                 n_channels = 0;
4867
4868                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4869                         if (wiphy->bands[band])
4870                                 n_channels += wiphy->bands[band]->n_channels;
4871         }
4872
4873         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4874                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4875                                     tmp)
4876                         n_ssids++;
4877
4878         if (n_ssids > wiphy->max_sched_scan_ssids)
4879                 return -EINVAL;
4880
4881         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
4882                 nla_for_each_nested(attr,
4883                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4884                                     tmp)
4885                         n_match_sets++;
4886
4887         if (n_match_sets > wiphy->max_match_sets)
4888                 return -EINVAL;
4889
4890         if (info->attrs[NL80211_ATTR_IE])
4891                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4892         else
4893                 ie_len = 0;
4894
4895         if (ie_len > wiphy->max_sched_scan_ie_len)
4896                 return -EINVAL;
4897
4898         mutex_lock(&rdev->sched_scan_mtx);
4899
4900         if (rdev->sched_scan_req) {
4901                 err = -EINPROGRESS;
4902                 goto out;
4903         }
4904
4905         request = kzalloc(sizeof(*request)
4906                         + sizeof(*request->ssids) * n_ssids
4907                         + sizeof(*request->match_sets) * n_match_sets
4908                         + sizeof(*request->channels) * n_channels
4909                         + ie_len, GFP_KERNEL);
4910         if (!request) {
4911                 err = -ENOMEM;
4912                 goto out;
4913         }
4914
4915         if (n_ssids)
4916                 request->ssids = (void *)&request->channels[n_channels];
4917         request->n_ssids = n_ssids;
4918         if (ie_len) {
4919                 if (request->ssids)
4920                         request->ie = (void *)(request->ssids + n_ssids);
4921                 else
4922                         request->ie = (void *)(request->channels + n_channels);
4923         }
4924
4925         if (n_match_sets) {
4926                 if (request->ie)
4927                         request->match_sets = (void *)(request->ie + ie_len);
4928                 else if (request->ssids)
4929                         request->match_sets =
4930                                 (void *)(request->ssids + n_ssids);
4931                 else
4932                         request->match_sets =
4933                                 (void *)(request->channels + n_channels);
4934         }
4935         request->n_match_sets = n_match_sets;
4936
4937         i = 0;
4938         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4939                 /* user specified, bail out if channel not found */
4940                 nla_for_each_nested(attr,
4941                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
4942                                     tmp) {
4943                         struct ieee80211_channel *chan;
4944
4945                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4946
4947                         if (!chan) {
4948                                 err = -EINVAL;
4949                                 goto out_free;
4950                         }
4951
4952                         /* ignore disabled channels */
4953                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4954                                 continue;
4955
4956                         request->channels[i] = chan;
4957                         i++;
4958                 }
4959         } else {
4960                 /* all channels */
4961                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4962                         int j;
4963                         if (!wiphy->bands[band])
4964                                 continue;
4965                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4966                                 struct ieee80211_channel *chan;
4967
4968                                 chan = &wiphy->bands[band]->channels[j];
4969
4970                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4971                                         continue;
4972
4973                                 request->channels[i] = chan;
4974                                 i++;
4975                         }
4976                 }
4977         }
4978
4979         if (!i) {
4980                 err = -EINVAL;
4981                 goto out_free;
4982         }
4983
4984         request->n_channels = i;
4985
4986         i = 0;
4987         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4988                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4989                                     tmp) {
4990                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4991                                 err = -EINVAL;
4992                                 goto out_free;
4993                         }
4994                         request->ssids[i].ssid_len = nla_len(attr);
4995                         memcpy(request->ssids[i].ssid, nla_data(attr),
4996                                nla_len(attr));
4997                         i++;
4998                 }
4999         }
5000
5001         i = 0;
5002         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5003                 nla_for_each_nested(attr,
5004                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5005                                     tmp) {
5006                         struct nlattr *ssid, *rssi;
5007
5008                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5009                                   nla_data(attr), nla_len(attr),
5010                                   nl80211_match_policy);
5011                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5012                         if (ssid) {
5013                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5014                                         err = -EINVAL;
5015                                         goto out_free;
5016                                 }
5017                                 memcpy(request->match_sets[i].ssid.ssid,
5018                                        nla_data(ssid), nla_len(ssid));
5019                                 request->match_sets[i].ssid.ssid_len =
5020                                         nla_len(ssid);
5021                         }
5022                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5023                         if (rssi)
5024                                 request->rssi_thold = nla_get_u32(rssi);
5025                         else
5026                                 request->rssi_thold =
5027                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5028                         i++;
5029                 }
5030         }
5031
5032         if (info->attrs[NL80211_ATTR_IE]) {
5033                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5034                 memcpy((void *)request->ie,
5035                        nla_data(info->attrs[NL80211_ATTR_IE]),
5036                        request->ie_len);
5037         }
5038
5039         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5040                 request->flags = nla_get_u32(
5041                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5042                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5043                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
5044                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
5045                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
5046                         err = -EOPNOTSUPP;
5047                         goto out_free;
5048                 }
5049         }
5050
5051         request->dev = dev;
5052         request->wiphy = &rdev->wiphy;
5053         request->interval = interval;
5054         request->scan_start = jiffies;
5055
5056         err = rdev_sched_scan_start(rdev, dev, request);
5057         if (!err) {
5058                 rdev->sched_scan_req = request;
5059                 nl80211_send_sched_scan(rdev, dev,
5060                                         NL80211_CMD_START_SCHED_SCAN);
5061                 goto out;
5062         }
5063
5064 out_free:
5065         kfree(request);
5066 out:
5067         mutex_unlock(&rdev->sched_scan_mtx);
5068         return err;
5069 }
5070
5071 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5072                                    struct genl_info *info)
5073 {
5074         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5075         int err;
5076
5077         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5078             !rdev->ops->sched_scan_stop)
5079                 return -EOPNOTSUPP;
5080
5081         mutex_lock(&rdev->sched_scan_mtx);
5082         err = __cfg80211_stop_sched_scan(rdev, false);
5083         mutex_unlock(&rdev->sched_scan_mtx);
5084
5085         return err;
5086 }
5087
5088 static int nl80211_start_radar_detection(struct sk_buff *skb,
5089                                          struct genl_info *info)
5090 {
5091         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5092         struct net_device *dev = info->user_ptr[1];
5093         struct wireless_dev *wdev = dev->ieee80211_ptr;
5094         struct cfg80211_chan_def chandef;
5095         int err;
5096
5097         err = nl80211_parse_chandef(rdev, info, &chandef);
5098         if (err)
5099                 return err;
5100
5101         if (wdev->cac_started)
5102                 return -EBUSY;
5103
5104         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5105         if (err < 0)
5106                 return err;
5107
5108         if (err == 0)
5109                 return -EINVAL;
5110
5111         if (chandef.chan->dfs_state != NL80211_DFS_USABLE)
5112                 return -EINVAL;
5113
5114         if (!rdev->ops->start_radar_detection)
5115                 return -EOPNOTSUPP;
5116
5117         mutex_lock(&rdev->devlist_mtx);
5118         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5119                                            chandef.chan, CHAN_MODE_SHARED,
5120                                            BIT(chandef.width));
5121         if (err)
5122                 goto err_locked;
5123
5124         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5125         if (!err) {
5126                 wdev->channel = chandef.chan;
5127                 wdev->cac_started = true;
5128                 wdev->cac_start_time = jiffies;
5129         }
5130 err_locked:
5131         mutex_unlock(&rdev->devlist_mtx);
5132
5133         return err;
5134 }
5135
5136 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5137                             u32 seq, int flags,
5138                             struct cfg80211_registered_device *rdev,
5139                             struct wireless_dev *wdev,
5140                             struct cfg80211_internal_bss *intbss)
5141 {
5142         struct cfg80211_bss *res = &intbss->pub;
5143         const struct cfg80211_bss_ies *ies;
5144         void *hdr;
5145         struct nlattr *bss;
5146         bool tsf = false;
5147
5148         ASSERT_WDEV_LOCK(wdev);
5149
5150         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5151                              NL80211_CMD_NEW_SCAN_RESULTS);
5152         if (!hdr)
5153                 return -1;
5154
5155         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5156
5157         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
5158             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5159                 goto nla_put_failure;
5160
5161         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5162         if (!bss)
5163                 goto nla_put_failure;
5164         if ((!is_zero_ether_addr(res->bssid) &&
5165              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5166                 goto nla_put_failure;
5167
5168         rcu_read_lock();
5169         ies = rcu_dereference(res->ies);
5170         if (ies) {
5171                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5172                         goto fail_unlock_rcu;
5173                 tsf = true;
5174                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5175                                         ies->len, ies->data))
5176                         goto fail_unlock_rcu;
5177         }
5178         ies = rcu_dereference(res->beacon_ies);
5179         if (ies) {
5180                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5181                         goto fail_unlock_rcu;
5182                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5183                                         ies->len, ies->data))
5184                         goto fail_unlock_rcu;
5185         }
5186         rcu_read_unlock();
5187
5188         if (res->beacon_interval &&
5189             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5190                 goto nla_put_failure;
5191         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5192             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5193             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5194                         jiffies_to_msecs(jiffies - intbss->ts)))
5195                 goto nla_put_failure;
5196
5197         switch (rdev->wiphy.signal_type) {
5198         case CFG80211_SIGNAL_TYPE_MBM:
5199                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5200                         goto nla_put_failure;
5201                 break;
5202         case CFG80211_SIGNAL_TYPE_UNSPEC:
5203                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5204                         goto nla_put_failure;
5205                 break;
5206         default:
5207                 break;
5208         }
5209
5210         switch (wdev->iftype) {
5211         case NL80211_IFTYPE_P2P_CLIENT:
5212         case NL80211_IFTYPE_STATION:
5213                 if (intbss == wdev->current_bss &&
5214                     nla_put_u32(msg, NL80211_BSS_STATUS,
5215                                 NL80211_BSS_STATUS_ASSOCIATED))
5216                         goto nla_put_failure;
5217                 break;
5218         case NL80211_IFTYPE_ADHOC:
5219                 if (intbss == wdev->current_bss &&
5220                     nla_put_u32(msg, NL80211_BSS_STATUS,
5221                                 NL80211_BSS_STATUS_IBSS_JOINED))
5222                         goto nla_put_failure;
5223                 break;
5224         default:
5225                 break;
5226         }
5227
5228         nla_nest_end(msg, bss);
5229
5230         return genlmsg_end(msg, hdr);
5231
5232  fail_unlock_rcu:
5233         rcu_read_unlock();
5234  nla_put_failure:
5235         genlmsg_cancel(msg, hdr);
5236         return -EMSGSIZE;
5237 }
5238
5239 static int nl80211_dump_scan(struct sk_buff *skb,
5240                              struct netlink_callback *cb)
5241 {
5242         struct cfg80211_registered_device *rdev;
5243         struct net_device *dev;
5244         struct cfg80211_internal_bss *scan;
5245         struct wireless_dev *wdev;
5246         int start = cb->args[1], idx = 0;
5247         int err;
5248
5249         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
5250         if (err)
5251                 return err;
5252
5253         wdev = dev->ieee80211_ptr;
5254
5255         wdev_lock(wdev);
5256         spin_lock_bh(&rdev->bss_lock);
5257         cfg80211_bss_expire(rdev);
5258
5259         cb->seq = rdev->bss_generation;
5260
5261         list_for_each_entry(scan, &rdev->bss_list, list) {
5262                 if (++idx <= start)
5263                         continue;
5264                 if (nl80211_send_bss(skb, cb,
5265                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5266                                 rdev, wdev, scan) < 0) {
5267                         idx--;
5268                         break;
5269                 }
5270         }
5271
5272         spin_unlock_bh(&rdev->bss_lock);
5273         wdev_unlock(wdev);
5274
5275         cb->args[1] = idx;
5276         nl80211_finish_netdev_dump(rdev);
5277
5278         return skb->len;
5279 }
5280
5281 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
5282                                 int flags, struct net_device *dev,
5283                                 struct survey_info *survey)
5284 {
5285         void *hdr;
5286         struct nlattr *infoattr;
5287
5288         hdr = nl80211hdr_put(msg, portid, seq, flags,
5289                              NL80211_CMD_NEW_SURVEY_RESULTS);
5290         if (!hdr)
5291                 return -ENOMEM;
5292
5293         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
5294                 goto nla_put_failure;
5295
5296         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
5297         if (!infoattr)
5298                 goto nla_put_failure;
5299
5300         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
5301                         survey->channel->center_freq))
5302                 goto nla_put_failure;
5303
5304         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
5305             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
5306                 goto nla_put_failure;
5307         if ((survey->filled & SURVEY_INFO_IN_USE) &&
5308             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
5309                 goto nla_put_failure;
5310         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
5311             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
5312                         survey->channel_time))
5313                 goto nla_put_failure;
5314         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
5315             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
5316                         survey->channel_time_busy))
5317                 goto nla_put_failure;
5318         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
5319             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
5320                         survey->channel_time_ext_busy))
5321                 goto nla_put_failure;
5322         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
5323             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
5324                         survey->channel_time_rx))
5325                 goto nla_put_failure;
5326         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
5327             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
5328                         survey->channel_time_tx))
5329                 goto nla_put_failure;
5330
5331         nla_nest_end(msg, infoattr);
5332
5333         return genlmsg_end(msg, hdr);
5334
5335  nla_put_failure:
5336         genlmsg_cancel(msg, hdr);
5337         return -EMSGSIZE;
5338 }
5339
5340 static int nl80211_dump_survey(struct sk_buff *skb,
5341                         struct netlink_callback *cb)
5342 {
5343         struct survey_info survey;
5344         struct cfg80211_registered_device *dev;
5345         struct net_device *netdev;
5346         int survey_idx = cb->args[1];
5347         int res;
5348
5349         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
5350         if (res)
5351                 return res;
5352
5353         if (!dev->ops->dump_survey) {
5354                 res = -EOPNOTSUPP;
5355                 goto out_err;
5356         }
5357
5358         while (1) {
5359                 struct ieee80211_channel *chan;
5360
5361                 res = rdev_dump_survey(dev, netdev, survey_idx, &survey);
5362                 if (res == -ENOENT)
5363                         break;
5364                 if (res)
5365                         goto out_err;
5366
5367                 /* Survey without a channel doesn't make sense */
5368                 if (!survey.channel) {
5369                         res = -EINVAL;
5370                         goto out;
5371                 }
5372
5373                 chan = ieee80211_get_channel(&dev->wiphy,
5374                                              survey.channel->center_freq);
5375                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
5376                         survey_idx++;
5377                         continue;
5378                 }
5379
5380                 if (nl80211_send_survey(skb,
5381                                 NETLINK_CB(cb->skb).portid,
5382                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5383                                 netdev,
5384                                 &survey) < 0)
5385                         goto out;
5386                 survey_idx++;
5387         }
5388
5389  out:
5390         cb->args[1] = survey_idx;
5391         res = skb->len;
5392  out_err:
5393         nl80211_finish_netdev_dump(dev);
5394         return res;
5395 }
5396
5397 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
5398 {
5399         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
5400                                   NL80211_WPA_VERSION_2));
5401 }
5402
5403 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
5404 {
5405         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5406         struct net_device *dev = info->user_ptr[1];
5407         struct ieee80211_channel *chan;
5408         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
5409         int err, ssid_len, ie_len = 0, sae_data_len = 0;
5410         enum nl80211_auth_type auth_type;
5411         struct key_parse key;
5412         bool local_state_change;
5413
5414         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5415                 return -EINVAL;
5416
5417         if (!info->attrs[NL80211_ATTR_MAC])
5418                 return -EINVAL;
5419
5420         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
5421                 return -EINVAL;
5422
5423         if (!info->attrs[NL80211_ATTR_SSID])
5424                 return -EINVAL;
5425
5426         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
5427                 return -EINVAL;
5428
5429         err = nl80211_parse_key(info, &key);
5430         if (err)
5431                 return err;
5432
5433         if (key.idx >= 0) {
5434                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5435                         return -EINVAL;
5436                 if (!key.p.key || !key.p.key_len)
5437                         return -EINVAL;
5438                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5439                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5440                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5441                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5442                         return -EINVAL;
5443                 if (key.idx > 4)
5444                         return -EINVAL;
5445         } else {
5446                 key.p.key_len = 0;
5447                 key.p.key = NULL;
5448         }
5449
5450         if (key.idx >= 0) {
5451                 int i;
5452                 bool ok = false;
5453                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5454                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5455                                 ok = true;
5456                                 break;
5457                         }
5458                 }
5459                 if (!ok)
5460                         return -EINVAL;
5461         }
5462
5463         if (!rdev->ops->auth)
5464                 return -EOPNOTSUPP;
5465
5466         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5467             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5468                 return -EOPNOTSUPP;
5469
5470         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5471         chan = ieee80211_get_channel(&rdev->wiphy,
5472                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5473         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5474                 return -EINVAL;
5475
5476         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5477         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5478
5479         if (info->attrs[NL80211_ATTR_IE]) {
5480                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5481                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5482         }
5483
5484         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5485         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5486                 return -EINVAL;
5487
5488         if (auth_type == NL80211_AUTHTYPE_SAE &&
5489             !info->attrs[NL80211_ATTR_SAE_DATA])
5490                 return -EINVAL;
5491
5492         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5493                 if (auth_type != NL80211_AUTHTYPE_SAE)
5494                         return -EINVAL;
5495                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5496                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5497                 /* need to include at least Auth Transaction and Status Code */
5498                 if (sae_data_len < 4)
5499                         return -EINVAL;
5500         }
5501
5502         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5503
5504         /*
5505          * Since we no longer track auth state, ignore
5506          * requests to only change local state.
