net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2017  Intel Deutschland GmbH
   7  */
   8
   9 #include <linux/if.h>
  10 #include <linux/module.h>
  11 #include <linux/err.h>
  12 #include <linux/slab.h>
  13 #include <linux/list.h>
  14 #include <linux/if_ether.h>
  15 #include <linux/ieee80211.h>
  16 #include <linux/nl80211.h>
  17 #include <linux/rtnetlink.h>
  18 #include <linux/netlink.h>
  19 #include <linux/etherdevice.h>
  20 #include <net/net_namespace.h>
  21 #include <net/genetlink.h>
  22 #include <net/cfg80211.h>
  23 #include <net/sock.h>
  24 #include <net/inet_connection_sock.h>
  25 #include "core.h"
  26 #include "nl80211.h"
  27 #include "reg.h"
  28 #include "rdev-ops.h"
  29
  30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  31                                    struct genl_info *info,
  32                                    struct cfg80211_crypto_settings *settings,
  33                                    int cipher_limit);
  34
  35 /* the netlink family */
  36 static struct genl_family nl80211_fam;
  37
  38 /* multicast groups */
  39 enum nl80211_multicast_groups {
  40         NL80211_MCGRP_CONFIG,
  41         NL80211_MCGRP_SCAN,
  42         NL80211_MCGRP_REGULATORY,
  43         NL80211_MCGRP_MLME,
  44         NL80211_MCGRP_VENDOR,
  45         NL80211_MCGRP_NAN,
  46         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  47 };
  48
  49 static const struct genl_multicast_group nl80211_mcgrps[] = {
  50         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  51         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  52         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  53         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  54         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  55         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  56 #ifdef CONFIG_NL80211_TESTMODE
  57         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  58 #endif
  59 };
  60
  61 /* returns ERR_PTR values */
  62 static struct wireless_dev *
  63 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  64 {
  65         struct cfg80211_registered_device *rdev;
  66         struct wireless_dev *result = NULL;
  67         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  68         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  69         u64 wdev_id;
  70         int wiphy_idx = -1;
  71         int ifidx = -1;
  72
  73         ASSERT_RTNL();
  74
  75         if (!have_ifidx && !have_wdev_id)
  76                 return ERR_PTR(-EINVAL);
  77
  78         if (have_ifidx)
  79                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  80         if (have_wdev_id) {
  81                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  82                 wiphy_idx = wdev_id >> 32;
  83         }
  84
  85         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  86                 struct wireless_dev *wdev;
  87
  88                 if (wiphy_net(&rdev->wiphy) != netns)
  89                         continue;
  90
  91                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  92                         continue;
  93
  94                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  95                         if (have_ifidx && wdev->netdev &&
  96                             wdev->netdev->ifindex == ifidx) {
  97                                 result = wdev;
  98                                 break;
  99                         }
 100                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 101                                 result = wdev;
 102                                 break;
 103                         }
 104                 }
 105
 106                 if (result)
 107                         break;
 108         }
 109
 110         if (result)
 111                 return result;
 112         return ERR_PTR(-ENODEV);
 113 }
 114
 115 static struct cfg80211_registered_device *
 116 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 117 {
 118         struct cfg80211_registered_device *rdev = NULL, *tmp;
 119         struct net_device *netdev;
 120
 121         ASSERT_RTNL();
 122
 123         if (!attrs[NL80211_ATTR_WIPHY] &&
 124             !attrs[NL80211_ATTR_IFINDEX] &&
 125             !attrs[NL80211_ATTR_WDEV])
 126                 return ERR_PTR(-EINVAL);
 127
 128         if (attrs[NL80211_ATTR_WIPHY])
 129                 rdev = cfg80211_rdev_by_wiphy_idx(
 130                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 131
 132         if (attrs[NL80211_ATTR_WDEV]) {
 133                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 134                 struct wireless_dev *wdev;
 135                 bool found = false;
 136
 137                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 138                 if (tmp) {
 139                         /* make sure wdev exists */
 140                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 141                                 if (wdev->identifier != (u32)wdev_id)
 142                                         continue;
 143                                 found = true;
 144                                 break;
 145                         }
 146
 147                         if (!found)
 148                                 tmp = NULL;
 149
 150                         if (rdev && tmp != rdev)
 151                                 return ERR_PTR(-EINVAL);
 152                         rdev = tmp;
 153                 }
 154         }
 155
 156         if (attrs[NL80211_ATTR_IFINDEX]) {
 157                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 158
 159                 netdev = __dev_get_by_index(netns, ifindex);
 160                 if (netdev) {
 161                         if (netdev->ieee80211_ptr)
 162                                 tmp = wiphy_to_rdev(
 163                                         netdev->ieee80211_ptr->wiphy);
 164                         else
 165                                 tmp = NULL;
 166
 167                         /* not wireless device -- return error */
 168                         if (!tmp)
 169                                 return ERR_PTR(-EINVAL);
 170
 171                         /* mismatch -- return error */
 172                         if (rdev && tmp != rdev)
 173                                 return ERR_PTR(-EINVAL);
 174
 175                         rdev = tmp;
 176                 }
 177         }
 178
 179         if (!rdev)
 180                 return ERR_PTR(-ENODEV);
 181
 182         if (netns != wiphy_net(&rdev->wiphy))
 183                 return ERR_PTR(-ENODEV);
 184
 185         return rdev;
 186 }
 187
 188 /*
 189  * This function returns a pointer to the driver
 190  * that the genl_info item that is passed refers to.
 191  *
 192  * The result of this can be a PTR_ERR and hence must
 193  * be checked with IS_ERR() for errors.