5507          */
5508         if (local_state_change)
5509                 return 0;
5510
5511         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5512                                   ssid, ssid_len, ie, ie_len,
5513                                   key.p.key, key.p.key_len, key.idx,
5514                                   sae_data, sae_data_len);
5515 }
5516
5517 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5518                                    struct genl_info *info,
5519                                    struct cfg80211_crypto_settings *settings,
5520                                    int cipher_limit)
5521 {
5522         memset(settings, 0, sizeof(*settings));
5523
5524         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5525
5526         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5527                 u16 proto;
5528                 proto = nla_get_u16(
5529                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5530                 settings->control_port_ethertype = cpu_to_be16(proto);
5531                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5532                     proto != ETH_P_PAE)
5533                         return -EINVAL;
5534                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5535                         settings->control_port_no_encrypt = true;
5536         } else
5537                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5538
5539         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5540                 void *data;
5541                 int len, i;
5542
5543                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5544                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5545                 settings->n_ciphers_pairwise = len / sizeof(u32);
5546
5547                 if (len % sizeof(u32))
5548                         return -EINVAL;
5549
5550                 if (settings->n_ciphers_pairwise > cipher_limit)
5551                         return -EINVAL;
5552
5553                 memcpy(settings->ciphers_pairwise, data, len);
5554
5555                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5556                         if (!cfg80211_supported_cipher_suite(
5557                                         &rdev->wiphy,
5558                                         settings->ciphers_pairwise[i]))
5559                                 return -EINVAL;
5560         }
5561
5562         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5563                 settings->cipher_group =
5564                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5565                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5566                                                      settings->cipher_group))
5567                         return -EINVAL;
5568         }
5569
5570         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5571                 settings->wpa_versions =
5572                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5573                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5574                         return -EINVAL;
5575         }
5576
5577         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5578                 void *data;
5579                 int len;
5580
5581                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5582                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5583                 settings->n_akm_suites = len / sizeof(u32);
5584
5585                 if (len % sizeof(u32))
5586                         return -EINVAL;
5587
5588                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
5589                         return -EINVAL;
5590
5591                 memcpy(settings->akm_suites, data, len);
5592         }
5593
5594         return 0;
5595 }
5596
5597 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
5598 {
5599         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5600         struct net_device *dev = info->user_ptr[1];
5601         struct cfg80211_crypto_settings crypto;
5602         struct ieee80211_channel *chan;
5603         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
5604         int err, ssid_len, ie_len = 0;
5605         bool use_mfp = false;
5606         u32 flags = 0;
5607         struct ieee80211_ht_cap *ht_capa = NULL;
5608         struct ieee80211_ht_cap *ht_capa_mask = NULL;
5609
5610         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5611                 return -EINVAL;
5612
5613         if (!info->attrs[NL80211_ATTR_MAC] ||
5614             !info->attrs[NL80211_ATTR_SSID] ||
5615             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5616                 return -EINVAL;
5617
5618         if (!rdev->ops->assoc)
5619                 return -EOPNOTSUPP;
5620
5621         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5622             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5623                 return -EOPNOTSUPP;
5624
5625         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5626
5627         chan = ieee80211_get_channel(&rdev->wiphy,
5628                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5629         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5630                 return -EINVAL;
5631
5632         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5633         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5634
5635         if (info->attrs[NL80211_ATTR_IE]) {
5636                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5637                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5638         }
5639
5640         if (info->attrs[NL80211_ATTR_USE_MFP]) {
5641                 enum nl80211_mfp mfp =
5642                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
5643                 if (mfp == NL80211_MFP_REQUIRED)
5644                         use_mfp = true;
5645                 else if (mfp != NL80211_MFP_NO)
5646                         return -EINVAL;
5647         }
5648
5649         if (info->attrs[NL80211_ATTR_PREV_BSSID])
5650                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
5651
5652         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5653                 flags |= ASSOC_REQ_DISABLE_HT;
5654
5655         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5656                 ht_capa_mask =
5657                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
5658
5659         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5660                 if (!ht_capa_mask)
5661                         return -EINVAL;
5662                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5663         }
5664
5665         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
5666         if (!err)
5667                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
5668                                           ssid, ssid_len, ie, ie_len, use_mfp,
5669                                           &crypto, flags, ht_capa,
5670                                           ht_capa_mask);
5671
5672         return err;
5673 }
5674
5675 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
5676 {
5677         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5678         struct net_device *dev = info->user_ptr[1];
5679         const u8 *ie = NULL, *bssid;
5680         int ie_len = 0;
5681         u16 reason_code;
5682         bool local_state_change;
5683
5684         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5685                 return -EINVAL;
5686
5687         if (!info->attrs[NL80211_ATTR_MAC])
5688                 return -EINVAL;
5689
5690         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5691                 return -EINVAL;
5692
5693         if (!rdev->ops->deauth)
5694                 return -EOPNOTSUPP;
5695
5696         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5697             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5698                 return -EOPNOTSUPP;
5699
5700         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5701
5702         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5703         if (reason_code == 0) {
5704                 /* Reason Code 0 is reserved */
5705                 return -EINVAL;
5706         }
5707
5708         if (info->attrs[NL80211_ATTR_IE]) {
5709                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5710                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5711         }
5712
5713         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5714
5715         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
5716                                     local_state_change);
5717 }
5718
5719 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
5720 {
5721         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5722         struct net_device *dev = info->user_ptr[1];
5723         const u8 *ie = NULL, *bssid;
5724         int ie_len = 0;
5725         u16 reason_code;
5726         bool local_state_change;
5727
5728         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5729                 return -EINVAL;
5730
5731         if (!info->attrs[NL80211_ATTR_MAC])
5732                 return -EINVAL;
5733
5734         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5735                 return -EINVAL;
5736
5737         if (!rdev->ops->disassoc)
5738                 return -EOPNOTSUPP;
5739
5740         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5741             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5742                 return -EOPNOTSUPP;
5743
5744         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5745
5746         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5747         if (reason_code == 0) {
5748                 /* Reason Code 0 is reserved */
5749                 return -EINVAL;
5750         }
5751
5752         if (info->attrs[NL80211_ATTR_IE]) {
5753                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5754                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5755         }
5756
5757         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5758
5759         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
5760                                       local_state_change);
5761 }
5762
5763 static bool
5764 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
5765                          int mcast_rate[IEEE80211_NUM_BANDS],
5766                          int rateval)
5767 {
5768         struct wiphy *wiphy = &rdev->wiphy;
5769         bool found = false;
5770         int band, i;
5771
5772         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5773                 struct ieee80211_supported_band *sband;
5774
5775                 sband = wiphy->bands[band];
5776                 if (!sband)
5777                         continue;
5778
5779                 for (i = 0; i < sband->n_bitrates; i++) {
5780                         if (sband->bitrates[i].bitrate == rateval) {
5781                                 mcast_rate[band] = i + 1;
5782                                 found = true;
5783                                 break;
5784                         }
5785                 }
5786         }
5787
5788         return found;
5789 }
5790
5791 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
5792 {
5793         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5794         struct net_device *dev = info->user_ptr[1];
5795         struct cfg80211_ibss_params ibss;
5796         struct wiphy *wiphy;
5797         struct cfg80211_cached_keys *connkeys = NULL;
5798         int err;
5799
5800         memset(&ibss, 0, sizeof(ibss));
5801
5802         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5803                 return -EINVAL;
5804
5805         if (!info->attrs[NL80211_ATTR_SSID] ||
5806             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5807                 return -EINVAL;
5808
5809         ibss.beacon_interval = 100;
5810
5811         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
5812                 ibss.beacon_interval =
5813                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5814                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
5815                         return -EINVAL;
5816         }
5817
5818         if (!rdev->ops->join_ibss)
5819                 return -EOPNOTSUPP;
5820
5821         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5822                 return -EOPNOTSUPP;
5823
5824         wiphy = &rdev->wiphy;
5825
5826         if (info->attrs[NL80211_ATTR_MAC]) {
5827                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5828
5829                 if (!is_valid_ether_addr(ibss.bssid))
5830                         return -EINVAL;
5831         }
5832         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5833         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5834
5835         if (info->attrs[NL80211_ATTR_IE]) {
5836                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5837                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5838         }
5839
5840         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
5841         if (err)
5842                 return err;
5843
5844         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
5845                 return -EINVAL;
5846
5847         if (ibss.chandef.width > NL80211_CHAN_WIDTH_40)
5848                 return -EINVAL;
5849         if (ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
5850             !(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
5851                 return -EINVAL;
5852
5853         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
5854         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5855
5856         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5857                 u8 *rates =
5858                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5859                 int n_rates =
5860                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5861                 struct ieee80211_supported_band *sband =
5862                         wiphy->bands[ibss.chandef.chan->band];
5863
5864                 err = ieee80211_get_ratemask(sband, rates, n_rates,
5865                                              &ibss.basic_rates);
5866                 if (err)
5867                         return err;
5868         }
5869
5870         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5871             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
5872                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5873                 return -EINVAL;
5874
5875         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5876                 bool no_ht = false;
5877
5878                 connkeys = nl80211_parse_connkeys(rdev,
5879                                           info->attrs[NL80211_ATTR_KEYS],
5880                                           &no_ht);
5881                 if (IS_ERR(connkeys))
5882                         return PTR_ERR(connkeys);
5883
5884                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
5885                     no_ht) {
5886                         kfree(connkeys);
5887                         return -EINVAL;
5888                 }
5889         }
5890
5891         ibss.control_port =
5892                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
5893
5894         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
5895         if (err)
5896                 kfree(connkeys);
5897         return err;
5898 }
5899
5900 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
5901 {
5902         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5903         struct net_device *dev = info->user_ptr[1];
5904
5905         if (!rdev->ops->leave_ibss)
5906                 return -EOPNOTSUPP;
5907
5908         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5909                 return -EOPNOTSUPP;
5910
5911         return cfg80211_leave_ibss(rdev, dev, false);
5912 }
5913
5914 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
5915 {
5916         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5917         struct net_device *dev = info->user_ptr[1];
5918         int mcast_rate[IEEE80211_NUM_BANDS];
5919         u32 nla_rate;
5920         int err;
5921
5922         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5923             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5924                 return -EOPNOTSUPP;
5925
5926         if (!rdev->ops->set_mcast_rate)
5927                 return -EOPNOTSUPP;
5928
5929         memset(mcast_rate, 0, sizeof(mcast_rate));
5930
5931         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
5932                 return -EINVAL;
5933
5934         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
5935         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
5936                 return -EINVAL;
5937
5938         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
5939
5940         return err;
5941 }
5942
5943
5944 #ifdef CONFIG_NL80211_TESTMODE
5945 static struct genl_multicast_group nl80211_testmode_mcgrp = {
5946         .name = "testmode",
5947 };
5948
5949 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
5950 {
5951         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5952         int err;
5953
5954         if (!info->attrs[NL80211_ATTR_TESTDATA])
5955                 return -EINVAL;
5956
5957         err = -EOPNOTSUPP;
5958         if (rdev->ops->testmode_cmd) {
5959                 rdev->testmode_info = info;
5960                 err = rdev_testmode_cmd(rdev,
5961                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
5962                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
5963                 rdev->testmode_info = NULL;
5964         }
5965
5966         return err;
5967 }
5968
5969 static int nl80211_testmode_dump(struct sk_buff *skb,
5970                                  struct netlink_callback *cb)
5971 {
5972         struct cfg80211_registered_device *rdev;
5973         int err;
5974         long phy_idx;
5975         void *data = NULL;
5976         int data_len = 0;
5977
5978         if (cb->args[0]) {
5979                 /*
5980                  * 0 is a valid index, but not valid for args[0],
5981                  * so we need to offset by 1.
5982                  */
5983                 phy_idx = cb->args[0] - 1;
5984         } else {
5985                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
5986                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
5987                                   nl80211_policy);
5988                 if (err)
5989                         return err;
5990
5991                 mutex_lock(&cfg80211_mutex);
5992                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
5993                                                   nl80211_fam.attrbuf);
5994                 if (IS_ERR(rdev)) {
5995                         mutex_unlock(&cfg80211_mutex);
5996                         return PTR_ERR(rdev);
5997                 }
5998                 phy_idx = rdev->wiphy_idx;
5999                 rdev = NULL;
6000                 mutex_unlock(&cfg80211_mutex);
6001
6002                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6003                         cb->args[1] =
6004                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6005         }
6006
6007         if (cb->args[1]) {
6008                 data = nla_data((void *)cb->args[1]);
6009                 data_len = nla_len((void *)cb->args[1]);
6010         }
6011
6012         mutex_lock(&cfg80211_mutex);
6013         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6014         if (!rdev) {
6015                 mutex_unlock(&cfg80211_mutex);
6016                 return -ENOENT;
6017         }
6018         cfg80211_lock_rdev(rdev);
6019         mutex_unlock(&cfg80211_mutex);
6020
6021         if (!rdev->ops->testmode_dump) {
6022                 err = -EOPNOTSUPP;
6023                 goto out_err;
6024         }
6025
6026         while (1) {
6027                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6028                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6029                                            NL80211_CMD_TESTMODE);
6030                 struct nlattr *tmdata;
6031
6032                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6033                         genlmsg_cancel(skb, hdr);
6034                         break;
6035                 }
6036
6037                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6038                 if (!tmdata) {
6039                         genlmsg_cancel(skb, hdr);
6040                         break;
6041                 }
6042                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6043                 nla_nest_end(skb, tmdata);
6044
6045                 if (err == -ENOBUFS || err == -ENOENT) {
6046                         genlmsg_cancel(skb, hdr);
6047                         break;
6048                 } else if (err) {
6049                         genlmsg_cancel(skb, hdr);
6050                         goto out_err;
6051                 }
6052
6053                 genlmsg_end(skb, hdr);
6054         }
6055
6056         err = skb->len;
6057         /* see above */
6058         cb->args[0] = phy_idx + 1;
6059  out_err:
6060         cfg80211_unlock_rdev(rdev);
6061         return err;
6062 }
6063
6064 static struct sk_buff *
6065 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
6066                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
6067 {
6068         struct sk_buff *skb;
6069         void *hdr;
6070         struct nlattr *data;
6071
6072         skb = nlmsg_new(approxlen + 100, gfp);
6073         if (!skb)
6074                 return NULL;
6075
6076         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
6077         if (!hdr) {
6078                 kfree_skb(skb);
6079                 return NULL;
6080         }
6081
6082         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6083                 goto nla_put_failure;
6084         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6085
6086         ((void **)skb->cb)[0] = rdev;
6087         ((void **)skb->cb)[1] = hdr;
6088         ((void **)skb->cb)[2] = data;
6089
6090         return skb;
6091
6092  nla_put_failure:
6093         kfree_skb(skb);
6094         return NULL;
6095 }
6096
6097 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
6098                                                   int approxlen)
6099 {
6100         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6101
6102         if (WARN_ON(!rdev->testmode_info))
6103                 return NULL;
6104
6105         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
6106                                 rdev->testmode_info->snd_portid,
6107                                 rdev->testmode_info->snd_seq,
6108                                 GFP_KERNEL);
6109 }
6110 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
6111
6112 int cfg80211_testmode_reply(struct sk_buff *skb)
6113 {
6114         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6115         void *hdr = ((void **)skb->cb)[1];
6116         struct nlattr *data = ((void **)skb->cb)[2];
6117
6118         if (WARN_ON(!rdev->testmode_info)) {
6119                 kfree_skb(skb);
6120                 return -EINVAL;
6121         }
6122
6123         nla_nest_end(skb, data);
6124         genlmsg_end(skb, hdr);
6125         return genlmsg_reply(skb, rdev->testmode_info);
6126 }
6127 EXPORT_SYMBOL(cfg80211_testmode_reply);
6128
6129 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
6130                                                   int approxlen, gfp_t gfp)
6131 {
6132         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6133
6134         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
6135 }
6136 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
6137
6138 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
6139 {
6140         void *hdr = ((void **)skb->cb)[1];
6141         struct nlattr *data = ((void **)skb->cb)[2];
6142
6143         nla_nest_end(skb, data);
6144         genlmsg_end(skb, hdr);
6145         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
6146 }
6147 EXPORT_SYMBOL(cfg80211_testmode_event);
6148 #endif
6149
6150 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6151 {
6152         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6153         struct net_device *dev = info->user_ptr[1];
6154         struct cfg80211_connect_params connect;
6155         struct wiphy *wiphy;
6156         struct cfg80211_cached_keys *connkeys = NULL;
6157         int err;
6158
6159         memset(&connect, 0, sizeof(connect));
6160
6161         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6162                 return -EINVAL;
6163
6164         if (!info->attrs[NL80211_ATTR_SSID] ||
6165             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6166                 return -EINVAL;
6167
6168         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6169                 connect.auth_type =
6170                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6171                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6172                                              NL80211_CMD_CONNECT))
6173                         return -EINVAL;
6174         } else
6175                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6176
6177         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6178
6179         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6180                                       NL80211_MAX_NR_CIPHER_SUITES);
6181         if (err)
6182                 return err;
6183
6184         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6185             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6186                 return -EOPNOTSUPP;
6187
6188         wiphy = &rdev->wiphy;
6189
6190         connect.bg_scan_period = -1;
6191         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6192                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6193                 connect.bg_scan_period =
6194                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6195         }
6196
6197         if (info->attrs[NL80211_ATTR_MAC])
6198                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6199         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6200         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6201
6202         if (info->attrs[NL80211_ATTR_IE]) {
6203                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6204                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6205         }
6206
6207         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6208                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6209                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6210                     connect.mfp != NL80211_MFP_NO)
6211                         return -EINVAL;
6212         } else {
6213                 connect.mfp = NL80211_MFP_NO;
6214         }
6215
6216         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6217                 connect.channel =
6218                         ieee80211_get_channel(wiphy,
6219                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6220                 if (!connect.channel ||
6221                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
6222                         return -EINVAL;
6223         }
6224
6225         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6226                 connkeys = nl80211_parse_connkeys(rdev,
6227                                           info->attrs[NL80211_ATTR_KEYS], NULL);
6228                 if (IS_ERR(connkeys))
6229                         return PTR_ERR(connkeys);
6230         }
6231
6232         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6233                 connect.flags |= ASSOC_REQ_DISABLE_HT;
6234
6235         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6236                 memcpy(&connect.ht_capa_mask,
6237                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6238                        sizeof(connect.ht_capa_mask));
6239
6240         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6241                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
6242                         kfree(connkeys);
6243                         return -EINVAL;
6244                 }
6245                 memcpy(&connect.ht_capa,
6246                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6247                        sizeof(connect.ht_capa));
6248         }
6249
6250         err = cfg80211_connect(rdev, dev, &connect, connkeys);
6251         if (err)
6252                 kfree(connkeys);
6253         return err;
6254 }
6255
6256 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
6257 {
6258         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6259         struct net_device *dev = info->user_ptr[1];
6260         u16 reason;
6261
6262         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6263                 reason = WLAN_REASON_DEAUTH_LEAVING;
6264         else
6265                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6266
6267         if (reason == 0)
6268                 return -EINVAL;
6269
6270         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6271             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6272                 return -EOPNOTSUPP;
6273
6274         return cfg80211_disconnect(rdev, dev, reason, true);
6275 }
6276
6277 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
6278 {
6279         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6280         struct net *net;
6281         int err;
6282         u32 pid;
6283
6284         if (!info->attrs[NL80211_ATTR_PID])
6285                 return -EINVAL;
6286
6287         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
6288
6289         net = get_net_ns_by_pid(pid);
6290         if (IS_ERR(net))
6291                 return PTR_ERR(net);
6292
6293         err = 0;
6294
6295         /* check if anything to do */
6296         if (!net_eq(wiphy_net(&rdev->wiphy), net))
6297                 err = cfg80211_switch_netns(rdev, net);
6298
6299         put_net(net);
6300         return err;
6301 }
6302
6303 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
6304 {
6305         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6306         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
6307                         struct cfg80211_pmksa *pmksa) = NULL;
6308         struct net_device *dev = info->user_ptr[1];
6309         struct cfg80211_pmksa pmksa;
6310
6311         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
6312
6313         if (!info->attrs[NL80211_ATTR_MAC])
6314                 return -EINVAL;
6315
6316         if (!info->attrs[NL80211_ATTR_PMKID])
6317                 return -EINVAL;
6318
6319         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
6320         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6321
6322         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6323             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6324                 return -EOPNOTSUPP;
6325
6326         switch (info->genlhdr->cmd) {
6327         case NL80211_CMD_SET_PMKSA:
6328                 rdev_ops = rdev->ops->set_pmksa;
6329                 break;
6330         case NL80211_CMD_DEL_PMKSA:
6331                 rdev_ops = rdev->ops->del_pmksa;
6332                 break;
6333         default:
6334                 WARN_ON(1);
6335                 break;
6336         }
6337
6338         if (!rdev_ops)
6339                 return -EOPNOTSUPP;
6340
6341         return rdev_ops(&rdev->wiphy, dev, &pmksa);
6342 }
6343
6344 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
6345 {
6346         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6347         struct net_device *dev = info->user_ptr[1];
6348
6349         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6350             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6351                 return -EOPNOTSUPP;
6352
6353         if (!rdev->ops->flush_pmksa)
6354                 return -EOPNOTSUPP;
6355
6356         return rdev_flush_pmksa(rdev, dev);
6357 }
6358
6359 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
6360 {
6361         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6362         struct net_device *dev = info->user_ptr[1];
6363         u8 action_code, dialog_token;
6364         u16 status_code;
6365         u8 *peer;
6366
6367         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6368             !rdev->ops->tdls_mgmt)
6369                 return -EOPNOTSUPP;
6370
6371         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
6372             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
6373             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
6374             !info->attrs[NL80211_ATTR_IE] ||
6375             !info->attrs[NL80211_ATTR_MAC])
6376                 return -EINVAL;
6377
6378         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6379         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
6380         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
6381         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
6382
6383         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
6384                               dialog_token, status_code,
6385                               nla_data(info->attrs[NL80211_ATTR_IE]),
6386                               nla_len(info->attrs[NL80211_ATTR_IE]));
6387 }
6388
6389 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
6390 {
6391         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6392         struct net_device *dev = info->user_ptr[1];
6393         enum nl80211_tdls_operation operation;
6394         u8 *peer;
6395
6396         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
6397             !rdev->ops->tdls_oper)
6398                 return -EOPNOTSUPP;
6399
6400         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
6401             !info->attrs[NL80211_ATTR_MAC])
6402                 return -EINVAL;
6403
6404         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
6405         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
6406
6407         return rdev_tdls_oper(rdev, dev, peer, operation);
6408 }
6409
6410 static int nl80211_remain_on_channel(struct sk_buff *skb,
6411                                      struct genl_info *info)
6412 {
6413         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6414         struct wireless_dev *wdev = info->user_ptr[1];
6415         struct cfg80211_chan_def chandef;
6416         struct sk_buff *msg;
6417         void *hdr;
6418         u64 cookie;
6419         u32 duration;
6420         int err;
6421
6422         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
6423             !info->attrs[NL80211_ATTR_DURATION])
6424                 return -EINVAL;
6425
6426         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6427
6428         if (!rdev->ops->remain_on_channel ||
6429             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
6430                 return -EOPNOTSUPP;
6431
6432         /*
6433          * We should be on that channel for at least a minimum amount of
6434          * time (10ms) but no longer than the driver supports.
6435          */
6436         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6437             duration > rdev->wiphy.max_remain_on_channel_duration)
6438                 return -EINVAL;
6439
6440         err = nl80211_parse_chandef(rdev, info, &chandef);
6441         if (err)
6442                 return err;
6443
6444         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6445         if (!msg)
6446                 return -ENOMEM;
6447
6448         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6449                              NL80211_CMD_REMAIN_ON_CHANNEL);
6450
6451         if (IS_ERR(hdr)) {
6452                 err = PTR_ERR(hdr);
6453                 goto free_msg;
6454         }
6455
6456         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6457                                      duration, &cookie);
6458
6459         if (err)
6460                 goto free_msg;
6461
6462         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6463                 goto nla_put_failure;
6464
6465         genlmsg_end(msg, hdr);
6466
6467         return genlmsg_reply(msg, info);
6468
6469  nla_put_failure:
6470         err = -ENOBUFS;
6471  free_msg:
6472         nlmsg_free(msg);
6473         return err;
6474 }
6475
6476 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6477                                             struct genl_info *info)
6478 {
6479         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6480         struct wireless_dev *wdev = info->user_ptr[1];
6481         u64 cookie;
6482
6483         if (!info->attrs[NL80211_ATTR_COOKIE])
6484                 return -EINVAL;
6485
6486         if (!rdev->ops->cancel_remain_on_channel)
6487                 return -EOPNOTSUPP;
6488
6489         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6490
6491         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6492 }
6493
6494 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6495                            u8 *rates, u8 rates_len)
6496 {
6497         u8 i;
6498         u32 mask = 0;
6499
6500         for (i = 0; i < rates_len; i++) {
6501                 int rate = (rates[i] & 0x7f) * 5;
6502                 int ridx;
6503                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6504                         struct ieee80211_rate *srate =
6505                                 &sband->bitrates[ridx];
6506                         if (rate == srate->bitrate) {
6507                                 mask |= 1 << ridx;
6508                                 break;
6509                         }
6510                 }
6511                 if (ridx == sband->n_bitrates)
6512                         return 0; /* rate not found */
6513         }
6514
6515         return mask;
6516 }
6517
6518 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6519                                u8 *rates, u8 rates_len,
6520                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6521 {
6522         u8 i;
6523
6524         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6525
6526         for (i = 0; i < rates_len; i++) {
6527                 int ridx, rbit;
6528
6529                 ridx = rates[i] / 8;
6530                 rbit = BIT(rates[i] % 8);
6531
6532                 /* check validity */
6533                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6534                         return false;
6535
6536                 /* check availability */
6537                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
6538                         mcs[ridx] |= rbit;
6539                 else
6540                         return false;
6541         }
6542
6543         return true;
6544 }
6545
6546 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
6547         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
6548                                     .len = NL80211_MAX_SUPP_RATES },
6549         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
6550                                  .len = NL80211_MAX_SUPP_HT_RATES },
6551 };
6552
6553 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
6554                                        struct genl_info *info)
6555 {
6556         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
6557         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6558         struct cfg80211_bitrate_mask mask;
6559         int rem, i;
6560         struct net_device *dev = info->user_ptr[1];
6561         struct nlattr *tx_rates;
6562         struct ieee80211_supported_band *sband;
6563
6564         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
6565                 return -EINVAL;
6566
6567         if (!rdev->ops->set_bitrate_mask)
6568                 return -EOPNOTSUPP;
6569
6570         memset(&mask, 0, sizeof(mask));
6571         /* Default to all rates enabled */
6572         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
6573                 sband = rdev->wiphy.bands[i];
6574                 mask.control[i].legacy =
6575                         sband ? (1 << sband->n_bitrates) - 1 : 0;
6576                 if (sband)
6577                         memcpy(mask.control[i].mcs,
6578                                sband->ht_cap.mcs.rx_mask,
6579                                sizeof(mask.control[i].mcs));
6580                 else
6581                         memset(mask.control[i].mcs, 0,
6582                                sizeof(mask.control[i].mcs));
6583         }
6584
6585         /*
6586          * The nested attribute uses enum nl80211_band as the index. This maps
6587          * directly to the enum ieee80211_band values used in cfg80211.
6588          */
6589         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
6590         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
6591         {
6592                 enum ieee80211_band band = nla_type(tx_rates);
6593                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
6594                         return -EINVAL;
6595                 sband = rdev->wiphy.bands[band];
6596                 if (sband == NULL)
6597                         return -EINVAL;
6598                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
6599                           nla_len(tx_rates), nl80211_txattr_policy);
6600                 if (tb[NL80211_TXRATE_LEGACY]) {
6601                         mask.control[band].legacy = rateset_to_mask(
6602                                 sband,
6603                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
6604                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
6605                         if ((mask.control[band].legacy == 0) &&
6606                             nla_len(tb[NL80211_TXRATE_LEGACY]))
6607                                 return -EINVAL;
6608                 }
6609                 if (tb[NL80211_TXRATE_MCS]) {
6610                         if (!ht_rateset_to_mask(
6611                                         sband,
6612                                         nla_data(tb[NL80211_TXRATE_MCS]),
6613                                         nla_len(tb[NL80211_TXRATE_MCS]),
6614                                         mask.control[band].mcs))
6615                                 return -EINVAL;
6616                 }
6617
6618                 if (mask.control[band].legacy == 0) {
6619                         /* don't allow empty legacy rates if HT
6620                          * is not even supported. */
6621                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
6622                                 return -EINVAL;
6623
6624                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
6625                                 if (mask.control[band].mcs[i])
6626                                         break;
6627
6628                         /* legacy and mcs rates may not be both empty */
6629                         if (i == IEEE80211_HT_MCS_MASK_LEN)
6630                                 return -EINVAL;
6631                 }
6632         }
6633
6634         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
6635 }
6636
6637 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
6638 {
6639         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6640         struct wireless_dev *wdev = info->user_ptr[1];
6641         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
6642
6643         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
6644                 return -EINVAL;
6645
6646         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
6647                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
6648
6649         switch (wdev->iftype) {
6650         case NL80211_IFTYPE_STATION:
6651         case NL80211_IFTYPE_ADHOC:
6652         case NL80211_IFTYPE_P2P_CLIENT:
6653         case NL80211_IFTYPE_AP:
6654         case NL80211_IFTYPE_AP_VLAN:
6655         case NL80211_IFTYPE_MESH_POINT:
6656         case NL80211_IFTYPE_P2P_GO:
6657         case NL80211_IFTYPE_P2P_DEVICE:
6658                 break;
6659         default:
6660                 return -EOPNOTSUPP;
6661         }
6662
6663         /* not much point in registering if we can't reply */
6664         if (!rdev->ops->mgmt_tx)
6665                 return -EOPNOTSUPP;
6666
6667         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
6668                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
6669                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
6670 }
6671
6672 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
6673 {
6674         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6675         struct wireless_dev *wdev = info->user_ptr[1];
6676         struct cfg80211_chan_def chandef;
6677         int err;
6678         void *hdr = NULL;
6679         u64 cookie;
6680         struct sk_buff *msg = NULL;
6681         unsigned int wait = 0;
6682         bool offchan, no_cck, dont_wait_for_ack;
6683
6684         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
6685
6686         if (!info->attrs[NL80211_ATTR_FRAME])
6687                 return -EINVAL;
6688
6689         if (!rdev->ops->mgmt_tx)
6690                 return -EOPNOTSUPP;
6691
6692         switch (wdev->iftype) {
6693         case NL80211_IFTYPE_STATION:
6694         case NL80211_IFTYPE_ADHOC:
6695         case NL80211_IFTYPE_P2P_CLIENT:
6696         case NL80211_IFTYPE_AP:
6697         case NL80211_IFTYPE_AP_VLAN:
6698         case NL80211_IFTYPE_MESH_POINT:
6699         case NL80211_IFTYPE_P2P_GO:
6700         case NL80211_IFTYPE_P2P_DEVICE:
6701                 break;
6702         default:
6703                 return -EOPNOTSUPP;
6704         }
6705
6706         if (info->attrs[NL80211_ATTR_DURATION]) {
6707                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6708                         return -EINVAL;
6709                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6710
6711                 /*
6712                  * We should wait on the channel for at least a minimum amount
6713                  * of time (10ms) but no longer than the driver supports.