 194  */
 195 static struct cfg80211_registered_device *
 196 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 197 {
 198         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 199 }
 200
 201 /* policy for the attributes */
 202 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 203         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 204         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 205                                       .len = 20-1 },
 206         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 207
 208         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 209         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 210         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 211         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 212         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 213
 214         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 215         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 216         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 217         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 218         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 219         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 220
 221         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 222         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 223         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 224
 225         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 226         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 227
 228         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 229         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 230                                     .len = WLAN_MAX_KEY_LEN },
 231         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 232         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 233         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 234         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 235         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 236
 237         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 238         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 239         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 240                                        .len = IEEE80211_MAX_DATA_LEN },
 241         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 242                                        .len = IEEE80211_MAX_DATA_LEN },
 243         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 244         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 245         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 246         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 247                                                .len = NL80211_MAX_SUPP_RATES },
 248         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 249         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 250         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 251         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 252                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 253         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 254
 255         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 256         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 257
 258         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 259         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 260         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 261         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 262                                            .len = NL80211_MAX_SUPP_RATES },
 263         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 264
 265         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 266         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 267
 268         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 269
 270         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 271         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 272                               .len = IEEE80211_MAX_DATA_LEN },
 273         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 274         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 275
 276         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 277                                 .len = IEEE80211_MAX_SSID_LEN },
 278         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 279         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 280         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 281         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 282         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 283         [NL80211_ATTR_STA_FLAGS2] = {
 284                 .len = sizeof(struct nl80211_sta_flag_update),
 285         },
 286         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 287         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 288         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 289         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 290         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 291         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 292         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 293         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 294         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 295                                  .len = WLAN_PMKID_LEN },
 296         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 297         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 298         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 299         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 300                                  .len = IEEE80211_MAX_DATA_LEN },
 301         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 302         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 303         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 304         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 305         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 306         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 307         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 308         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 309         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 310         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 311         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 312         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 313         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 314         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 315         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 316         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 317         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 318         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 319         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 320         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 321                                          .len = IEEE80211_MAX_DATA_LEN },
 322         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 323                                          .len = IEEE80211_MAX_DATA_LEN },
 324         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 325         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 327         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 328         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 329         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 330         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 331         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 332         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 333         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 334         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 335                                       .len = IEEE80211_MAX_DATA_LEN },
 336         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 337         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 338         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 339                 .len = NL80211_HT_CAPABILITY_LEN
 340         },
 341         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 342         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 343         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 344         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 345         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 346         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 347         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 348         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 349         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 350         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 351         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 352         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 353         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 354         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 355         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 356         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 357         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 358                 .len = NL80211_VHT_CAPABILITY_LEN,
 359         },
 360         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 361         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 362                                   .len = IEEE80211_MAX_DATA_LEN },
 363         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 364         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 365         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 366         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 367         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 368         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 369         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 370         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 371         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 372         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 373         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 374         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 375         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 376         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 377                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 378         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 379         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 380         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 381         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 382         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 383         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 384         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 385         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 386         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 387         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 388         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 389         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 390         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 391         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 392         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 393         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 394         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 395         [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
 396         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 397                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 398         },
 399         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 400         [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
 401         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 402         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 403         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 404                                     .len = FILS_MAX_KEK_LEN },
 405         [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