6714                  */
6715                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6716                     wait > rdev->wiphy.max_remain_on_channel_duration)
6717                         return -EINVAL;
6718
6719         }
6720
6721         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
6722
6723         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6724                 return -EINVAL;
6725
6726         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6727
6728         err = nl80211_parse_chandef(rdev, info, &chandef);
6729         if (err)
6730                 return err;
6731
6732         if (!dont_wait_for_ack) {
6733                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6734                 if (!msg)
6735                         return -ENOMEM;
6736
6737                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6738                                      NL80211_CMD_FRAME);
6739
6740                 if (IS_ERR(hdr)) {
6741                         err = PTR_ERR(hdr);
6742                         goto free_msg;
6743                 }
6744         }
6745
6746         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
6747                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
6748                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
6749                                     no_cck, dont_wait_for_ack, &cookie);
6750         if (err)
6751                 goto free_msg;
6752
6753         if (msg) {
6754                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6755                         goto nla_put_failure;
6756
6757                 genlmsg_end(msg, hdr);
6758                 return genlmsg_reply(msg, info);
6759         }
6760
6761         return 0;
6762
6763  nla_put_failure:
6764         err = -ENOBUFS;
6765  free_msg:
6766         nlmsg_free(msg);
6767         return err;
6768 }
6769
6770 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
6771 {
6772         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6773         struct wireless_dev *wdev = info->user_ptr[1];
6774         u64 cookie;
6775
6776         if (!info->attrs[NL80211_ATTR_COOKIE])
6777                 return -EINVAL;
6778
6779         if (!rdev->ops->mgmt_tx_cancel_wait)
6780                 return -EOPNOTSUPP;
6781
6782         switch (wdev->iftype) {
6783         case NL80211_IFTYPE_STATION:
6784         case NL80211_IFTYPE_ADHOC:
6785         case NL80211_IFTYPE_P2P_CLIENT:
6786         case NL80211_IFTYPE_AP:
6787         case NL80211_IFTYPE_AP_VLAN:
6788         case NL80211_IFTYPE_P2P_GO:
6789         case NL80211_IFTYPE_P2P_DEVICE:
6790                 break;
6791         default:
6792                 return -EOPNOTSUPP;
6793         }
6794
6795         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6796
6797         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
6798 }
6799
6800 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
6801 {
6802         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6803         struct wireless_dev *wdev;
6804         struct net_device *dev = info->user_ptr[1];
6805         u8 ps_state;
6806         bool state;
6807         int err;
6808
6809         if (!info->attrs[NL80211_ATTR_PS_STATE])
6810                 return -EINVAL;
6811
6812         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
6813
6814         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
6815                 return -EINVAL;
6816
6817         wdev = dev->ieee80211_ptr;
6818
6819         if (!rdev->ops->set_power_mgmt)
6820                 return -EOPNOTSUPP;
6821
6822         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
6823
6824         if (state == wdev->ps)
6825                 return 0;
6826
6827         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
6828         if (!err)
6829                 wdev->ps = state;
6830         return err;
6831 }
6832
6833 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
6834 {
6835         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6836         enum nl80211_ps_state ps_state;
6837         struct wireless_dev *wdev;
6838         struct net_device *dev = info->user_ptr[1];
6839         struct sk_buff *msg;
6840         void *hdr;
6841         int err;
6842
6843         wdev = dev->ieee80211_ptr;
6844
6845         if (!rdev->ops->set_power_mgmt)
6846                 return -EOPNOTSUPP;
6847
6848         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6849         if (!msg)
6850                 return -ENOMEM;
6851
6852         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6853                              NL80211_CMD_GET_POWER_SAVE);
6854         if (!hdr) {
6855                 err = -ENOBUFS;
6856                 goto free_msg;
6857         }
6858
6859         if (wdev->ps)
6860                 ps_state = NL80211_PS_ENABLED;
6861         else
6862                 ps_state = NL80211_PS_DISABLED;
6863
6864         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
6865                 goto nla_put_failure;
6866
6867         genlmsg_end(msg, hdr);
6868         return genlmsg_reply(msg, info);
6869
6870  nla_put_failure:
6871         err = -ENOBUFS;
6872  free_msg:
6873         nlmsg_free(msg);
6874         return err;
6875 }
6876
6877 static struct nla_policy
6878 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
6879         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
6880         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
6881         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
6882         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
6883         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
6884         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
6885 };
6886
6887 static int nl80211_set_cqm_txe(struct genl_info *info,
6888                                u32 rate, u32 pkts, u32 intvl)
6889 {
6890         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6891         struct wireless_dev *wdev;
6892         struct net_device *dev = info->user_ptr[1];
6893
6894         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
6895                 return -EINVAL;
6896
6897         wdev = dev->ieee80211_ptr;
6898
6899         if (!rdev->ops->set_cqm_txe_config)
6900                 return -EOPNOTSUPP;
6901
6902         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6903             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6904                 return -EOPNOTSUPP;
6905
6906         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
6907 }
6908
6909 static int nl80211_set_cqm_rssi(struct genl_info *info,
6910                                 s32 threshold, u32 hysteresis)
6911 {
6912         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6913         struct wireless_dev *wdev;
6914         struct net_device *dev = info->user_ptr[1];
6915
6916         if (threshold > 0)
6917                 return -EINVAL;
6918
6919         wdev = dev->ieee80211_ptr;
6920
6921         if (!rdev->ops->set_cqm_rssi_config)
6922                 return -EOPNOTSUPP;
6923
6924         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6925             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6926                 return -EOPNOTSUPP;
6927
6928         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
6929 }
6930
6931 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
6932 {
6933         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
6934         struct nlattr *cqm;
6935         int err;
6936
6937         cqm = info->attrs[NL80211_ATTR_CQM];
6938         if (!cqm) {
6939                 err = -EINVAL;
6940                 goto out;
6941         }
6942
6943         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
6944                                nl80211_attr_cqm_policy);
6945         if (err)
6946                 goto out;
6947
6948         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
6949             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
6950                 s32 threshold;
6951                 u32 hysteresis;
6952                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
6953                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
6954                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
6955         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
6956                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
6957                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
6958                 u32 rate, pkts, intvl;
6959                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
6960                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
6961                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
6962                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
6963         } else
6964                 err = -EINVAL;
6965
6966 out:
6967         return err;
6968 }
6969
6970 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
6971 {
6972         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6973         struct net_device *dev = info->user_ptr[1];
6974         struct mesh_config cfg;
6975         struct mesh_setup setup;
6976         int err;
6977
6978         /* start with default */
6979         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
6980         memcpy(&setup, &default_mesh_setup, sizeof(setup));
6981
6982         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
6983                 /* and parse parameters if given */
6984                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
6985                 if (err)
6986                         return err;
6987         }
6988
6989         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
6990             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
6991                 return -EINVAL;
6992
6993         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
6994         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
6995
6996         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6997             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
6998                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6999                         return -EINVAL;
7000
7001         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7002                 setup.beacon_interval =
7003                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7004                 if (setup.beacon_interval < 10 ||
7005                     setup.beacon_interval > 10000)
7006                         return -EINVAL;
7007         }
7008
7009         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7010                 setup.dtim_period =
7011                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7012                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7013                         return -EINVAL;
7014         }
7015
7016         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7017                 /* parse additional setup parameters if given */
7018                 err = nl80211_parse_mesh_setup(info, &setup);
7019                 if (err)
7020                         return err;
7021         }
7022
7023         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7024                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7025                 if (err)
7026                         return err;
7027         } else {
7028                 /* cfg80211_join_mesh() will sort it out */
7029                 setup.chandef.chan = NULL;
7030         }
7031
7032         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7033 }
7034
7035 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7036 {
7037         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7038         struct net_device *dev = info->user_ptr[1];
7039
7040         return cfg80211_leave_mesh(rdev, dev);
7041 }
7042
7043 #ifdef CONFIG_PM
7044 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7045                                         struct cfg80211_registered_device *rdev)
7046 {
7047         struct nlattr *nl_pats, *nl_pat;
7048         int i, pat_len;
7049
7050         if (!rdev->wowlan->n_patterns)
7051                 return 0;
7052
7053         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7054         if (!nl_pats)
7055                 return -ENOBUFS;
7056
7057         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
7058                 nl_pat = nla_nest_start(msg, i + 1);
7059                 if (!nl_pat)
7060                         return -ENOBUFS;
7061                 pat_len = rdev->wowlan->patterns[i].pattern_len;
7062                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
7063                             DIV_ROUND_UP(pat_len, 8),
7064                             rdev->wowlan->patterns[i].mask) ||
7065                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
7066                             pat_len, rdev->wowlan->patterns[i].pattern) ||
7067                     nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
7068                                 rdev->wowlan->patterns[i].pkt_offset))
7069                         return -ENOBUFS;
7070                 nla_nest_end(msg, nl_pat);
7071         }
7072         nla_nest_end(msg, nl_pats);
7073
7074         return 0;
7075 }
7076
7077 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7078                                    struct cfg80211_wowlan_tcp *tcp)
7079 {
7080         struct nlattr *nl_tcp;
7081
7082         if (!tcp)
7083                 return 0;
7084
7085         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
7086         if (!nl_tcp)
7087                 return -ENOBUFS;
7088
7089         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
7090             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
7091             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
7092             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
7093             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
7094             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
7095                     tcp->payload_len, tcp->payload) ||
7096             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
7097                         tcp->data_interval) ||
7098             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
7099                     tcp->wake_len, tcp->wake_data) ||
7100             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
7101                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
7102                 return -ENOBUFS;
7103
7104         if (tcp->payload_seq.len &&
7105             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
7106                     sizeof(tcp->payload_seq), &tcp->payload_seq))
7107                 return -ENOBUFS;
7108
7109         if (tcp->payload_tok.len &&
7110             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
7111                     sizeof(tcp->payload_tok) + tcp->tokens_size,
7112                     &tcp->payload_tok))
7113                 return -ENOBUFS;
7114
7115         return 0;
7116 }
7117
7118 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
7119 {
7120         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7121         struct sk_buff *msg;
7122         void *hdr;
7123         u32 size = NLMSG_DEFAULT_SIZE;
7124
7125         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7126             !rdev->wiphy.wowlan.tcp)
7127                 return -EOPNOTSUPP;
7128
7129         if (rdev->wowlan && rdev->wowlan->tcp) {
7130                 /* adjust size to have room for all the data */
7131                 size += rdev->wowlan->tcp->tokens_size +
7132                         rdev->wowlan->tcp->payload_len +
7133                         rdev->wowlan->tcp->wake_len +
7134                         rdev->wowlan->tcp->wake_len / 8;
7135         }
7136
7137         msg = nlmsg_new(size, GFP_KERNEL);
7138         if (!msg)
7139                 return -ENOMEM;
7140
7141         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7142                              NL80211_CMD_GET_WOWLAN);
7143         if (!hdr)
7144                 goto nla_put_failure;
7145
7146         if (rdev->wowlan) {
7147                 struct nlattr *nl_wowlan;
7148
7149                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
7150                 if (!nl_wowlan)
7151                         goto nla_put_failure;
7152
7153                 if ((rdev->wowlan->any &&
7154                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7155                     (rdev->wowlan->disconnect &&
7156                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7157                     (rdev->wowlan->magic_pkt &&
7158                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7159                     (rdev->wowlan->gtk_rekey_failure &&
7160                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7161                     (rdev->wowlan->eap_identity_req &&
7162                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7163                     (rdev->wowlan->four_way_handshake &&
7164                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7165                     (rdev->wowlan->rfkill_release &&
7166                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
7167                         goto nla_put_failure;
7168
7169                 if (nl80211_send_wowlan_patterns(msg, rdev))
7170                         goto nla_put_failure;
7171
7172                 if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
7173                         goto nla_put_failure;
7174
7175                 nla_nest_end(msg, nl_wowlan);
7176         }
7177
7178         genlmsg_end(msg, hdr);
7179         return genlmsg_reply(msg, info);
7180
7181 nla_put_failure:
7182         nlmsg_free(msg);
7183         return -ENOBUFS;
7184 }
7185
7186 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
7187                                     struct nlattr *attr,
7188                                     struct cfg80211_wowlan *trig)
7189 {
7190         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
7191         struct cfg80211_wowlan_tcp *cfg;
7192         struct nl80211_wowlan_tcp_data_token *tok = NULL;
7193         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
7194         u32 size;
7195         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
7196         int err, port;
7197
7198         if (!rdev->wiphy.wowlan.tcp)
7199                 return -EINVAL;
7200
7201         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
7202                         nla_data(attr), nla_len(attr),
7203                         nl80211_wowlan_tcp_policy);
7204         if (err)
7205                 return err;
7206
7207         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
7208             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
7209             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
7210             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
7211             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
7212             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
7213             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
7214             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
7215                 return -EINVAL;
7216
7217         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
7218         if (data_size > rdev->wiphy.wowlan.tcp->data_payload_max)
7219                 return -EINVAL;
7220
7221         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
7222                         rdev->wiphy.wowlan.tcp->data_interval_max)
7223                 return -EINVAL;
7224
7225         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
7226         if (wake_size > rdev->wiphy.wowlan.tcp->wake_payload_max)
7227                 return -EINVAL;
7228
7229         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
7230         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
7231                 return -EINVAL;
7232
7233         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
7234                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7235
7236                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
7237                 tokens_size = tokln - sizeof(*tok);
7238
7239                 if (!tok->len || tokens_size % tok->len)
7240                         return -EINVAL;
7241                 if (!rdev->wiphy.wowlan.tcp->tok)
7242                         return -EINVAL;
7243                 if (tok->len > rdev->wiphy.wowlan.tcp->tok->max_len)
7244                         return -EINVAL;
7245                 if (tok->len < rdev->wiphy.wowlan.tcp->tok->min_len)
7246                         return -EINVAL;
7247                 if (tokens_size > rdev->wiphy.wowlan.tcp->tok->bufsize)
7248                         return -EINVAL;
7249                 if (tok->offset + tok->len > data_size)
7250                         return -EINVAL;
7251         }
7252
7253         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
7254                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
7255                 if (!rdev->wiphy.wowlan.tcp->seq)
7256                         return -EINVAL;
7257                 if (seq->len == 0 || seq->len > 4)
7258                         return -EINVAL;
7259                 if (seq->len + seq->offset > data_size)
7260                         return -EINVAL;
7261         }
7262
7263         size = sizeof(*cfg);
7264         size += data_size;
7265         size += wake_size + wake_mask_size;
7266         size += tokens_size;
7267
7268         cfg = kzalloc(size, GFP_KERNEL);
7269         if (!cfg)
7270                 return -ENOMEM;
7271         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
7272         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
7273         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
7274                ETH_ALEN);
7275         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
7276                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
7277         else
7278                 port = 0;
7279 #ifdef CONFIG_INET
7280         /* allocate a socket and port for it and use it */
7281         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
7282                             IPPROTO_TCP, &cfg->sock, 1);
7283         if (err) {
7284                 kfree(cfg);
7285                 return err;
7286         }
7287         if (inet_csk_get_port(cfg->sock->sk, port)) {
7288                 sock_release(cfg->sock);
7289                 kfree(cfg);
7290                 return -EADDRINUSE;
7291         }
7292         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
7293 #else
7294         if (!port) {
7295                 kfree(cfg);
7296                 return -EINVAL;
7297         }
7298         cfg->src_port = port;
7299 #endif
7300
7301         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
7302         cfg->payload_len = data_size;
7303         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
7304         memcpy((void *)cfg->payload,
7305                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
7306                data_size);
7307         if (seq)
7308                 cfg->payload_seq = *seq;
7309         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
7310         cfg->wake_len = wake_size;
7311         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
7312         memcpy((void *)cfg->wake_data,
7313                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
7314                wake_size);
7315         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
7316                          data_size + wake_size;
7317         memcpy((void *)cfg->wake_mask,
7318                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
7319                wake_mask_size);
7320         if (tok) {
7321                 cfg->tokens_size = tokens_size;
7322                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
7323         }
7324
7325         trig->tcp = cfg;
7326
7327         return 0;
7328 }
7329
7330 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
7331 {
7332         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7333         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
7334         struct cfg80211_wowlan new_triggers = {};
7335         struct cfg80211_wowlan *ntrig;
7336         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
7337         int err, i;
7338         bool prev_enabled = rdev->wowlan;
7339
7340         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
7341             !rdev->wiphy.wowlan.tcp)
7342                 return -EOPNOTSUPP;
7343
7344         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
7345                 cfg80211_rdev_free_wowlan(rdev);
7346                 rdev->wowlan = NULL;
7347                 goto set_wakeup;
7348         }
7349
7350         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
7351                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7352                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
7353                         nl80211_wowlan_policy);
7354         if (err)
7355                 return err;
7356
7357         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
7358                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
7359                         return -EINVAL;
7360                 new_triggers.any = true;
7361         }
7362
7363         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