 406         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 407         [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 408         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 409         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 410                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 411         },
 412         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 413 };
 414
 415 /* policy for the key attributes */
 416 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 417         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 418         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 419         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 420         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 421         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 422         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 423         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 424         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 425 };
 426
 427 /* policy for the key default flags */
 428 static const struct nla_policy
 429 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 430         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 431         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 432 };
 433
 434 #ifdef CONFIG_PM
 435 /* policy for WoWLAN attributes */
 436 static const struct nla_policy
 437 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 438         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 439         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 440         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 441         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 442         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 443         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 444         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 445         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 446         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 447         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 448 };
 449
 450 static const struct nla_policy
 451 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 452         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 453         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 454         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 455         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 456         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 457         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 458         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 459                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 460         },
 461         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 462                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 463         },
 464         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 465         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 466         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 467 };
 468 #endif /* CONFIG_PM */
 469
 470 /* policy for coalesce rule attributes */
 471 static const struct nla_policy
 472 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 473         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 474         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 475         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 476 };
 477
 478 /* policy for GTK rekey offload attributes */
 479 static const struct nla_policy
 480 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 481         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 482         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 483         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 484 };
 485
 486 static const struct nla_policy
 487 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 488         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 489                                                  .len = IEEE80211_MAX_SSID_LEN },
 490         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 491 };
 492
 493 static const struct nla_policy
 494 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 495         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 496         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 497 };
 498
 499 static const struct nla_policy
 500 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 501         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 502         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 503         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 504                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 505         },
 506 };
 507
 508 /* policy for NAN function attributes */
 509 static const struct nla_policy
 510 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 511         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 512         [NL80211_NAN_FUNC_SERVICE_ID] = { .type = NLA_BINARY,
 513                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 514         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 515         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 516         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 517         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 518         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 519         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 520         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 521         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 522         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 523                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 524         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 525         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 526         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 527         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 528         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 529 };
 530
 531 /* policy for Service Response Filter attributes */
 532 static const struct nla_policy
 533 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 534         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 535         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 536                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 537         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 538         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 539 };
 540
 541 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 542                                      struct netlink_callback *cb,
 543                                      struct cfg80211_registered_device **rdev,
 544                                      struct wireless_dev **wdev)
 545 {
 546         int err;
 547
 548         rtnl_lock();
 549
 550         if (!cb->args[0]) {
 551                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 552                                   genl_family_attrbuf(&nl80211_fam),
 553                                   nl80211_fam.maxattr, nl80211_policy);
 554                 if (err)
 555                         goto out_unlock;
 556
 557                 *wdev = __cfg80211_wdev_from_attrs(
 558                                         sock_net(skb->sk),
 559                                         genl_family_attrbuf(&nl80211_fam));
 560                 if (IS_ERR(*wdev)) {
 561                         err = PTR_ERR(*wdev);
 562                         goto out_unlock;
 563                 }
 564                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 565                 /* 0 is the first index - add 1 to parse only once */
 566                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 567                 cb->args[1] = (*wdev)->identifier;
 568         } else {
 569                 /* subtract the 1 again here */
 570                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 571                 struct wireless_dev *tmp;
 572
 573                 if (!wiphy) {
 574                         err = -ENODEV;
 575                         goto out_unlock;
 576                 }
 577                 *rdev = wiphy_to_rdev(wiphy);
 578                 *wdev = NULL;
 579
 580                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 581                         if (tmp->identifier == cb->args[1]) {
 582                                 *wdev = tmp;
 583                                 break;
 584                         }
 585                 }
 586
 587                 if (!*wdev) {
 588                         err = -ENODEV;
 589                         goto out_unlock;
 590                 }
 591         }
 592
 593         return 0;
 594  out_unlock:
 595         rtnl_unlock();
 596         return err;
 597 }
 598
 599 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 600 {
 601         rtnl_unlock();
 602 }
 603
 604 /* IE validation */
 605 static bool is_valid_ie_attr(const struct nlattr *attr)
 606 {
 607         const u8 *pos;
 608         int len;
 609
 610         if (!attr)
 611                 return true;
 612
 613         pos = nla_data(attr);
 614         len = nla_len(attr);
 615
 616         while (len) {
 617                 u8 elemlen;
 618
 619                 if (len < 2)
 620                         return false;
 621                 len -= 2;
 622
 623                 elemlen = pos[1];
 624                 if (elemlen > len)
 625                         return false;
 626
 627                 len -= elemlen;
 628                 pos += 2 + elemlen;
 629         }
 630
 631         return true;
 632 }
 633
 634 /* message building helper */
 635 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 636                                    int flags, u8 cmd)
 637 {
 638         /* since there is no private header just add the generic one */
 639         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 640 }
 641
 642 static int nl80211_msg_put_channel(struct sk_buff *msg,
 643                                    struct ieee80211_channel *chan,
 644                                    bool large)
 645 {
 646         /* Some channels must be completely excluded from the
 647          * list to protect old user-space tools from breaking
 648          */
 649         if (!large && chan->flags &
 650             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 651                 return 0;
 652
 653         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 654                         chan->center_freq))
 655                 goto nla_put_failure;
 656
 657         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 658             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 659                 goto nla_put_failure;
 660         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 661                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 662                         goto nla_put_failure;
 663                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 664                         goto nla_put_failure;
 665         }
 666         if (chan->flags & IEEE80211_CHAN_RADAR) {
 667                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 668                         goto nla_put_failure;
 669                 if (large) {
 670                         u32 time;
 671
 672                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 673
 674                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 675                                         chan->dfs_state))
 676                                 goto nla_put_failure;
 677                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 678                                         time))
 679                                 goto nla_put_failure;
 680                         if (nla_put_u32(msg,
 681                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 682                                         chan->dfs_cac_ms))
 683                                 goto nla_put_failure;
 684                 }
 685         }
 686
 687         if (large) {
 688                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 689                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 690                         goto nla_put_failure;
 691                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 692                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 693                         goto nla_put_failure;
 694                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 695                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 696                         goto nla_put_failure;
 697                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 698                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 699                         goto nla_put_failure;
 700                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 701                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 702                         goto nla_put_failure;
 703                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 704                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 705                         goto nla_put_failure;
 706                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 707                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 708                         goto nla_put_failure;
 709                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 710                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 711                         goto nla_put_failure;
 712         }
 713
 714         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 715                         DBM_TO_MBM(chan->max_power)))
 716                 goto nla_put_failure;
 717
 718         return 0;
 719
 720  nla_put_failure:
 721         return -ENOBUFS;
 722 }
 723
 724 /* netlink command implementations */
 725
 726 struct key_parse {
 727         struct key_params p;
 728         int idx;
 729         int type;
 730         bool def, defmgmt;
 731         bool def_uni, def_multi;
 732 };
 733
 734 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 735 {
 736         struct nlattr *tb[NL80211_KEY_MAX + 1];
 737         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 738                                    nl80211_key_policy);
 739         if (err)
 740                 return err;
 741
 742         k->def = !!tb[NL80211_KEY_DEFAULT];
 743         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 744
 745         if (k->def) {
 746                 k->def_uni = true;
 747                 k->def_multi = true;
 748         }
 749         if (k->defmgmt)
 750                 k->def_multi = true;
 751
 752         if (tb[NL80211_KEY_IDX])
 753                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 754
 755         if (tb[NL80211_KEY_DATA]) {
 756                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 757                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 758         }
 759
 760         if (tb[NL80211_KEY_SEQ]) {
 761                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 762                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 763         }
 764
 765         if (tb[NL80211_KEY_CIPHER])
 766                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 767
 768         if (tb[NL80211_KEY_TYPE]) {
 769                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 770                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 771                         return -EINVAL;
 772         }
 773
 774         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 775                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 776
 777                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 778                                        tb[NL80211_KEY_DEFAULT_TYPES],
 779                                        nl80211_key_default_policy);
 780                 if (err)
 781                         return err;
 782
 783                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 784                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 785         }
 786
 787         return 0;
 788 }
 789
 790 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 791 {
 792         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 793                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 794                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 795         }
 796
 797         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 798                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 799                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 800         }
 801
 802         if (info->attrs[NL80211_ATTR_KEY_IDX])
 803                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 804
 805         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 806                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 807
 808         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 809         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 810
 811         if (k->def) {
 812                 k->def_uni = true;
 813                 k->def_multi = true;
 814         }
 815         if (k->defmgmt)
 816                 k->def_multi = true;
 817
 818         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 819                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 820                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 821                         return -EINVAL;
 822         }
 823
 824         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 825                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 826                 int err = nla_parse_nested(
 827                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 828                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 829                                 nl80211_key_default_policy);
 830                 if (err)
 831                         return err;
 832
 833                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 834                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 835         }
 836
 837         return 0;
 838 }
 839
 840 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 841 {
 842         int err;
 843
 844         memset(k, 0, sizeof(*k));
 845         k->idx = -1;
 846         k->type = -1;
 847
 848         if (info->attrs[NL80211_ATTR_KEY])
 849                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 850         else
 851                 err = nl80211_parse_key_old(info, k);
 852
 853         if (err)
 854                 return err;
 855
 856         if (k->def && k->defmgmt)
 857                 return -EINVAL;
 858
 859         if (k->defmgmt) {
 860                 if (k->def_uni || !k->def_multi)
 861                         return -EINVAL;
 862         }
 863
 864         if (k->idx != -1) {
 865                 if (k->defmgmt) {
 866                         if (k->idx < 4 || k->idx > 5)
 867                                 return -EINVAL;
 868                 } else if (k->def) {
 869                         if (k->idx < 0 || k->idx > 3)
 870                                 return -EINVAL;
 871                 } else {
 872                         if (k->idx < 0 || k->idx > 5)
 873                                 return -EINVAL;
 874                 }
 875         }
 876
 877         return 0;
 878 }
 879
 880 static struct cfg80211_cached_keys *
 881 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 882                        struct nlattr *keys, bool *no_ht)
 883 {
 884         struct key_parse parse;
 885         struct nlattr *key;
 886         struct cfg80211_cached_keys *result;
 887         int rem, err, def = 0;
 888         bool have_key = false;
 889
 890         nla_for_each_nested(key, keys, rem) {
 891                 have_key = true;
 892                 break;
 893         }
 894
 895         if (!have_key)
 896                 return NULL;
 897
 898         result = kzalloc(sizeof(*result), GFP_KERNEL);
 899         if (!result)
 900                 return ERR_PTR(-ENOMEM);
 901
 902         result->def = -1;
 903
 904         nla_for_each_nested(key, keys, rem) {
 905                 memset(&parse, 0, sizeof(parse));
 906                 parse.idx = -1;
 907
 908                 err = nl80211_parse_key_new(key, &parse);
 909                 if (err)
 910                         goto error;
 911                 err = -EINVAL;
 912                 if (!parse.p.key)
 913                         goto error;
 914                 if (parse.idx < 0 || parse.idx > 3)
 915                         goto error;
 916                 if (parse.def) {
 917                         if (def)
 918                                 goto error;
 919                         def = 1;
 920                         result->def = parse.idx;
 921                         if (!parse.def_uni || !parse.def_multi)
 922                                 goto error;
 923                 } else if (parse.defmgmt)
 924                         goto error;
 925                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 926                                                      parse.idx, false, NULL);
 927                 if (err)
 928                         goto error;
 929                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
 930                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
 931                         err = -EINVAL;
 932                         goto error;
 933                 }
 934                 result->params[parse.idx].cipher = parse.p.cipher;
 935                 result->params[parse.idx].key_len = parse.p.key_len;
 936                 result->params[parse.idx].key = result->data[parse.idx];
 937                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 938
 939                 /* must be WEP key if we got here */
 940                 if (no_ht)
 941                         *no_ht = true;
 942         }
 943
 944         if (result->def < 0) {
 945                 err = -EINVAL;
 946                 goto error;
 947         }
 948
 949         return result;
 950  error:
 951         kfree(result);
 952         return ERR_PTR(err);
 953 }
 954
 955 static int nl80211_key_allowed(struct wireless_dev *wdev)
 956 {
 957         ASSERT_WDEV_LOCK(wdev);
 958
 959         switch (wdev->iftype) {
 960         case NL80211_IFTYPE_AP:
 961         case NL80211_IFTYPE_AP_VLAN:
 962         case NL80211_IFTYPE_P2P_GO:
 963         case NL80211_IFTYPE_MESH_POINT:
 964                 break;
 965         case NL80211_IFTYPE_ADHOC:
 966         case NL80211_IFTYPE_STATION:
 967         case NL80211_IFTYPE_P2P_CLIENT:
 968                 if (!wdev->current_bss)
 969                         return -ENOLINK;
 970                 break;
 971         case NL80211_IFTYPE_UNSPECIFIED:
 972         case NL80211_IFTYPE_OCB:
 973         case NL80211_IFTYPE_MONITOR:
 974         case NL80211_IFTYPE_NAN:
 975         case NL80211_IFTYPE_P2P_DEVICE:
 976         case NL80211_IFTYPE_WDS:
 977         case NUM_NL80211_IFTYPES:
 978                 return -EINVAL;
 979         }
 980
 981         return 0;
 982 }
 983
 984 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 985                                                         struct nlattr *tb)
 986 {
 987         struct ieee80211_channel *chan;
 988
 989         if (tb == NULL)
 990                 return NULL;
 991         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 992         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 993                 return NULL;
 994         return chan;
 995 }
 996
 997 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 998 {
 999         struct nlattr *nl_modes = nla_nest_start(msg, attr);
1000         int i;
1001
1002         if (!nl_modes)
1003                 goto nla_put_failure;
1004
1005         i = 0;
1006         while (ifmodes) {
1007                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1008                         goto nla_put_failure;
1009                 ifmodes >>= 1;
1010                 i++;
1011         }
1012
1013         nla_nest_end(msg, nl_modes);
1014         return 0;
1015
1016 nla_put_failure:
1017         return -ENOBUFS;
1018 }
1019
1020 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1021                                           struct sk_buff *msg,
1022                                           bool large)
1023 {
1024         struct nlattr *nl_combis;
1025         int i, j;
1026
1027         nl_combis = nla_nest_start(msg,
1028                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1029         if (!nl_combis)
1030                 goto nla_put_failure;
1031
1032         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1033                 const struct ieee80211_iface_combination *c;
1034                 struct nlattr *nl_combi, *nl_limits;
1035
1036                 c = &wiphy->iface_combinations[i];
1037
1038                 nl_combi = nla_nest_start(msg, i + 1);
1039                 if (!nl_combi)
1040                         goto nla_put_failure;
1041