7364                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
7365                         return -EINVAL;
7366                 new_triggers.disconnect = true;
7367         }
7368
7369         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
7370                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
7371                         return -EINVAL;
7372                 new_triggers.magic_pkt = true;
7373         }
7374
7375         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
7376                 return -EINVAL;
7377
7378         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
7379                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
7380                         return -EINVAL;
7381                 new_triggers.gtk_rekey_failure = true;
7382         }
7383
7384         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
7385                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
7386                         return -EINVAL;
7387                 new_triggers.eap_identity_req = true;
7388         }
7389
7390         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
7391                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
7392                         return -EINVAL;
7393                 new_triggers.four_way_handshake = true;
7394         }
7395
7396         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
7397                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
7398                         return -EINVAL;
7399                 new_triggers.rfkill_release = true;
7400         }
7401
7402         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
7403                 struct nlattr *pat;
7404                 int n_patterns = 0;
7405                 int rem, pat_len, mask_len, pkt_offset;
7406                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
7407
7408                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7409                                     rem)
7410                         n_patterns++;
7411                 if (n_patterns > wowlan->n_patterns)
7412                         return -EINVAL;
7413
7414                 new_triggers.patterns = kcalloc(n_patterns,
7415                                                 sizeof(new_triggers.patterns[0]),
7416                                                 GFP_KERNEL);
7417                 if (!new_triggers.patterns)
7418                         return -ENOMEM;
7419
7420                 new_triggers.n_patterns = n_patterns;
7421                 i = 0;
7422
7423                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
7424                                     rem) {
7425                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
7426                                   nla_data(pat), nla_len(pat), NULL);
7427                         err = -EINVAL;
7428                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
7429                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
7430                                 goto error;
7431                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
7432                         mask_len = DIV_ROUND_UP(pat_len, 8);
7433                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
7434                             mask_len)
7435                                 goto error;
7436                         if (pat_len > wowlan->pattern_max_len ||
7437                             pat_len < wowlan->pattern_min_len)
7438                                 goto error;
7439
7440                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET])
7441                                 pkt_offset = 0;
7442                         else
7443                                 pkt_offset = nla_get_u32(
7444                                         pat_tb[NL80211_WOWLAN_PKTPAT_OFFSET]);
7445                         if (pkt_offset > wowlan->max_pkt_offset)
7446                                 goto error;
7447                         new_triggers.patterns[i].pkt_offset = pkt_offset;
7448
7449                         new_triggers.patterns[i].mask =
7450                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
7451                         if (!new_triggers.patterns[i].mask) {
7452                                 err = -ENOMEM;
7453                                 goto error;
7454                         }
7455                         new_triggers.patterns[i].pattern =
7456                                 new_triggers.patterns[i].mask + mask_len;
7457                         memcpy(new_triggers.patterns[i].mask,
7458                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
7459                                mask_len);
7460                         new_triggers.patterns[i].pattern_len = pat_len;
7461                         memcpy(new_triggers.patterns[i].pattern,
7462                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
7463                                pat_len);
7464                         i++;
7465                 }
7466         }
7467
7468         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
7469                 err = nl80211_parse_wowlan_tcp(
7470                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
7471                         &new_triggers);
7472                 if (err)
7473                         goto error;
7474         }
7475
7476         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
7477         if (!ntrig) {
7478                 err = -ENOMEM;
7479                 goto error;
7480         }
7481         cfg80211_rdev_free_wowlan(rdev);
7482         rdev->wowlan = ntrig;
7483
7484  set_wakeup:
7485         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
7486                 rdev_set_wakeup(rdev, rdev->wowlan);
7487
7488         return 0;
7489  error:
7490         for (i = 0; i < new_triggers.n_patterns; i++)
7491                 kfree(new_triggers.patterns[i].mask);
7492         kfree(new_triggers.patterns);
7493         if (new_triggers.tcp && new_triggers.tcp->sock)
7494                 sock_release(new_triggers.tcp->sock);
7495         kfree(new_triggers.tcp);
7496         return err;
7497 }
7498 #endif
7499
7500 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
7501 {
7502         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7503         struct net_device *dev = info->user_ptr[1];
7504         struct wireless_dev *wdev = dev->ieee80211_ptr;
7505         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
7506         struct cfg80211_gtk_rekey_data rekey_data;
7507         int err;
7508
7509         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
7510                 return -EINVAL;
7511
7512         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
7513                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
7514                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
7515                         nl80211_rekey_policy);
7516         if (err)
7517                 return err;
7518
7519         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
7520                 return -ERANGE;
7521         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
7522                 return -ERANGE;
7523         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
7524                 return -ERANGE;
7525
7526         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
7527                NL80211_KEK_LEN);
7528         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
7529                NL80211_KCK_LEN);
7530         memcpy(rekey_data.replay_ctr,
7531                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
7532                NL80211_REPLAY_CTR_LEN);
7533
7534         wdev_lock(wdev);
7535         if (!wdev->current_bss) {
7536                 err = -ENOTCONN;
7537                 goto out;
7538         }
7539
7540         if (!rdev->ops->set_rekey_data) {
7541                 err = -EOPNOTSUPP;
7542                 goto out;
7543         }
7544
7545         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
7546  out:
7547         wdev_unlock(wdev);
7548         return err;
7549 }
7550
7551 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
7552                                              struct genl_info *info)
7553 {
7554         struct net_device *dev = info->user_ptr[1];
7555         struct wireless_dev *wdev = dev->ieee80211_ptr;
7556
7557         if (wdev->iftype != NL80211_IFTYPE_AP &&
7558             wdev->iftype != NL80211_IFTYPE_P2P_GO)
7559                 return -EINVAL;
7560
7561         if (wdev->ap_unexpected_nlportid)
7562                 return -EBUSY;
7563
7564         wdev->ap_unexpected_nlportid = info->snd_portid;
7565         return 0;
7566 }
7567
7568 static int nl80211_probe_client(struct sk_buff *skb,
7569                                 struct genl_info *info)
7570 {
7571         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7572         struct net_device *dev = info->user_ptr[1];
7573         struct wireless_dev *wdev = dev->ieee80211_ptr;
7574         struct sk_buff *msg;
7575         void *hdr;
7576         const u8 *addr;
7577         u64 cookie;
7578         int err;
7579
7580         if (wdev->iftype != NL80211_IFTYPE_AP &&
7581             wdev->iftype != NL80211_IFTYPE_P2P_GO)
7582                 return -EOPNOTSUPP;
7583
7584         if (!info->attrs[NL80211_ATTR_MAC])
7585                 return -EINVAL;
7586
7587         if (!rdev->ops->probe_client)
7588                 return -EOPNOTSUPP;
7589
7590         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7591         if (!msg)
7592                 return -ENOMEM;
7593
7594         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7595                              NL80211_CMD_PROBE_CLIENT);
7596
7597         if (IS_ERR(hdr)) {
7598                 err = PTR_ERR(hdr);
7599                 goto free_msg;
7600         }
7601
7602         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7603
7604         err = rdev_probe_client(rdev, dev, addr, &cookie);
7605         if (err)
7606                 goto free_msg;
7607
7608         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7609                 goto nla_put_failure;
7610
7611         genlmsg_end(msg, hdr);
7612
7613         return genlmsg_reply(msg, info);
7614
7615  nla_put_failure:
7616         err = -ENOBUFS;
7617  free_msg:
7618         nlmsg_free(msg);
7619         return err;
7620 }
7621
7622 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
7623 {
7624         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7625         struct cfg80211_beacon_registration *reg, *nreg;
7626         int rv;
7627
7628         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
7629                 return -EOPNOTSUPP;
7630
7631         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
7632         if (!nreg)
7633                 return -ENOMEM;
7634
7635         /* First, check if already registered. */
7636         spin_lock_bh(&rdev->beacon_registrations_lock);
7637         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
7638                 if (reg->nlportid == info->snd_portid) {
7639                         rv = -EALREADY;
7640                         goto out_err;
7641                 }
7642         }
7643         /* Add it to the list */
7644         nreg->nlportid = info->snd_portid;
7645         list_add(&nreg->list, &rdev->beacon_registrations);
7646
7647         spin_unlock_bh(&rdev->beacon_registrations_lock);
7648
7649         return 0;
7650 out_err:
7651         spin_unlock_bh(&rdev->beacon_registrations_lock);
7652         kfree(nreg);
7653         return rv;
7654 }
7655
7656 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
7657 {
7658         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7659         struct wireless_dev *wdev = info->user_ptr[1];
7660         int err;
7661
7662         if (!rdev->ops->start_p2p_device)
7663                 return -EOPNOTSUPP;
7664
7665         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
7666                 return -EOPNOTSUPP;
7667
7668         if (wdev->p2p_started)
7669                 return 0;
7670
7671         mutex_lock(&rdev->devlist_mtx);
7672         err = cfg80211_can_add_interface(rdev, wdev->iftype);
7673         mutex_unlock(&rdev->devlist_mtx);
7674         if (err)
7675                 return err;
7676
7677         err = rdev_start_p2p_device(rdev, wdev);
7678         if (err)
7679                 return err;
7680
7681         wdev->p2p_started = true;
7682         mutex_lock(&rdev->devlist_mtx);
7683         rdev->opencount++;
7684         mutex_unlock(&rdev->devlist_mtx);
7685
7686         return 0;
7687 }
7688
7689 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
7690 {
7691         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7692         struct wireless_dev *wdev = info->user_ptr[1];
7693
7694         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
7695                 return -EOPNOTSUPP;
7696
7697         if (!rdev->ops->stop_p2p_device)
7698                 return -EOPNOTSUPP;
7699
7700         if (!wdev->p2p_started)
7701                 return 0;
7702
7703         rdev_stop_p2p_device(rdev, wdev);
7704         wdev->p2p_started = false;
7705
7706         mutex_lock(&rdev->devlist_mtx);
7707         rdev->opencount--;
7708         mutex_unlock(&rdev->devlist_mtx);
7709
7710         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
7711                 rdev->scan_req->aborted = true;
7712                 ___cfg80211_scan_done(rdev, true);
7713         }
7714
7715         return 0;
7716 }
7717
7718 #define NL80211_FLAG_NEED_WIPHY         0x01
7719 #define NL80211_FLAG_NEED_NETDEV        0x02
7720 #define NL80211_FLAG_NEED_RTNL          0x04
7721 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
7722 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
7723                                          NL80211_FLAG_CHECK_NETDEV_UP)
7724 #define NL80211_FLAG_NEED_WDEV          0x10
7725 /* If a netdev is associated, it must be UP, P2P must be started */
7726 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
7727                                          NL80211_FLAG_CHECK_NETDEV_UP)
7728
7729 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
7730                             struct genl_info *info)
7731 {
7732         struct cfg80211_registered_device *rdev;
7733         struct wireless_dev *wdev;
7734         struct net_device *dev;
7735         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
7736
7737         if (rtnl)
7738                 rtnl_lock();
7739
7740         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
7741                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7742                 if (IS_ERR(rdev)) {
7743                         if (rtnl)
7744                                 rtnl_unlock();
7745                         return PTR_ERR(rdev);
7746                 }
7747                 info->user_ptr[0] = rdev;
7748         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
7749                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7750                 mutex_lock(&cfg80211_mutex);
7751                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
7752                                                   info->attrs);
7753                 if (IS_ERR(wdev)) {
7754                         mutex_unlock(&cfg80211_mutex);
7755                         if (rtnl)
7756                                 rtnl_unlock();
7757                         return PTR_ERR(wdev);
7758                 }
7759
7760                 dev = wdev->netdev;
7761                 rdev = wiphy_to_dev(wdev->wiphy);
7762
7763                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
7764                         if (!dev) {
7765                                 mutex_unlock(&cfg80211_mutex);
7766                                 if (rtnl)
7767                                         rtnl_unlock();
7768                                 return -EINVAL;
7769                         }
7770
7771                         info->user_ptr[1] = dev;
7772                 } else {
7773                         info->user_ptr[1] = wdev;
7774                 }
7775
7776                 if (dev) {
7777                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
7778                             !netif_running(dev)) {
7779                                 mutex_unlock(&cfg80211_mutex);
7780                                 if (rtnl)
7781                                         rtnl_unlock();
7782                                 return -ENETDOWN;
7783                         }
7784
7785                         dev_hold(dev);
7786                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
7787                         if (!wdev->p2p_started) {
7788                                 mutex_unlock(&cfg80211_mutex);
7789                                 if (rtnl)
7790                                         rtnl_unlock();
7791                                 return -ENETDOWN;
7792                         }
7793                 }
7794
7795                 cfg80211_lock_rdev(rdev);
7796
7797                 mutex_unlock(&cfg80211_mutex);
7798
7799                 info->user_ptr[0] = rdev;
7800         }
7801
7802         return 0;
7803 }
7804
7805 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
7806                               struct genl_info *info)
7807 {
7808         if (info->user_ptr[0])
7809                 cfg80211_unlock_rdev(info->user_ptr[0]);
7810         if (info->user_ptr[1]) {
7811                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7812                         struct wireless_dev *wdev = info->user_ptr[1];
7813
7814                         if (wdev->netdev)
7815                                 dev_put(wdev->netdev);
7816                 } else {
7817                         dev_put(info->user_ptr[1]);
7818                 }
7819         }
7820         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
7821                 rtnl_unlock();
7822 }
7823
7824 static struct genl_ops nl80211_ops[] = {
7825         {
7826                 .cmd = NL80211_CMD_GET_WIPHY,
7827                 .doit = nl80211_get_wiphy,
7828                 .dumpit = nl80211_dump_wiphy,
7829                 .policy = nl80211_policy,
7830                 /* can be retrieved by unprivileged users */
7831                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
7832         },
7833         {
7834                 .cmd = NL80211_CMD_SET_WIPHY,
7835                 .doit = nl80211_set_wiphy,
7836                 .policy = nl80211_policy,
7837                 .flags = GENL_ADMIN_PERM,
7838                 .internal_flags = NL80211_FLAG_NEED_RTNL,
7839         },
7840         {
7841                 .cmd = NL80211_CMD_GET_INTERFACE,
7842                 .doit = nl80211_get_interface,
7843                 .dumpit = nl80211_dump_interface,
7844                 .policy = nl80211_policy,
7845                 /* can be retrieved by unprivileged users */
7846                 .internal_flags = NL80211_FLAG_NEED_WDEV,
7847         },
7848         {
7849                 .cmd = NL80211_CMD_SET_INTERFACE,
7850                 .doit = nl80211_set_interface,
7851                 .policy = nl80211_policy,
7852                 .flags = GENL_ADMIN_PERM,
7853                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7854                                   NL80211_FLAG_NEED_RTNL,
7855         },
7856         {
7857                 .cmd = NL80211_CMD_NEW_INTERFACE,
7858                 .doit = nl80211_new_interface,
7859                 .policy = nl80211_policy,
7860                 .flags = GENL_ADMIN_PERM,
7861                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7862                                   NL80211_FLAG_NEED_RTNL,
7863         },
7864         {
7865                 .cmd = NL80211_CMD_DEL_INTERFACE,
7866                 .doit = nl80211_del_interface,
7867                 .policy = nl80211_policy,
7868                 .flags = GENL_ADMIN_PERM,
7869                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7870                                   NL80211_FLAG_NEED_RTNL,
7871         },
7872         {
7873                 .cmd = NL80211_CMD_GET_KEY,
7874                 .doit = nl80211_get_key,
7875                 .policy = nl80211_policy,
7876                 .flags = GENL_ADMIN_PERM,
7877                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7878                                   NL80211_FLAG_NEED_RTNL,
7879         },
7880         {
7881                 .cmd = NL80211_CMD_SET_KEY,
7882                 .doit = nl80211_set_key,
7883                 .policy = nl80211_policy,
7884                 .flags = GENL_ADMIN_PERM,
7885                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7886                                   NL80211_FLAG_NEED_RTNL,
7887         },
7888         {
7889                 .cmd = NL80211_CMD_NEW_KEY,
7890                 .doit = nl80211_new_key,
7891                 .policy = nl80211_policy,
7892                 .flags = GENL_ADMIN_PERM,
7893                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7894                                   NL80211_FLAG_NEED_RTNL,
7895         },
7896         {
7897                 .cmd = NL80211_CMD_DEL_KEY,
7898                 .doit = nl80211_del_key,
7899                 .policy = nl80211_policy,
7900                 .flags = GENL_ADMIN_PERM,
7901                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7902                                   NL80211_FLAG_NEED_RTNL,
7903         },
7904         {
7905                 .cmd = NL80211_CMD_SET_BEACON,
7906                 .policy = nl80211_policy,
7907                 .flags = GENL_ADMIN_PERM,
7908                 .doit = nl80211_set_beacon,
7909                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7910                                   NL80211_FLAG_NEED_RTNL,
7911         },
7912         {
7913                 .cmd = NL80211_CMD_START_AP,
7914                 .policy = nl80211_policy,
7915                 .flags = GENL_ADMIN_PERM,
7916                 .doit = nl80211_start_ap,
7917                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7918                                   NL80211_FLAG_NEED_RTNL,
7919         },
7920         {
7921                 .cmd = NL80211_CMD_STOP_AP,
7922                 .policy = nl80211_policy,
7923                 .flags = GENL_ADMIN_PERM,
7924                 .doit = nl80211_stop_ap,
7925                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7926                                   NL80211_FLAG_NEED_RTNL,
7927         },
7928         {
7929                 .cmd = NL80211_CMD_GET_STATION,
7930                 .doit = nl80211_get_station,
7931                 .dumpit = nl80211_dump_station,
7932                 .policy = nl80211_policy,
7933                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7934                                   NL80211_FLAG_NEED_RTNL,
7935         },
7936         {
7937                 .cmd = NL80211_CMD_SET_STATION,
7938                 .doit = nl80211_set_station,
7939                 .policy = nl80211_policy,
7940                 .flags = GENL_ADMIN_PERM,
7941                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7942                                   NL80211_FLAG_NEED_RTNL,
7943         },
7944         {
7945                 .cmd = NL80211_CMD_NEW_STATION,
7946                 .doit = nl80211_new_station,
7947                 .policy = nl80211_policy,
7948                 .flags = GENL_ADMIN_PERM,
7949                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7950                                   NL80211_FLAG_NEED_RTNL,
7951         },
7952         {
7953                 .cmd = NL80211_CMD_DEL_STATION,
7954                 .doit = nl80211_del_station,
7955                 .policy = nl80211_policy,
7956                 .flags = GENL_ADMIN_PERM,
7957                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7958                                   NL80211_FLAG_NEED_RTNL,
7959         },
7960         {
7961                 .cmd = NL80211_CMD_GET_MPATH,
7962                 .doit = nl80211_get_mpath,
7963                 .dumpit = nl80211_dump_mpath,
7964                 .policy = nl80211_policy,
7965                 .flags = GENL_ADMIN_PERM,
7966                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7967                                   NL80211_FLAG_NEED_RTNL,
7968         },
7969         {
7970                 .cmd = NL80211_CMD_SET_MPATH,
7971                 .doit = nl80211_set_mpath,
7972                 .policy = nl80211_policy,
7973                 .flags = GENL_ADMIN_PERM,
7974                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7975                                   NL80211_FLAG_NEED_RTNL,
7976         },
7977         {
7978                 .cmd = NL80211_CMD_NEW_MPATH,
7979                 .doit = nl80211_new_mpath,
7980                 .policy = nl80211_policy,
7981                 .flags = GENL_ADMIN_PERM,
7982                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7983                                   NL80211_FLAG_NEED_RTNL,
7984         },
7985         {
7986                 .cmd = NL80211_CMD_DEL_MPATH,
7987                 .doit = nl80211_del_mpath,
7988                 .policy = nl80211_policy,
7989                 .flags = GENL_ADMIN_PERM,
7990                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7991                                   NL80211_FLAG_NEED_RTNL,
7992         },
7993         {
7994                 .cmd = NL80211_CMD_SET_BSS,
7995                 .doit = nl80211_set_bss,