1042                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1043                 if (!nl_limits)
1044                         goto nla_put_failure;
1045
1046                 for (j = 0; j < c->n_limits; j++) {
1047                         struct nlattr *nl_limit;
1048
1049                         nl_limit = nla_nest_start(msg, j + 1);
1050                         if (!nl_limit)
1051                                 goto nla_put_failure;
1052                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1053                                         c->limits[j].max))
1054                                 goto nla_put_failure;
1055                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1056                                                 c->limits[j].types))
1057                                 goto nla_put_failure;
1058                         nla_nest_end(msg, nl_limit);
1059                 }
1060
1061                 nla_nest_end(msg, nl_limits);
1062
1063                 if (c->beacon_int_infra_match &&
1064                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1065                         goto nla_put_failure;
1066                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1067                                 c->num_different_channels) ||
1068                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1069                                 c->max_interfaces))
1070                         goto nla_put_failure;
1071                 if (large &&
1072                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1073                                 c->radar_detect_widths) ||
1074                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1075                                 c->radar_detect_regions)))
1076                         goto nla_put_failure;
1077                 if (c->beacon_int_min_gcd &&
1078                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1079                                 c->beacon_int_min_gcd))
1080                         goto nla_put_failure;
1081
1082                 nla_nest_end(msg, nl_combi);
1083         }
1084
1085         nla_nest_end(msg, nl_combis);
1086
1087         return 0;
1088 nla_put_failure:
1089         return -ENOBUFS;
1090 }
1091
1092 #ifdef CONFIG_PM
1093 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1094                                         struct sk_buff *msg)
1095 {
1096         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1097         struct nlattr *nl_tcp;
1098
1099         if (!tcp)
1100                 return 0;
1101
1102         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1103         if (!nl_tcp)
1104                 return -ENOBUFS;
1105
1106         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1107                         tcp->data_payload_max))
1108                 return -ENOBUFS;
1109
1110         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1111                         tcp->data_payload_max))
1112                 return -ENOBUFS;
1113
1114         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1115                 return -ENOBUFS;
1116
1117         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1118                                 sizeof(*tcp->tok), tcp->tok))
1119                 return -ENOBUFS;
1120
1121         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1122                         tcp->data_interval_max))
1123                 return -ENOBUFS;
1124
1125         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1126                         tcp->wake_payload_max))
1127                 return -ENOBUFS;
1128
1129         nla_nest_end(msg, nl_tcp);
1130         return 0;
1131 }
1132
1133 static int nl80211_send_wowlan(struct sk_buff *msg,
1134                                struct cfg80211_registered_device *rdev,
1135                                bool large)
1136 {
1137         struct nlattr *nl_wowlan;
1138
1139         if (!rdev->wiphy.wowlan)
1140                 return 0;
1141
1142         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1143         if (!nl_wowlan)
1144                 return -ENOBUFS;
1145
1146         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1147              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1148             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1149              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1150             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1151              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1152             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1153              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1154             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1155              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1156             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1157              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1158             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1159              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1160             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1161              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1162                 return -ENOBUFS;
1163
1164         if (rdev->wiphy.wowlan->n_patterns) {
1165                 struct nl80211_pattern_support pat = {
1166                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1167                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1168                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1169                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1170                 };
1171
1172                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1173                             sizeof(pat), &pat))
1174                         return -ENOBUFS;
1175         }
1176
1177         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1178             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1179                         rdev->wiphy.wowlan->max_nd_match_sets))
1180                 return -ENOBUFS;
1181
1182         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1183                 return -ENOBUFS;
1184
1185         nla_nest_end(msg, nl_wowlan);
1186
1187         return 0;
1188 }
1189 #endif
1190
1191 static int nl80211_send_coalesce(struct sk_buff *msg,
1192                                  struct cfg80211_registered_device *rdev)
1193 {
1194         struct nl80211_coalesce_rule_support rule;
1195
1196         if (!rdev->wiphy.coalesce)
1197                 return 0;
1198
1199         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1200         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1201         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1202         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1203         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1204         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1205
1206         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1207                 return -ENOBUFS;
1208
1209         return 0;
1210 }
1211
1212 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1213                                       struct ieee80211_supported_band *sband)
1214 {
1215         struct nlattr *nl_rates, *nl_rate;
1216         struct ieee80211_rate *rate;
1217         int i;
1218
1219         /* add HT info */
1220         if (sband->ht_cap.ht_supported &&
1221             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1222                      sizeof(sband->ht_cap.mcs),
1223                      &sband->ht_cap.mcs) ||
1224              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1225                          sband->ht_cap.cap) ||
1226              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1227                         sband->ht_cap.ampdu_factor) ||
1228              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1229                         sband->ht_cap.ampdu_density)))
1230                 return -ENOBUFS;
1231
1232         /* add VHT info */
1233         if (sband->vht_cap.vht_supported &&
1234             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1235                      sizeof(sband->vht_cap.vht_mcs),
1236                      &sband->vht_cap.vht_mcs) ||
1237              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1238                          sband->vht_cap.cap)))
1239                 return -ENOBUFS;
1240
1241         /* add bitrates */
1242         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1243         if (!nl_rates)
1244                 return -ENOBUFS;
1245
1246         for (i = 0; i < sband->n_bitrates; i++) {
1247                 nl_rate = nla_nest_start(msg, i);
1248                 if (!nl_rate)
1249                         return -ENOBUFS;
1250
1251                 rate = &sband->bitrates[i];
1252                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1253                                 rate->bitrate))
1254                         return -ENOBUFS;
1255                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1256                     nla_put_flag(msg,
1257                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1258                         return -ENOBUFS;
1259
1260                 nla_nest_end(msg, nl_rate);
1261         }
1262
1263         nla_nest_end(msg, nl_rates);
1264
1265         return 0;
1266 }
1267
1268 static int
1269 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1270                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1271 {
1272         u16 stypes;
1273         struct nlattr *nl_ftypes, *nl_ifs;
1274         enum nl80211_iftype ift;
1275         int i;
1276
1277         if (!mgmt_stypes)
1278                 return 0;
1279
1280         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1281         if (!nl_ifs)
1282                 return -ENOBUFS;
1283
1284         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1285                 nl_ftypes = nla_nest_start(msg, ift);
1286                 if (!nl_ftypes)
1287                         return -ENOBUFS;
1288                 i = 0;
1289                 stypes = mgmt_stypes[ift].tx;
1290                 while (stypes) {
1291                         if ((stypes & 1) &&
1292                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1293                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1294                                 return -ENOBUFS;
1295                         stypes >>= 1;
1296                         i++;
1297                 }
1298                 nla_nest_end(msg, nl_ftypes);
1299         }
1300
1301         nla_nest_end(msg, nl_ifs);
1302
1303         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1304         if (!nl_ifs)
1305                 return -ENOBUFS;
1306
1307         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1308                 nl_ftypes = nla_nest_start(msg, ift);
1309                 if (!nl_ftypes)
1310                         return -ENOBUFS;
1311                 i = 0;
1312                 stypes = mgmt_stypes[ift].rx;
1313                 while (stypes) {
1314                         if ((stypes & 1) &&
1315                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1316                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1317                                 return -ENOBUFS;
1318                         stypes >>= 1;
1319                         i++;
1320                 }
1321                 nla_nest_end(msg, nl_ftypes);
1322         }
1323         nla_nest_end(msg, nl_ifs);
1324
1325         return 0;
1326 }
1327
1328 #define CMD(op, n)                                                      \
1329          do {                                                           \
1330                 if (rdev->ops->op) {                                    \
1331                         i++;                                            \
1332                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1333                                 goto nla_put_failure;                   \
1334                 }                                                       \
1335         } while (0)
1336
1337 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1338                                         struct sk_buff *msg)
1339 {
1340         int i = 0;
1341
1342         /*
1343          * do *NOT* add anything into this function, new things need to be
1344          * advertised only to new versions of userspace that can deal with
1345          * the split (and they can't possibly care about new features...