7996                 .policy = nl80211_policy,
7997                 .flags = GENL_ADMIN_PERM,
7998                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7999                                   NL80211_FLAG_NEED_RTNL,
8000         },
8001         {
8002                 .cmd = NL80211_CMD_GET_REG,
8003                 .doit = nl80211_get_reg,
8004                 .policy = nl80211_policy,
8005                 /* can be retrieved by unprivileged users */
8006         },
8007         {
8008                 .cmd = NL80211_CMD_SET_REG,
8009                 .doit = nl80211_set_reg,
8010                 .policy = nl80211_policy,
8011                 .flags = GENL_ADMIN_PERM,
8012         },
8013         {
8014                 .cmd = NL80211_CMD_REQ_SET_REG,
8015                 .doit = nl80211_req_set_reg,
8016                 .policy = nl80211_policy,
8017                 .flags = GENL_ADMIN_PERM,
8018         },
8019         {
8020                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
8021                 .doit = nl80211_get_mesh_config,
8022                 .policy = nl80211_policy,
8023                 /* can be retrieved by unprivileged users */
8024                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8025                                   NL80211_FLAG_NEED_RTNL,
8026         },
8027         {
8028                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
8029                 .doit = nl80211_update_mesh_config,
8030                 .policy = nl80211_policy,
8031                 .flags = GENL_ADMIN_PERM,
8032                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8033                                   NL80211_FLAG_NEED_RTNL,
8034         },
8035         {
8036                 .cmd = NL80211_CMD_TRIGGER_SCAN,
8037                 .doit = nl80211_trigger_scan,
8038                 .policy = nl80211_policy,
8039                 .flags = GENL_ADMIN_PERM,
8040                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8041                                   NL80211_FLAG_NEED_RTNL,
8042         },
8043         {
8044                 .cmd = NL80211_CMD_GET_SCAN,
8045                 .policy = nl80211_policy,
8046                 .dumpit = nl80211_dump_scan,
8047         },
8048         {
8049                 .cmd = NL80211_CMD_START_SCHED_SCAN,
8050                 .doit = nl80211_start_sched_scan,
8051                 .policy = nl80211_policy,
8052                 .flags = GENL_ADMIN_PERM,
8053                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8054                                   NL80211_FLAG_NEED_RTNL,
8055         },
8056         {
8057                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
8058                 .doit = nl80211_stop_sched_scan,
8059                 .policy = nl80211_policy,
8060                 .flags = GENL_ADMIN_PERM,
8061                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8062                                   NL80211_FLAG_NEED_RTNL,
8063         },
8064         {
8065                 .cmd = NL80211_CMD_AUTHENTICATE,
8066                 .doit = nl80211_authenticate,
8067                 .policy = nl80211_policy,
8068                 .flags = GENL_ADMIN_PERM,
8069                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8070                                   NL80211_FLAG_NEED_RTNL,
8071         },
8072         {
8073                 .cmd = NL80211_CMD_ASSOCIATE,
8074                 .doit = nl80211_associate,
8075                 .policy = nl80211_policy,
8076                 .flags = GENL_ADMIN_PERM,
8077                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8078                                   NL80211_FLAG_NEED_RTNL,
8079         },
8080         {
8081                 .cmd = NL80211_CMD_DEAUTHENTICATE,
8082                 .doit = nl80211_deauthenticate,
8083                 .policy = nl80211_policy,
8084                 .flags = GENL_ADMIN_PERM,
8085                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8086                                   NL80211_FLAG_NEED_RTNL,
8087         },
8088         {
8089                 .cmd = NL80211_CMD_DISASSOCIATE,
8090                 .doit = nl80211_disassociate,
8091                 .policy = nl80211_policy,
8092                 .flags = GENL_ADMIN_PERM,
8093                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8094                                   NL80211_FLAG_NEED_RTNL,
8095         },
8096         {
8097                 .cmd = NL80211_CMD_JOIN_IBSS,
8098                 .doit = nl80211_join_ibss,
8099                 .policy = nl80211_policy,
8100                 .flags = GENL_ADMIN_PERM,
8101                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8102                                   NL80211_FLAG_NEED_RTNL,
8103         },
8104         {
8105                 .cmd = NL80211_CMD_LEAVE_IBSS,
8106                 .doit = nl80211_leave_ibss,
8107                 .policy = nl80211_policy,
8108                 .flags = GENL_ADMIN_PERM,
8109                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8110                                   NL80211_FLAG_NEED_RTNL,
8111         },
8112 #ifdef CONFIG_NL80211_TESTMODE
8113         {
8114                 .cmd = NL80211_CMD_TESTMODE,
8115                 .doit = nl80211_testmode_do,
8116                 .dumpit = nl80211_testmode_dump,
8117                 .policy = nl80211_policy,
8118                 .flags = GENL_ADMIN_PERM,
8119                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8120                                   NL80211_FLAG_NEED_RTNL,
8121         },
8122 #endif
8123         {
8124                 .cmd = NL80211_CMD_CONNECT,
8125                 .doit = nl80211_connect,
8126                 .policy = nl80211_policy,
8127                 .flags = GENL_ADMIN_PERM,
8128                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8129                                   NL80211_FLAG_NEED_RTNL,
8130         },
8131         {
8132                 .cmd = NL80211_CMD_DISCONNECT,
8133                 .doit = nl80211_disconnect,
8134                 .policy = nl80211_policy,
8135                 .flags = GENL_ADMIN_PERM,
8136                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8137                                   NL80211_FLAG_NEED_RTNL,
8138         },
8139         {
8140                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
8141                 .doit = nl80211_wiphy_netns,
8142                 .policy = nl80211_policy,
8143                 .flags = GENL_ADMIN_PERM,
8144                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8145                                   NL80211_FLAG_NEED_RTNL,
8146         },
8147         {
8148                 .cmd = NL80211_CMD_GET_SURVEY,
8149                 .policy = nl80211_policy,
8150                 .dumpit = nl80211_dump_survey,
8151         },
8152         {
8153                 .cmd = NL80211_CMD_SET_PMKSA,
8154                 .doit = nl80211_setdel_pmksa,
8155                 .policy = nl80211_policy,
8156                 .flags = GENL_ADMIN_PERM,
8157                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8158                                   NL80211_FLAG_NEED_RTNL,
8159         },
8160         {
8161                 .cmd = NL80211_CMD_DEL_PMKSA,
8162                 .doit = nl80211_setdel_pmksa,
8163                 .policy = nl80211_policy,
8164                 .flags = GENL_ADMIN_PERM,
8165                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8166                                   NL80211_FLAG_NEED_RTNL,
8167         },
8168         {
8169                 .cmd = NL80211_CMD_FLUSH_PMKSA,
8170                 .doit = nl80211_flush_pmksa,
8171                 .policy = nl80211_policy,
8172                 .flags = GENL_ADMIN_PERM,
8173                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8174                                   NL80211_FLAG_NEED_RTNL,
8175         },
8176         {
8177                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
8178                 .doit = nl80211_remain_on_channel,
8179                 .policy = nl80211_policy,
8180                 .flags = GENL_ADMIN_PERM,
8181                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8182                                   NL80211_FLAG_NEED_RTNL,
8183         },
8184         {
8185                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8186                 .doit = nl80211_cancel_remain_on_channel,
8187                 .policy = nl80211_policy,
8188                 .flags = GENL_ADMIN_PERM,
8189                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8190                                   NL80211_FLAG_NEED_RTNL,
8191         },
8192         {
8193                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
8194                 .doit = nl80211_set_tx_bitrate_mask,
8195                 .policy = nl80211_policy,
8196                 .flags = GENL_ADMIN_PERM,
8197                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8198                                   NL80211_FLAG_NEED_RTNL,
8199         },
8200         {
8201                 .cmd = NL80211_CMD_REGISTER_FRAME,
8202                 .doit = nl80211_register_mgmt,
8203                 .policy = nl80211_policy,
8204                 .flags = GENL_ADMIN_PERM,
8205                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8206                                   NL80211_FLAG_NEED_RTNL,
8207         },
8208         {
8209                 .cmd = NL80211_CMD_FRAME,
8210                 .doit = nl80211_tx_mgmt,
8211                 .policy = nl80211_policy,
8212                 .flags = GENL_ADMIN_PERM,
8213                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8214                                   NL80211_FLAG_NEED_RTNL,
8215         },
8216         {
8217                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
8218                 .doit = nl80211_tx_mgmt_cancel_wait,
8219                 .policy = nl80211_policy,
8220                 .flags = GENL_ADMIN_PERM,
8221                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8222                                   NL80211_FLAG_NEED_RTNL,
8223         },
8224         {
8225                 .cmd = NL80211_CMD_SET_POWER_SAVE,
8226                 .doit = nl80211_set_power_save,
8227                 .policy = nl80211_policy,
8228                 .flags = GENL_ADMIN_PERM,
8229                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8230                                   NL80211_FLAG_NEED_RTNL,
8231         },
8232         {
8233                 .cmd = NL80211_CMD_GET_POWER_SAVE,
8234                 .doit = nl80211_get_power_save,
8235                 .policy = nl80211_policy,
8236                 /* can be retrieved by unprivileged users */
8237                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8238                                   NL80211_FLAG_NEED_RTNL,
8239         },
8240         {
8241                 .cmd = NL80211_CMD_SET_CQM,
8242                 .doit = nl80211_set_cqm,
8243                 .policy = nl80211_policy,
8244                 .flags = GENL_ADMIN_PERM,
8245                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8246                                   NL80211_FLAG_NEED_RTNL,
8247         },
8248         {
8249                 .cmd = NL80211_CMD_SET_CHANNEL,
8250                 .doit = nl80211_set_channel,
8251                 .policy = nl80211_policy,
8252                 .flags = GENL_ADMIN_PERM,
8253                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8254                                   NL80211_FLAG_NEED_RTNL,
8255         },
8256         {
8257                 .cmd = NL80211_CMD_SET_WDS_PEER,
8258                 .doit = nl80211_set_wds_peer,
8259                 .policy = nl80211_policy,
8260                 .flags = GENL_ADMIN_PERM,
8261                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8262                                   NL80211_FLAG_NEED_RTNL,
8263         },
8264         {
8265                 .cmd = NL80211_CMD_JOIN_MESH,
8266                 .doit = nl80211_join_mesh,
8267                 .policy = nl80211_policy,
8268                 .flags = GENL_ADMIN_PERM,
8269                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8270                                   NL80211_FLAG_NEED_RTNL,
8271         },
8272         {
8273                 .cmd = NL80211_CMD_LEAVE_MESH,
8274                 .doit = nl80211_leave_mesh,
8275                 .policy = nl80211_policy,
8276                 .flags = GENL_ADMIN_PERM,
8277                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8278                                   NL80211_FLAG_NEED_RTNL,
8279         },
8280 #ifdef CONFIG_PM
8281         {
8282                 .cmd = NL80211_CMD_GET_WOWLAN,
8283                 .doit = nl80211_get_wowlan,
8284                 .policy = nl80211_policy,
8285                 /* can be retrieved by unprivileged users */
8286                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8287                                   NL80211_FLAG_NEED_RTNL,
8288         },
8289         {
8290                 .cmd = NL80211_CMD_SET_WOWLAN,
8291                 .doit = nl80211_set_wowlan,
8292                 .policy = nl80211_policy,
8293                 .flags = GENL_ADMIN_PERM,
8294                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8295                                   NL80211_FLAG_NEED_RTNL,
8296         },
8297 #endif
8298         {
8299                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
8300                 .doit = nl80211_set_rekey_data,
8301                 .policy = nl80211_policy,
8302                 .flags = GENL_ADMIN_PERM,
8303                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8304                                   NL80211_FLAG_NEED_RTNL,
8305         },
8306         {
8307                 .cmd = NL80211_CMD_TDLS_MGMT,
8308                 .doit = nl80211_tdls_mgmt,
8309                 .policy = nl80211_policy,
8310                 .flags = GENL_ADMIN_PERM,
8311                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8312                                   NL80211_FLAG_NEED_RTNL,
8313         },
8314         {
8315                 .cmd = NL80211_CMD_TDLS_OPER,
8316                 .doit = nl80211_tdls_oper,
8317                 .policy = nl80211_policy,
8318                 .flags = GENL_ADMIN_PERM,
8319                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8320                                   NL80211_FLAG_NEED_RTNL,
8321         },
8322         {
8323                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
8324                 .doit = nl80211_register_unexpected_frame,
8325                 .policy = nl80211_policy,
8326                 .flags = GENL_ADMIN_PERM,
8327                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8328                                   NL80211_FLAG_NEED_RTNL,
8329         },
8330         {
8331                 .cmd = NL80211_CMD_PROBE_CLIENT,
8332                 .doit = nl80211_probe_client,
8333                 .policy = nl80211_policy,
8334                 .flags = GENL_ADMIN_PERM,
8335                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8336                                   NL80211_FLAG_NEED_RTNL,
8337         },
8338         {
8339                 .cmd = NL80211_CMD_REGISTER_BEACONS,
8340                 .doit = nl80211_register_beacons,
8341                 .policy = nl80211_policy,
8342                 .flags = GENL_ADMIN_PERM,
8343                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
8344                                   NL80211_FLAG_NEED_RTNL,
8345         },
8346         {
8347                 .cmd = NL80211_CMD_SET_NOACK_MAP,
8348                 .doit = nl80211_set_noack_map,
8349                 .policy = nl80211_policy,
8350                 .flags = GENL_ADMIN_PERM,
8351                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8352                                   NL80211_FLAG_NEED_RTNL,
8353         },
8354         {
8355                 .cmd = NL80211_CMD_START_P2P_DEVICE,
8356                 .doit = nl80211_start_p2p_device,
8357                 .policy = nl80211_policy,
8358                 .flags = GENL_ADMIN_PERM,
8359                 .internal_flags = NL80211_FLAG_NEED_WDEV |
8360                                   NL80211_FLAG_NEED_RTNL,
8361         },
8362         {
8363                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
8364                 .doit = nl80211_stop_p2p_device,
8365                 .policy = nl80211_policy,
8366                 .flags = GENL_ADMIN_PERM,
8367                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
8368                                   NL80211_FLAG_NEED_RTNL,
8369         },
8370         {
8371                 .cmd = NL80211_CMD_SET_MCAST_RATE,
8372                 .doit = nl80211_set_mcast_rate,
8373                 .policy = nl80211_policy,
8374                 .flags = GENL_ADMIN_PERM,
8375                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8376                                   NL80211_FLAG_NEED_RTNL,
8377         },
8378         {
8379                 .cmd = NL80211_CMD_SET_MAC_ACL,
8380                 .doit = nl80211_set_mac_acl,
8381                 .policy = nl80211_policy,
8382                 .flags = GENL_ADMIN_PERM,
8383                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
8384                                   NL80211_FLAG_NEED_RTNL,
8385         },
8386         {
8387                 .cmd = NL80211_CMD_RADAR_DETECT,
8388                 .doit = nl80211_start_radar_detection,
8389                 .policy = nl80211_policy,
8390                 .flags = GENL_ADMIN_PERM,
8391                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
8392                                   NL80211_FLAG_NEED_RTNL,
8393         },
8394 };
8395
8396 static struct genl_multicast_group nl80211_mlme_mcgrp = {
8397         .name = "mlme",
8398 };
8399
8400 /* multicast groups */
8401 static struct genl_multicast_group nl80211_config_mcgrp = {
8402         .name = "config",
8403 };
8404 static struct genl_multicast_group nl80211_scan_mcgrp = {
8405         .name = "scan",
8406 };
8407 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
8408         .name = "regulatory",
8409 };
8410
8411 /* notification functions */
8412
8413 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
8414 {
8415         struct sk_buff *msg;
8416
8417         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8418         if (!msg)
8419                 return;
8420
8421         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
8422                 nlmsg_free(msg);
8423                 return;
8424         }
8425
8426         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8427                                 nl80211_config_mcgrp.id, GFP_KERNEL);
8428 }
8429
8430 static int nl80211_add_scan_req(struct sk_buff *msg,
8431                                 struct cfg80211_registered_device *rdev)
8432 {
8433         struct cfg80211_scan_request *req = rdev->scan_req;
8434         struct nlattr *nest;
8435         int i;
8436
8437         ASSERT_RDEV_LOCK(rdev);
8438
8439         if (WARN_ON(!req))
8440                 return 0;
8441
8442         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
8443         if (!nest)
8444                 goto nla_put_failure;
8445         for (i = 0; i < req->n_ssids; i++) {
8446                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
8447                         goto nla_put_failure;
8448         }
8449         nla_nest_end(msg, nest);
8450
8451         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
8452         if (!nest)
8453                 goto nla_put_failure;
8454         for (i = 0; i < req->n_channels; i++) {
8455                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
8456                         goto nla_put_failure;
8457         }
8458         nla_nest_end(msg, nest);
8459
8460         if (req->ie &&
8461             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
8462                 goto nla_put_failure;
8463
8464         if (req->flags)
8465                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
8466
8467         return 0;
8468  nla_put_failure:
8469         return -ENOBUFS;
8470 }
8471
8472 static int nl80211_send_scan_msg(struct sk_buff *msg,
8473                                  struct cfg80211_registered_device *rdev,
8474                                  struct wireless_dev *wdev,
8475                                  u32 portid, u32 seq, int flags,
8476                                  u32 cmd)
8477 {
8478         void *hdr;
8479
8480         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8481         if (!hdr)
8482                 return -1;
8483
8484         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8485             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8486                                          wdev->netdev->ifindex)) ||
8487             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
8488                 goto nla_put_failure;
8489
8490         /* ignore errors and send incomplete event anyway */
8491         nl80211_add_scan_req(msg, rdev);
8492
8493         return genlmsg_end(msg, hdr);
8494
8495  nla_put_failure:
8496         genlmsg_cancel(msg, hdr);
8497         return -EMSGSIZE;
8498 }
8499
8500 static int
8501 nl80211_send_sched_scan_msg(struct sk_buff *msg,
8502                             struct cfg80211_registered_device *rdev,
8503                             struct net_device *netdev,
8504                             u32 portid, u32 seq, int flags, u32 cmd)
8505 {
8506         void *hdr;
8507
8508         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
8509         if (!hdr)
8510                 return -1;
8511
8512         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8513             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8514                 goto nla_put_failure;
8515
8516         return genlmsg_end(msg, hdr);
8517
8518  nla_put_failure:
8519         genlmsg_cancel(msg, hdr);
8520         return -EMSGSIZE;
8521 }
8522
8523 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
8524                              struct wireless_dev *wdev)
8525 {
8526         struct sk_buff *msg;
8527
8528         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8529         if (!msg)
8530                 return;
8531
8532         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8533                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
8534                 nlmsg_free(msg);
8535                 return;
8536         }
8537
8538         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8539                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8540 }
8541
8542 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
8543                             struct wireless_dev *wdev)
8544 {
8545         struct sk_buff *msg;
8546
8547         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8548         if (!msg)
8549                 return;
8550
8551         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8552                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
8553                 nlmsg_free(msg);
8554                 return;
8555         }
8556
8557         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8558                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8559 }
8560
8561 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
8562                                struct wireless_dev *wdev)
8563 {
8564         struct sk_buff *msg;
8565
8566         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8567         if (!msg)
8568                 return;
8569
8570         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
8571                                   NL80211_CMD_SCAN_ABORTED) < 0) {
8572                 nlmsg_free(msg);
8573                 return;
8574         }
8575
8576         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8577                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8578 }
8579
8580 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
8581                                      struct net_device *netdev)
8582 {
8583         struct sk_buff *msg;
8584
8585         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8586         if (!msg)
8587                 return;
8588
8589         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
8590                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
8591                 nlmsg_free(msg);
8592                 return;
8593         }
8594
8595         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8596                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8597 }
8598
8599 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
8600                              struct net_device *netdev, u32 cmd)
8601 {
8602         struct sk_buff *msg;
8603
8604         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8605         if (!msg)
8606                 return;
8607
8608         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
8609                 nlmsg_free(msg);
8610                 return;
8611         }
8612
8613         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8614                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
8615 }
8616
8617 /*
8618  * This can happen on global regulatory changes or device specific settings
8619  * based on custom world regulatory domains.