1346          */
1347         CMD(add_virtual_intf, NEW_INTERFACE);
1348         CMD(change_virtual_intf, SET_INTERFACE);
1349         CMD(add_key, NEW_KEY);
1350         CMD(start_ap, START_AP);
1351         CMD(add_station, NEW_STATION);
1352         CMD(add_mpath, NEW_MPATH);
1353         CMD(update_mesh_config, SET_MESH_CONFIG);
1354         CMD(change_bss, SET_BSS);
1355         CMD(auth, AUTHENTICATE);
1356         CMD(assoc, ASSOCIATE);
1357         CMD(deauth, DEAUTHENTICATE);
1358         CMD(disassoc, DISASSOCIATE);
1359         CMD(join_ibss, JOIN_IBSS);
1360         CMD(join_mesh, JOIN_MESH);
1361         CMD(set_pmksa, SET_PMKSA);
1362         CMD(del_pmksa, DEL_PMKSA);
1363         CMD(flush_pmksa, FLUSH_PMKSA);
1364         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1365                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1366         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1367         CMD(mgmt_tx, FRAME);
1368         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1369         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1370                 i++;
1371                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1372                         goto nla_put_failure;
1373         }
1374         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1375             rdev->ops->join_mesh) {
1376                 i++;
1377                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1378                         goto nla_put_failure;
1379         }
1380         CMD(set_wds_peer, SET_WDS_PEER);
1381         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1382                 CMD(tdls_mgmt, TDLS_MGMT);
1383                 CMD(tdls_oper, TDLS_OPER);
1384         }
1385         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1386                 CMD(sched_scan_start, START_SCHED_SCAN);
1387         CMD(probe_client, PROBE_CLIENT);
1388         CMD(set_noack_map, SET_NOACK_MAP);
1389         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1390                 i++;
1391                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1392                         goto nla_put_failure;
1393         }
1394         CMD(start_p2p_device, START_P2P_DEVICE);
1395         CMD(set_mcast_rate, SET_MCAST_RATE);
1396 #ifdef CONFIG_NL80211_TESTMODE
1397         CMD(testmode_cmd, TESTMODE);
1398 #endif
1399
1400         if (rdev->ops->connect || rdev->ops->auth) {
1401                 i++;
1402                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1403                         goto nla_put_failure;
1404         }
1405
1406         if (rdev->ops->disconnect || rdev->ops->deauth) {
1407                 i++;
1408                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1409                         goto nla_put_failure;
1410         }
1411
1412         return i;
1413  nla_put_failure:
1414         return -ENOBUFS;
1415 }
1416
1417 struct nl80211_dump_wiphy_state {
1418         s64 filter_wiphy;
1419         long start;
1420         long split_start, band_start, chan_start, capa_start;
1421         bool split;
1422 };
1423
1424 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1425                               enum nl80211_commands cmd,
1426                               struct sk_buff *msg, u32 portid, u32 seq,
1427                               int flags, struct nl80211_dump_wiphy_state *state)
1428 {
1429         void *hdr;
1430         struct nlattr *nl_bands, *nl_band;
1431         struct nlattr *nl_freqs, *nl_freq;
1432         struct nlattr *nl_cmds;
1433         enum nl80211_band band;
1434         struct ieee80211_channel *chan;
1435         int i;
1436         const struct ieee80211_txrx_stypes *mgmt_stypes =
1437                                 rdev->wiphy.mgmt_stypes;
1438         u32 features;
1439
1440         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1441         if (!hdr)
1442                 return -ENOBUFS;
1443
1444         if (WARN_ON(!state))
1445                 return -EINVAL;
1446
1447         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1448             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1449                            wiphy_name(&rdev->wiphy)) ||
1450             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1451                         cfg80211_rdev_list_generation))
1452                 goto nla_put_failure;
1453
1454         if (cmd != NL80211_CMD_NEW_WIPHY)
1455                 goto finish;
1456
1457         switch (state->split_start) {
1458         case 0:
1459                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1460                                rdev->wiphy.retry_short) ||
1461                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1462                                rdev->wiphy.retry_long) ||
1463                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1464                                 rdev->wiphy.frag_threshold) ||
1465                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1466                                 rdev->wiphy.rts_threshold) ||
1467                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1468                                rdev->wiphy.coverage_class) ||
1469                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1470                                rdev->wiphy.max_scan_ssids) ||
1471                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1472                                rdev->wiphy.max_sched_scan_ssids) ||
1473                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1474                                 rdev->wiphy.max_scan_ie_len) ||
1475                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1476                                 rdev->wiphy.max_sched_scan_ie_len) ||
1477                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1478                                rdev->wiphy.max_match_sets) ||
1479                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1480                                 rdev->wiphy.max_sched_scan_plans) ||
1481                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1482                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1483                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1484                                 rdev->wiphy.max_sched_scan_plan_iterations))
1485                         goto nla_put_failure;
1486
1487                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1488                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1489                         goto nla_put_failure;
1490                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1491                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1492                         goto nla_put_failure;
1493                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1494                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1495                         goto nla_put_failure;
1496                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1497                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1498                         goto nla_put_failure;
1499                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1500                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1501                         goto nla_put_failure;
1502                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1503                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1504                         goto nla_put_failure;
1505                 state->split_start++;
1506                 if (state->split)
1507                         break;
1508         case 1:
1509                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1510                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1511                             rdev->wiphy.cipher_suites))
1512                         goto nla_put_failure;
1513
1514                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1515                                rdev->wiphy.max_num_pmkids))
1516                         goto nla_put_failure;
1517
1518                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1519                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1520                         goto nla_put_failure;
1521
1522                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1523                                 rdev->wiphy.available_antennas_tx) ||
1524                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1525                                 rdev->wiphy.available_antennas_rx))
1526                         goto nla_put_failure;
1527
1528                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1529                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1530                                 rdev->wiphy.probe_resp_offload))
1531                         goto nla_put_failure;
1532
1533                 if ((rdev->wiphy.available_antennas_tx ||
1534                      rdev->wiphy.available_antennas_rx) &&
1535                     rdev->ops->get_antenna) {
1536                         u32 tx_ant = 0, rx_ant = 0;
1537                         int res;
1538
1539                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1540                         if (!res) {
1541                                 if (nla_put_u32(msg,
1542                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1543                                                 tx_ant) ||
1544                                     nla_put_u32(msg,
1545                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1546                                                 rx_ant))
1547                                         goto nla_put_failure;
1548                         }
1549                 }
1550
1551                 state->split_start++;
1552                 if (state->split)
1553                         break;
1554         case 2:
1555                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1556                                         rdev->wiphy.interface_modes))
1557                                 goto nla_put_failure;
1558                 state->split_start++;
1559                 if (state->split)
1560                         break;
1561         case 3:
1562                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1563                 if (!nl_bands)
1564                         goto nla_put_failure;
1565
1566                 for (band = state->band_start;
1567                      band < NUM_NL80211_BANDS; band++) {
1568                         struct ieee80211_supported_band *sband;
1569
1570                         sband = rdev->wiphy.bands[band];
1571
1572                         if (!sband)
1573                                 continue;
1574
1575                         nl_band = nla_nest_start(msg, band);
1576                         if (!nl_band)
1577                                 goto nla_put_failure;
1578
1579                         switch (state->chan_start) {
1580                         case 0:
1581                                 if (nl80211_send_band_rateinfo(msg, sband))
1582                                         goto nla_put_failure;
1583                                 state->chan_start++;
1584                                 if (state->split)
1585                                         break;
1586                         default:
1587                                 /* add frequencies */
1588                                 nl_freqs = nla_nest_start(
1589                                         msg, NL80211_BAND_ATTR_FREQS);
1590                                 if (!nl_freqs)
1591                                         goto nla_put_failure;
1592
1593                                 for (i = state->chan_start - 1;
1594                                      i < sband->n_channels;
1595                                      i++) {
1596                                         nl_freq = nla_nest_start(msg, i);
1597                                         if (!nl_freq)
1598                                                 goto nla_put_failure;
1599
1600                                         chan = &sband->channels[i];
1601
1602                                         if (nl80211_msg_put_channel(
1603                                                         msg, chan,
1604                                                         state->split))
1605                                                 goto nla_put_failure;
1606
1607                                         nla_nest_end(msg, nl_freq);
1608                                         if (state->split)
1609                                                 break;
1610                                 }
1611                                 if (i < sband->n_channels)
1612                                         state->chan_start = i + 2;
1613                                 else
1614                                         state->chan_start = 0;
1615                                 nla_nest_end(msg, nl_freqs);
1616                         }
1617
1618                         nla_nest_end(msg, nl_band);
1619
1620                         if (state->split) {
1621                                 /* start again here */
1622                                 if (state->chan_start)
1623                                         band--;
1624                                 break;
1625                         }
1626                 }
1627                 nla_nest_end(msg, nl_bands);
1628
1629                 if (band < NUM_NL80211_BANDS)
1630                         state->band_start = band + 1;
1631                 else
1632                         state->band_start = 0;
1633
1634                 /* if bands & channels are done, continue outside */
1635                 if (state->band_start == 0 && state->chan_start == 0)
1636                         state->split_start++;
1637                 if (state->split)
1638                         break;
1639         case 4:
1640                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1641                 if (!nl_cmds)
1642                         goto nla_put_failure;
1643
1644                 i = nl80211_add_commands_unsplit(rdev, msg);
1645                 if (i < 0)
1646                         goto nla_put_failure;
1647                 if (state->split) {
1648                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1649                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1650                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1651                                 CMD(channel_switch, CHANNEL_SWITCH);
1652                         CMD(set_qos_map, SET_QOS_MAP);
1653                         if (rdev->wiphy.features &
1654                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1655                                 CMD(add_tx_ts, ADD_TX_TS);
1656                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1657                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1658                 }
1659 #undef CMD
1660
1661                 nla_nest_end(msg, nl_cmds);
1662                 state->split_start++;
1663                 if (state->split)
1664                         break;
1665         case 5:
1666                 if (rdev->ops->remain_on_channel &&
1667                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1668                     nla_put_u32(msg,
1669                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1670                                 rdev->wiphy.max_remain_on_channel_duration))
1671                         goto nla_put_failure;
1672
1673                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1674                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1675                         goto nla_put_failure;
1676
1677                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1678                         goto nla_put_failure;
1679                 state->split_start++;
1680                 if (state->split)
1681                         break;
1682         case 6:
1683 #ifdef CONFIG_PM
1684                 if (nl80211_send_wowlan(msg, rdev, state->split))
1685                         goto nla_put_failure;
1686                 state->split_start++;
1687                 if (state->split)
1688                         break;
1689 #else
1690                 state->split_start++;
1691 #endif
1692         case 7:
1693                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1694                                         rdev->wiphy.software_iftypes))
1695                         goto nla_put_failure;
1696
1697                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1698                                                    state->split))
1699                         goto nla_put_failure;
1700
1701                 state->split_start++;
1702                 if (state->split)
1703                         break;
1704         case 8:
1705                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1706                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1707                                 rdev->wiphy.ap_sme_capa))
1708                         goto nla_put_failure;
1709
1710                 features = rdev->wiphy.features;
1711                 /*
1712                  * We can only add the per-channel limit information if the
1713                  * dump is split, otherwise it makes it too big. Therefore
1714                  * only advertise it in that case.