8620  */
8621 void nl80211_send_reg_change_event(struct regulatory_request *request)
8622 {
8623         struct sk_buff *msg;
8624         void *hdr;
8625
8626         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8627         if (!msg)
8628                 return;
8629
8630         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
8631         if (!hdr) {
8632                 nlmsg_free(msg);
8633                 return;
8634         }
8635
8636         /* Userspace can always count this one always being set */
8637         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
8638                 goto nla_put_failure;
8639
8640         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
8641                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8642                                NL80211_REGDOM_TYPE_WORLD))
8643                         goto nla_put_failure;
8644         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
8645                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8646                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
8647                         goto nla_put_failure;
8648         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
8649                    request->intersect) {
8650                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8651                                NL80211_REGDOM_TYPE_INTERSECTION))
8652                         goto nla_put_failure;
8653         } else {
8654                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
8655                                NL80211_REGDOM_TYPE_COUNTRY) ||
8656                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
8657                                    request->alpha2))
8658                         goto nla_put_failure;
8659         }
8660
8661         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
8662             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
8663                 goto nla_put_failure;
8664
8665         genlmsg_end(msg, hdr);
8666
8667         rcu_read_lock();
8668         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
8669                                 GFP_ATOMIC);
8670         rcu_read_unlock();
8671
8672         return;
8673
8674 nla_put_failure:
8675         genlmsg_cancel(msg, hdr);
8676         nlmsg_free(msg);
8677 }
8678
8679 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
8680                                     struct net_device *netdev,
8681                                     const u8 *buf, size_t len,
8682                                     enum nl80211_commands cmd, gfp_t gfp)
8683 {
8684         struct sk_buff *msg;
8685         void *hdr;
8686
8687         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8688         if (!msg)
8689                 return;
8690
8691         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8692         if (!hdr) {
8693                 nlmsg_free(msg);
8694                 return;
8695         }
8696
8697         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8698             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8699             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
8700                 goto nla_put_failure;
8701
8702         genlmsg_end(msg, hdr);
8703
8704         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8705                                 nl80211_mlme_mcgrp.id, gfp);
8706         return;
8707
8708  nla_put_failure:
8709         genlmsg_cancel(msg, hdr);
8710         nlmsg_free(msg);
8711 }
8712
8713 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
8714                           struct net_device *netdev, const u8 *buf,
8715                           size_t len, gfp_t gfp)
8716 {
8717         nl80211_send_mlme_event(rdev, netdev, buf, len,
8718                                 NL80211_CMD_AUTHENTICATE, gfp);
8719 }
8720
8721 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
8722                            struct net_device *netdev, const u8 *buf,
8723                            size_t len, gfp_t gfp)
8724 {
8725         nl80211_send_mlme_event(rdev, netdev, buf, len,
8726                                 NL80211_CMD_ASSOCIATE, gfp);
8727 }
8728
8729 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
8730                          struct net_device *netdev, const u8 *buf,
8731                          size_t len, gfp_t gfp)
8732 {
8733         nl80211_send_mlme_event(rdev, netdev, buf, len,
8734                                 NL80211_CMD_DEAUTHENTICATE, gfp);
8735 }
8736
8737 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
8738                            struct net_device *netdev, const u8 *buf,
8739                            size_t len, gfp_t gfp)
8740 {
8741         nl80211_send_mlme_event(rdev, netdev, buf, len,
8742                                 NL80211_CMD_DISASSOCIATE, gfp);
8743 }
8744
8745 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
8746                                 struct net_device *netdev, const u8 *buf,
8747                                 size_t len, gfp_t gfp)
8748 {
8749         nl80211_send_mlme_event(rdev, netdev, buf, len,
8750                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
8751 }
8752
8753 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
8754                                   struct net_device *netdev, const u8 *buf,
8755                                   size_t len, gfp_t gfp)
8756 {
8757         nl80211_send_mlme_event(rdev, netdev, buf, len,
8758                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
8759 }
8760
8761 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
8762                                       struct net_device *netdev, int cmd,
8763                                       const u8 *addr, gfp_t gfp)
8764 {
8765         struct sk_buff *msg;
8766         void *hdr;
8767
8768         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8769         if (!msg)
8770                 return;
8771
8772         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8773         if (!hdr) {
8774                 nlmsg_free(msg);
8775                 return;
8776         }
8777
8778         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8779             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8780             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
8781             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8782                 goto nla_put_failure;
8783
8784         genlmsg_end(msg, hdr);
8785
8786         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8787                                 nl80211_mlme_mcgrp.id, gfp);
8788         return;
8789
8790  nla_put_failure:
8791         genlmsg_cancel(msg, hdr);
8792         nlmsg_free(msg);
8793 }
8794
8795 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
8796                                struct net_device *netdev, const u8 *addr,
8797                                gfp_t gfp)
8798 {
8799         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
8800                                   addr, gfp);
8801 }
8802
8803 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
8804                                 struct net_device *netdev, const u8 *addr,
8805                                 gfp_t gfp)
8806 {
8807         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
8808                                   addr, gfp);
8809 }
8810
8811 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
8812                                  struct net_device *netdev, const u8 *bssid,
8813                                  const u8 *req_ie, size_t req_ie_len,
8814                                  const u8 *resp_ie, size_t resp_ie_len,
8815                                  u16 status, gfp_t gfp)
8816 {
8817         struct sk_buff *msg;
8818         void *hdr;
8819
8820         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8821         if (!msg)
8822                 return;
8823
8824         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
8825         if (!hdr) {
8826                 nlmsg_free(msg);
8827                 return;
8828         }
8829
8830         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8831             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8832             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
8833             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
8834             (req_ie &&
8835              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8836             (resp_ie &&
8837              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8838                 goto nla_put_failure;
8839
8840         genlmsg_end(msg, hdr);
8841
8842         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8843                                 nl80211_mlme_mcgrp.id, gfp);
8844         return;
8845
8846  nla_put_failure:
8847         genlmsg_cancel(msg, hdr);
8848         nlmsg_free(msg);
8849
8850 }
8851
8852 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
8853                          struct net_device *netdev, const u8 *bssid,
8854                          const u8 *req_ie, size_t req_ie_len,
8855                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
8856 {
8857         struct sk_buff *msg;
8858         void *hdr;
8859
8860         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8861         if (!msg)
8862                 return;
8863
8864         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
8865         if (!hdr) {
8866                 nlmsg_free(msg);
8867                 return;
8868         }
8869
8870         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8871             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8872             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
8873             (req_ie &&
8874              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8875             (resp_ie &&
8876              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8877                 goto nla_put_failure;
8878
8879         genlmsg_end(msg, hdr);
8880
8881         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8882                                 nl80211_mlme_mcgrp.id, gfp);
8883         return;
8884
8885  nla_put_failure:
8886         genlmsg_cancel(msg, hdr);
8887         nlmsg_free(msg);
8888
8889 }
8890
8891 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
8892                                struct net_device *netdev, u16 reason,
8893                                const u8 *ie, size_t ie_len, bool from_ap)
8894 {
8895         struct sk_buff *msg;
8896         void *hdr;
8897
8898         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8899         if (!msg)
8900                 return;
8901
8902         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
8903         if (!hdr) {
8904                 nlmsg_free(msg);
8905                 return;
8906         }
8907
8908         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8909             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8910             (from_ap && reason &&
8911              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
8912             (from_ap &&
8913              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
8914             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
8915                 goto nla_put_failure;
8916
8917         genlmsg_end(msg, hdr);
8918
8919         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8920                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
8921         return;
8922
8923  nla_put_failure:
8924         genlmsg_cancel(msg, hdr);
8925         nlmsg_free(msg);
8926
8927 }
8928
8929 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
8930                              struct net_device *netdev, const u8 *bssid,
8931                              gfp_t gfp)
8932 {
8933         struct sk_buff *msg;
8934         void *hdr;
8935
8936         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8937         if (!msg)
8938                 return;
8939
8940         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
8941         if (!hdr) {
8942                 nlmsg_free(msg);
8943                 return;
8944         }
8945
8946         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8947             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8948             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8949                 goto nla_put_failure;
8950
8951         genlmsg_end(msg, hdr);
8952
8953         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8954                                 nl80211_mlme_mcgrp.id, gfp);
8955         return;
8956
8957  nla_put_failure:
8958         genlmsg_cancel(msg, hdr);
8959         nlmsg_free(msg);
8960 }
8961
8962 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
8963                 struct net_device *netdev,
8964                 const u8 *macaddr, const u8* ie, u8 ie_len,
8965                 gfp_t gfp)
8966 {
8967         struct sk_buff *msg;
8968         void *hdr;
8969
8970         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8971         if (!msg)
8972                 return;
8973
8974         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
8975         if (!hdr) {
8976                 nlmsg_free(msg);
8977                 return;
8978         }
8979
8980         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8981             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8982             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
8983             (ie_len && ie &&
8984              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
8985                 goto nla_put_failure;
8986
8987         genlmsg_end(msg, hdr);
8988
8989         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8990                                 nl80211_mlme_mcgrp.id, gfp);
8991         return;
8992
8993  nla_put_failure:
8994         genlmsg_cancel(msg, hdr);
8995         nlmsg_free(msg);
8996 }
8997
8998 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
8999                                  struct net_device *netdev, const u8 *addr,
9000                                  enum nl80211_key_type key_type, int key_id,
9001                                  const u8 *tsc, gfp_t gfp)
9002 {
9003         struct sk_buff *msg;
9004         void *hdr;
9005
9006         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9007         if (!msg)
9008                 return;
9009
9010         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
9011         if (!hdr) {
9012                 nlmsg_free(msg);
9013                 return;
9014         }
9015
9016         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9017             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9018             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
9019             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
9020             (key_id != -1 &&
9021              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
9022             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
9023                 goto nla_put_failure;
9024
9025         genlmsg_end(msg, hdr);
9026
9027         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9028                                 nl80211_mlme_mcgrp.id, gfp);
9029         return;
9030
9031  nla_put_failure:
9032         genlmsg_cancel(msg, hdr);
9033         nlmsg_free(msg);
9034 }
9035
9036 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
9037                                     struct ieee80211_channel *channel_before,
9038                                     struct ieee80211_channel *channel_after)
9039 {
9040         struct sk_buff *msg;
9041         void *hdr;
9042         struct nlattr *nl_freq;
9043
9044         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
9045         if (!msg)
9046                 return;
9047
9048         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
9049         if (!hdr) {
9050                 nlmsg_free(msg);
9051                 return;
9052         }
9053
9054         /*
9055          * Since we are applying the beacon hint to a wiphy we know its
9056          * wiphy_idx is valid
9057          */
9058         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
9059                 goto nla_put_failure;
9060
9061         /* Before */
9062         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
9063         if (!nl_freq)
9064                 goto nla_put_failure;
9065         if (nl80211_msg_put_channel(msg, channel_before))
9066                 goto nla_put_failure;
9067         nla_nest_end(msg, nl_freq);
9068
9069         /* After */
9070         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
9071         if (!nl_freq)
9072                 goto nla_put_failure;
9073         if (nl80211_msg_put_channel(msg, channel_after))
9074                 goto nla_put_failure;
9075         nla_nest_end(msg, nl_freq);
9076
9077         genlmsg_end(msg, hdr);
9078
9079         rcu_read_lock();
9080         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
9081                                 GFP_ATOMIC);
9082         rcu_read_unlock();
9083
9084         return;
9085
9086 nla_put_failure:
9087         genlmsg_cancel(msg, hdr);
9088         nlmsg_free(msg);
9089 }
9090
9091 static void nl80211_send_remain_on_chan_event(
9092         int cmd, struct cfg80211_registered_device *rdev,
9093         struct wireless_dev *wdev, u64 cookie,
9094         struct ieee80211_channel *chan,
9095         unsigned int duration, gfp_t gfp)
9096 {
9097         struct sk_buff *msg;
9098         void *hdr;
9099
9100         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9101         if (!msg)
9102                 return;
9103
9104         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9105         if (!hdr) {
9106                 nlmsg_free(msg);
9107                 return;
9108         }
9109
9110         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9111             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9112                                          wdev->netdev->ifindex)) ||
9113             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
9114             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
9115             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
9116                         NL80211_CHAN_NO_HT) ||
9117             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9118                 goto nla_put_failure;
9119
9120         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
9121             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
9122                 goto nla_put_failure;
9123
9124         genlmsg_end(msg, hdr);
9125
9126         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9127                                 nl80211_mlme_mcgrp.id, gfp);
9128         return;
9129
9130  nla_put_failure:
9131         genlmsg_cancel(msg, hdr);
9132         nlmsg_free(msg);
9133 }
9134
9135 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
9136                                     struct wireless_dev *wdev, u64 cookie,
9137                                     struct ieee80211_channel *chan,
9138                                     unsigned int duration, gfp_t gfp)
9139 {
9140         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
9141                                           rdev, wdev, cookie, chan,
9142                                           duration, gfp);
9143 }
9144
9145 void nl80211_send_remain_on_channel_cancel(
9146         struct cfg80211_registered_device *rdev,
9147         struct wireless_dev *wdev,
9148         u64 cookie, struct ieee80211_channel *chan, gfp_t gfp)
9149 {
9150         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9151                                           rdev, wdev, cookie, chan, 0, gfp);
9152 }
9153
9154 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
9155                             struct net_device *dev, const u8 *mac_addr,
9156                             struct station_info *sinfo, gfp_t gfp)
9157 {
9158         struct sk_buff *msg;
9159
9160         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9161         if (!msg)
9162                 return;
9163
9164         if (nl80211_send_station(msg, 0, 0, 0,
9165                                  rdev, dev, mac_addr, sinfo) < 0) {
9166                 nlmsg_free(msg);
9167                 return;
9168         }
9169
9170         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9171                                 nl80211_mlme_mcgrp.id, gfp);
9172 }
9173
9174 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
9175                                 struct net_device *dev, const u8 *mac_addr,
9176                                 gfp_t gfp)
9177 {
9178         struct sk_buff *msg;
9179         void *hdr;
9180
9181         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9182         if (!msg)
9183                 return;
9184
9185         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
9186         if (!hdr) {
9187                 nlmsg_free(msg);
9188                 return;
9189         }
9190
9191         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9192             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
9193                 goto nla_put_failure;
9194
9195         genlmsg_end(msg, hdr);
9196
9197         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9198                                 nl80211_mlme_mcgrp.id, gfp);
9199         return;
9200
9201  nla_put_failure:
9202         genlmsg_cancel(msg, hdr);
9203         nlmsg_free(msg);
9204 }
9205
9206 void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
9207                                     struct net_device *dev, const u8 *mac_addr,
9208                                     enum nl80211_connect_failed_reason reason,
9209                                     gfp_t gfp)
9210 {
9211         struct sk_buff *msg;
9212         void *hdr;
9213
9214         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9215         if (!msg)
9216                 return;
9217
9218         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
9219         if (!hdr) {
9220                 nlmsg_free(msg);
9221                 return;
9222         }
9223
9224         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9225             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
9226             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
9227                 goto nla_put_failure;
9228
9229         genlmsg_end(msg, hdr);
9230
9231         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9232                                 nl80211_mlme_mcgrp.id, gfp);
9233         return;
9234
9235  nla_put_failure:
9236         genlmsg_cancel(msg, hdr);
9237         nlmsg_free(msg);
9238 }
9239
9240 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
9241                                        const u8 *addr, gfp_t gfp)
9242 {
9243         struct wireless_dev *wdev = dev->ieee80211_ptr;
9244         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9245         struct sk_buff *msg;
9246         void *hdr;
9247         int err;
9248         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
9249
9250         if (!nlportid)
9251                 return false;
9252
9253         msg = nlmsg_new(100, gfp);
9254         if (!msg)
9255                 return true;
9256
9257         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
9258         if (!hdr) {
9259                 nlmsg_free(msg);
9260                 return true;
9261         }
9262
9263         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9264             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9265             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
9266                 goto nla_put_failure;
9267
9268         err = genlmsg_end(msg, hdr);
9269         if (err < 0) {
9270                 nlmsg_free(msg);
9271                 return true;
9272         }
9273
9274         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9275         return true;
9276
9277  nla_put_failure:
9278         genlmsg_cancel(msg, hdr);
9279         nlmsg_free(msg);
9280         return true;
9281 }
9282
9283 bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
9284 {
9285         return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
9286                                           addr, gfp);
9287 }
9288
9289 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
9290                                     const u8 *addr, gfp_t gfp)
9291 {
9292         return __nl80211_unexpected_frame(dev,
9293                                           NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
9294                                           addr, gfp);
9295 }
9296
9297 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
9298                       struct wireless_dev *wdev, u32 nlportid,
9299                       int freq, int sig_dbm,
9300                       const u8 *buf, size_t len, gfp_t gfp)
9301 {
9302         struct net_device *netdev = wdev->netdev;
9303         struct sk_buff *msg;
9304         void *hdr;
9305
9306         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9307         if (!msg)
9308                 return -ENOMEM;
9309
9310         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9311         if (!hdr) {
9312                 nlmsg_free(msg);
9313                 return -ENOMEM;
9314         }
9315
9316         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9317             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9318                                         netdev->ifindex)) ||
9319             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
9320             (sig_dbm &&
9321              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9322             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
9323                 goto nla_put_failure;
9324
9325         genlmsg_end(msg, hdr);
9326
9327         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
9328
9329  nla_put_failure:
9330         genlmsg_cancel(msg, hdr);
9331         nlmsg_free(msg);
9332         return -ENOBUFS;
9333 }
9334
9335 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
9336                                  struct wireless_dev *wdev, u64 cookie,
9337                                  const u8 *buf, size_t len, bool ack,
9338                                  gfp_t gfp)
9339 {
9340         struct net_device *netdev = wdev->netdev;
9341         struct sk_buff *msg;
9342         void *hdr;
9343
9344         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9345         if (!msg)
9346                 return;
9347
9348         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
9349         if (!hdr) {
9350                 nlmsg_free(msg);
9351                 return;
9352         }
9353
9354         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9355             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9356                                    netdev->ifindex)) ||
9357             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
9358             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
9359             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
9360                 goto nla_put_failure;
9361
9362         genlmsg_end(msg, hdr);
9363
9364         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
9365         return;
9366
9367  nla_put_failure:
9368         genlmsg_cancel(msg, hdr);
9369         nlmsg_free(msg);
9370 }
9371
9372 void
9373 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
9374                              struct net_device *netdev,
9375                              enum nl80211_cqm_rssi_threshold_event rssi_event,
9376                              gfp_t gfp)
9377 {
9378         struct sk_buff *msg;
9379         struct nlattr *pinfoattr;
9380         void *hdr;
9381
9382         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9383         if (!msg)
9384                 return;
9385
9386         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9387         if (!hdr) {
9388                 nlmsg_free(msg);
9389                 return;
9390         }
9391
9392         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9393             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9394                 goto nla_put_failure;
9395
9396         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9397         if (!pinfoattr)
9398                 goto nla_put_failure;
9399
9400         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
9401                         rssi_event))
9402                 goto nla_put_failure;
9403
9404         nla_nest_end(msg, pinfoattr);
9405
9406         genlmsg_end(msg, hdr);
9407
9408         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9409                                 nl80211_mlme_mcgrp.id, gfp);
9410         return;
9411
9412  nla_put_failure:
9413         genlmsg_cancel(msg, hdr);
9414         nlmsg_free(msg);
9415 }
9416
9417 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
9418                               struct net_device *netdev, const u8 *bssid,
9419                               const u8 *replay_ctr, gfp_t gfp)
9420 {
9421         struct sk_buff *msg;
9422         struct nlattr *rekey_attr;
9423         void *hdr;
9424
9425         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9426         if (!msg)
9427                 return;
9428
9429         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
9430         if (!hdr) {
9431                 nlmsg_free(msg);
9432                 return;
9433         }
9434
9435         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9436             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9437             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
9438                 goto nla_put_failure;
9439
9440         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
9441         if (!rekey_attr)
9442                 goto nla_put_failure;
9443
9444         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
9445                     NL80211_REPLAY_CTR_LEN, replay_ctr))
9446                 goto nla_put_failure;
9447
9448         nla_nest_end(msg, rekey_attr);
9449
9450         genlmsg_end(msg, hdr);
9451
9452         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9453                                 nl80211_mlme_mcgrp.id, gfp);
9454         return;
9455
9456  nla_put_failure:
9457         genlmsg_cancel(msg, hdr);
9458         nlmsg_free(msg);
9459 }
9460
9461 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
9462                                     struct net_device *netdev, int index,
9463                                     const u8 *bssid, bool preauth, gfp_t gfp)
9464 {
9465         struct sk_buff *msg;
9466         struct nlattr *attr;
9467         void *hdr;
9468
9469         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9470         if (!msg)
9471                 return;
9472
9473         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
9474         if (!hdr) {
9475                 nlmsg_free(msg);
9476                 return;
9477         }
9478
9479         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9480             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9481                 goto nla_put_failure;
9482
9483         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
9484         if (!attr)
9485                 goto nla_put_failure;
9486
9487         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
9488             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
9489             (preauth &&
9490              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
9491                 goto nla_put_failure;
9492
9493         nla_nest_end(msg, attr);
9494
9495         genlmsg_end(msg, hdr);
9496
9497         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9498                                 nl80211_mlme_mcgrp.id, gfp);
9499         return;
9500
9501  nla_put_failure:
9502         genlmsg_cancel(msg, hdr);
9503         nlmsg_free(msg);
9504 }
9505
9506 void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
9507                               struct net_device *netdev,
9508                               struct cfg80211_chan_def *chandef, gfp_t gfp)
9509 {
9510         struct sk_buff *msg;
9511         void *hdr;
9512
9513         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9514         if (!msg)
9515                 return;
9516
9517         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
9518         if (!hdr) {
9519                 nlmsg_free(msg);
9520                 return;
9521         }
9522
9523         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9524                 goto nla_put_failure;
9525
9526         if (nl80211_send_chandef(msg, chandef))
9527                 goto nla_put_failure;
9528
9529         genlmsg_end(msg, hdr);
9530
9531         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9532                                 nl80211_mlme_mcgrp.id, gfp);
9533         return;
9534
9535  nla_put_failure:
9536         genlmsg_cancel(msg, hdr);
9537         nlmsg_free(msg);
9538 }
9539
9540 void
9541 nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
9542                             struct net_device *netdev, const u8 *peer,
9543                             u32 num_packets, u32 rate, u32 intvl, gfp_t gfp)
9544 {
9545         struct sk_buff *msg;
9546         struct nlattr *pinfoattr;
9547         void *hdr;
9548
9549         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
9550         if (!msg)
9551                 return;
9552
9553         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9554         if (!hdr) {
9555                 nlmsg_free(msg);
9556                 return;
9557         }
9558
9559         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9560             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9561             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
9562                 goto nla_put_failure;
9563
9564         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9565         if (!pinfoattr)
9566                 goto nla_put_failure;
9567
9568         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
9569                 goto nla_put_failure;
9570
9571         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
9572                 goto nla_put_failure;
9573
9574         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
9575                 goto nla_put_failure;
9576
9577         nla_nest_end(msg, pinfoattr);
9578
9579         genlmsg_end(msg, hdr);
9580
9581         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9582                                 nl80211_mlme_mcgrp.id, gfp);
9583         return;
9584
9585  nla_put_failure:
9586         genlmsg_cancel(msg, hdr);
9587         nlmsg_free(msg);
9588 }
9589
9590 void
9591 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
9592                      struct cfg80211_chan_def *chandef,
9593                      enum nl80211_radar_event event,
9594                      struct net_device *netdev, gfp_t gfp)
9595 {
9596         struct sk_buff *msg;
9597         void *hdr;
9598
9599         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9600         if (!msg)
9601                 return;
9602
9603         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
9604         if (!hdr) {
9605                 nlmsg_free(msg);
9606                 return;
9607         }
9608
9609         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9610                 goto nla_put_failure;
9611
9612         /* NOP and radar events don't need a netdev parameter */
9613         if (netdev) {
9614                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
9615
9616                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9617                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9618                         goto nla_put_failure;
9619         }
9620
9621         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
9622                 goto nla_put_failure;
9623
9624         if (nl80211_send_chandef(msg, chandef))
9625                 goto nla_put_failure;
9626
9627         if (genlmsg_end(msg, hdr) < 0) {
9628                 nlmsg_free(msg);
9629                 return;
9630         }
9631
9632         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9633                                 nl80211_mlme_mcgrp.id, gfp);
9634         return;
9635
9636  nla_put_failure:
9637         genlmsg_cancel(msg, hdr);
9638         nlmsg_free(msg);
9639 }
9640
9641 void
9642 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
9643                                 struct net_device *netdev, const u8 *peer,
9644                                 u32 num_packets, gfp_t gfp)
9645 {
9646         struct sk_buff *msg;
9647         struct nlattr *pinfoattr;
9648         void *hdr;
9649
9650         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9651         if (!msg)
9652                 return;
9653
9654         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
9655         if (!hdr) {
9656                 nlmsg_free(msg);
9657                 return;
9658         }
9659
9660         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9661             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
9662             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
9663                 goto nla_put_failure;
9664
9665         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
9666         if (!pinfoattr)
9667                 goto nla_put_failure;
9668
9669         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
9670                 goto nla_put_failure;
9671
9672         nla_nest_end(msg, pinfoattr);
9673
9674         genlmsg_end(msg, hdr);
9675
9676         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9677                                 nl80211_mlme_mcgrp.id, gfp);
9678         return;
9679
9680  nla_put_failure:
9681         genlmsg_cancel(msg, hdr);
9682         nlmsg_free(msg);
9683 }
9684
9685 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
9686                            u64 cookie, bool acked, gfp_t gfp)
9687 {
9688         struct wireless_dev *wdev = dev->ieee80211_ptr;
9689         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9690         struct sk_buff *msg;
9691         void *hdr;
9692         int err;
9693
9694         trace_cfg80211_probe_status(dev, addr, cookie, acked);
9695
9696         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9697
9698         if (!msg)
9699                 return;
9700
9701         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
9702         if (!hdr) {
9703                 nlmsg_free(msg);
9704                 return;
9705         }
9706
9707         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9708             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9709             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
9710             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
9711             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
9712                 goto nla_put_failure;
9713
9714         err = genlmsg_end(msg, hdr);
9715         if (err < 0) {
9716                 nlmsg_free(msg);
9717                 return;
9718         }
9719
9720         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9721                                 nl80211_mlme_mcgrp.id, gfp);
9722         return;
9723
9724  nla_put_failure:
9725         genlmsg_cancel(msg, hdr);
9726         nlmsg_free(msg);
9727 }
9728 EXPORT_SYMBOL(cfg80211_probe_status);
9729
9730 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
9731                                  const u8 *frame, size_t len,
9732                                  int freq, int sig_dbm)
9733 {
9734         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9735         struct sk_buff *msg;
9736         void *hdr;
9737         struct cfg80211_beacon_registration *reg;
9738
9739         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
9740
9741         spin_lock_bh(&rdev->beacon_registrations_lock);
9742         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9743                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
9744                 if (!msg) {
9745                         spin_unlock_bh(&rdev->beacon_registrations_lock);
9746                         return;
9747                 }
9748
9749                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9750                 if (!hdr)
9751                         goto nla_put_failure;
9752
9753                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9754                     (freq &&
9755                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
9756                     (sig_dbm &&
9757                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9758                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
9759                         goto nla_put_failure;
9760
9761                 genlmsg_end(msg, hdr);
9762
9763                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
9764         }
9765         spin_unlock_bh(&rdev->beacon_registrations_lock);
9766         return;
9767
9768  nla_put_failure:
9769         spin_unlock_bh(&rdev->beacon_registrations_lock);
9770         if (hdr)
9771                 genlmsg_cancel(msg, hdr);
9772         nlmsg_free(msg);
9773 }
9774 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
9775
9776 #ifdef CONFIG_PM
9777 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
9778                                    struct cfg80211_wowlan_wakeup *wakeup,
9779                                    gfp_t gfp)
9780 {
9781         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9782         struct sk_buff *msg;
9783         void *hdr;
9784         int err, size = 200;
9785
9786         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
9787
9788         if (wakeup)
9789                 size += wakeup->packet_present_len;
9790
9791         msg = nlmsg_new(size, gfp);
9792         if (!msg)
9793                 return;
9794
9795         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
9796         if (!hdr)
9797                 goto free_msg;
9798
9799         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9800             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9801                 goto free_msg;
9802
9803         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9804                                         wdev->netdev->ifindex))
9805                 goto free_msg;
9806
9807         if (wakeup) {
9808                 struct nlattr *reasons;
9809
9810                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9811
9812                 if (wakeup->disconnect &&
9813                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
9814                         goto free_msg;
9815                 if (wakeup->magic_pkt &&
9816                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
9817                         goto free_msg;
9818                 if (wakeup->gtk_rekey_failure &&
9819                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
9820                         goto free_msg;
9821                 if (wakeup->eap_identity_req &&
9822                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
9823                         goto free_msg;
9824                 if (wakeup->four_way_handshake &&
9825                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
9826                         goto free_msg;
9827                 if (wakeup->rfkill_release &&
9828                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
9829                         goto free_msg;
9830
9831                 if (wakeup->pattern_idx >= 0 &&
9832                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
9833                                 wakeup->pattern_idx))
9834                         goto free_msg;
9835
9836                 if (wakeup->tcp_match)
9837                         nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH);
9838
9839                 if (wakeup->tcp_connlost)
9840                         nla_put_flag(msg,
9841                                      NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST);
9842
9843                 if (wakeup->tcp_nomoretokens)
9844                         nla_put_flag(msg,
9845                                 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS);
9846
9847                 if (wakeup->packet) {
9848                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
9849                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
9850
9851                         if (!wakeup->packet_80211) {
9852                                 pkt_attr =
9853                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
9854                                 len_attr =
9855                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
9856                         }
9857
9858                         if (wakeup->packet_len &&
9859                             nla_put_u32(msg, len_attr, wakeup->packet_len))
9860                                 goto free_msg;
9861
9862                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
9863                                     wakeup->packet))
9864                                 goto free_msg;
9865                 }
9866
9867                 nla_nest_end(msg, reasons);
9868         }
9869
9870         err = genlmsg_end(msg, hdr);
9871         if (err < 0)
9872                 goto free_msg;
9873
9874         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9875                                 nl80211_mlme_mcgrp.id, gfp);
9876         return;
9877
9878  free_msg:
9879         nlmsg_free(msg);
9880 }
9881 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
9882 #endif
9883
9884 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
9885                                 enum nl80211_tdls_operation oper,
9886                                 u16 reason_code, gfp_t gfp)
9887 {
9888         struct wireless_dev *wdev = dev->ieee80211_ptr;
9889         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9890         struct sk_buff *msg;
9891         void *hdr;
9892         int err;
9893
9894         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
9895                                          reason_code);
9896
9897         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9898         if (!msg)
9899                 return;
9900
9901         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
9902         if (!hdr) {
9903                 nlmsg_free(msg);
9904                 return;
9905         }
9906
9907         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9908             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9909             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
9910             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
9911             (reason_code > 0 &&
9912              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
9913                 goto nla_put_failure;
9914
9915         err = genlmsg_end(msg, hdr);
9916         if (err < 0) {
9917                 nlmsg_free(msg);
9918                 return;
9919         }
9920
9921         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9922                                 nl80211_mlme_mcgrp.id, gfp);
9923         return;
9924
9925  nla_put_failure:
9926         genlmsg_cancel(msg, hdr);
9927         nlmsg_free(msg);
9928 }
9929 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
9930
9931 static int nl80211_netlink_notify(struct notifier_block * nb,
9932                                   unsigned long state,
9933                                   void *_notify)
9934 {
9935         struct netlink_notify *notify = _notify;
9936         struct cfg80211_registered_device *rdev;
9937         struct wireless_dev *wdev;
9938         struct cfg80211_beacon_registration *reg, *tmp;
9939
9940         if (state != NETLINK_URELEASE)
9941                 return NOTIFY_DONE;
9942
9943         rcu_read_lock();
9944
9945         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
9946                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
9947                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
9948
9949                 spin_lock_bh(&rdev->beacon_registrations_lock);
9950                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
9951                                          list) {
9952                         if (reg->nlportid == notify->portid) {
9953                                 list_del(&reg->list);
9954                                 kfree(reg);
9955                                 break;
9956                         }
9957                 }
9958                 spin_unlock_bh(&rdev->beacon_registrations_lock);
9959         }
9960
9961         rcu_read_unlock();
9962
9963         return NOTIFY_DONE;
9964 }
9965
9966 static struct notifier_block nl80211_netlink_notifier = {
9967         .notifier_call = nl80211_netlink_notify,
9968 };
9969
9970 /* initialisation/exit functions */
9971
9972 int nl80211_init(void)
9973 {
9974         int err;
9975
9976         err = genl_register_family_with_ops(&nl80211_fam,
9977                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
9978         if (err)
9979                 return err;
9980
9981         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
9982         if (err)
9983                 goto err_out;
9984
9985         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
9986         if (err)
9987                 goto err_out;
9988
9989         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
9990         if (err)
9991                 goto err_out;
9992
9993         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
9994         if (err)
9995                 goto err_out;
9996
9997 #ifdef CONFIG_NL80211_TESTMODE
9998         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
9999         if (err)
10000                 goto err_out;
10001 #endif
10002
10003         err = netlink_register_notifier(&nl80211_netlink_notifier);
10004         if (err)
10005                 goto err_out;
10006
10007         return 0;
10008  err_out:
10009         genl_unregister_family(&nl80211_fam);
10010         return err;
10011 }
10012
10013 void nl80211_exit(void)
10014 {
10015         netlink_unregister_notifier(&nl80211_netlink_notifier);
10016         genl_unregister_family(&nl80211_fam);
10017 }