1715                  */
1716                 if (state->split)
1717                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1718                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1719                         goto nla_put_failure;
1720
1721                 if (rdev->wiphy.ht_capa_mod_mask &&
1722                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1723                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1724                             rdev->wiphy.ht_capa_mod_mask))
1725                         goto nla_put_failure;
1726
1727                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1728                     rdev->wiphy.max_acl_mac_addrs &&
1729                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1730                                 rdev->wiphy.max_acl_mac_addrs))
1731                         goto nla_put_failure;
1732
1733                 /*
1734                  * Any information below this point is only available to
1735                  * applications that can deal with it being split. This
1736                  * helps ensure that newly added capabilities don't break
1737                  * older tools by overrunning their buffers.
1738                  *
1739                  * We still increment split_start so that in the split
1740                  * case we'll continue with more data in the next round,
1741                  * but break unconditionally so unsplit data stops here.
1742                  */
1743                 state->split_start++;
1744                 break;
1745         case 9:
1746                 if (rdev->wiphy.extended_capabilities &&
1747                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1748                              rdev->wiphy.extended_capabilities_len,
1749                              rdev->wiphy.extended_capabilities) ||
1750                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1751                              rdev->wiphy.extended_capabilities_len,
1752                              rdev->wiphy.extended_capabilities_mask)))
1753                         goto nla_put_failure;
1754
1755                 if (rdev->wiphy.vht_capa_mod_mask &&
1756                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1757                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1758                             rdev->wiphy.vht_capa_mod_mask))
1759                         goto nla_put_failure;
1760
1761                 state->split_start++;
1762                 break;
1763         case 10:
1764                 if (nl80211_send_coalesce(msg, rdev))
1765                         goto nla_put_failure;
1766
1767                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1768                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1769                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1770                         goto nla_put_failure;
1771
1772                 if (rdev->wiphy.max_ap_assoc_sta &&
1773                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1774                                 rdev->wiphy.max_ap_assoc_sta))
1775                         goto nla_put_failure;
1776
1777                 state->split_start++;
1778                 break;
1779         case 11:
1780                 if (rdev->wiphy.n_vendor_commands) {
1781                         const struct nl80211_vendor_cmd_info *info;
1782                         struct nlattr *nested;
1783
1784                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1785                         if (!nested)
1786                                 goto nla_put_failure;
1787
1788                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1789                                 info = &rdev->wiphy.vendor_commands[i].info;
1790                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1791                                         goto nla_put_failure;
1792                         }
1793                         nla_nest_end(msg, nested);
1794                 }
1795
1796                 if (rdev->wiphy.n_vendor_events) {
1797                         const struct nl80211_vendor_cmd_info *info;
1798                         struct nlattr *nested;
1799
1800                         nested = nla_nest_start(msg,
1801                                                 NL80211_ATTR_VENDOR_EVENTS);
1802                         if (!nested)
1803                                 goto nla_put_failure;
1804
1805                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1806                                 info = &rdev->wiphy.vendor_events[i];
1807                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1808                                         goto nla_put_failure;
1809                         }
1810                         nla_nest_end(msg, nested);
1811                 }
1812                 state->split_start++;
1813                 break;
1814         case 12:
1815                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1816                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1817                                rdev->wiphy.max_num_csa_counters))
1818                         goto nla_put_failure;
1819
1820                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1821                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1822                         goto nla_put_failure;
1823
1824                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1825                             sizeof(rdev->wiphy.ext_features),
1826                             rdev->wiphy.ext_features))
1827                         goto nla_put_failure;
1828
1829                 if (rdev->wiphy.bss_select_support) {
1830                         struct nlattr *nested;
1831                         u32 bss_select_support = rdev->wiphy.bss_select_support;
1832
1833                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1834                         if (!nested)
1835                                 goto nla_put_failure;
1836
1837                         i = 0;
1838                         while (bss_select_support) {
1839                                 if ((bss_select_support & 1) &&
1840                                     nla_put_flag(msg, i))
1841                                         goto nla_put_failure;
1842                                 i++;
1843                                 bss_select_support >>= 1;
1844                         }
1845                         nla_nest_end(msg, nested);
1846                 }
1847
1848                 state->split_start++;
1849                 break;
1850         case 13:
1851                 if (rdev->wiphy.num_iftype_ext_capab &&
1852                     rdev->wiphy.iftype_ext_capab) {
1853                         struct nlattr *nested_ext_capab, *nested;
1854
1855                         nested = nla_nest_start(msg,
1856                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
1857                         if (!nested)
1858                                 goto nla_put_failure;
1859
1860                         for (i = state->capa_start;
1861                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
1862                                 const struct wiphy_iftype_ext_capab *capab;
1863
1864                                 capab = &rdev->wiphy.iftype_ext_capab[i];
1865
1866                                 nested_ext_capab = nla_nest_start(msg, i);
1867                                 if (!nested_ext_capab ||
1868                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1869                                                 capab->iftype) ||
1870                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
1871                                             capab->extended_capabilities_len,
1872                                             capab->extended_capabilities) ||
1873                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1874                                             capab->extended_capabilities_len,
1875                                             capab->extended_capabilities_mask))
1876                                         goto nla_put_failure;
1877
1878                                 nla_nest_end(msg, nested_ext_capab);
1879                                 if (state->split)
1880                                         break;
1881                         }
1882                         nla_nest_end(msg, nested);
1883                         if (i < rdev->wiphy.num_iftype_ext_capab) {
1884                                 state->capa_start = i + 1;
1885                                 break;
1886                         }
1887                 }
1888
1889                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
1890                                 rdev->wiphy.nan_supported_bands))
1891                         goto nla_put_failure;
1892
1893                 /* done */
1894                 state->split_start = 0;
1895                 break;
1896         }
1897  finish:
1898         genlmsg_end(msg, hdr);
1899         return 0;
1900
1901  nla_put_failure:
1902         genlmsg_cancel(msg, hdr);
1903         return -EMSGSIZE;
1904 }
1905
1906 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1907                                     struct netlink_callback *cb,
1908                                     struct nl80211_dump_wiphy_state *state)
1909 {
1910         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
1911         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1912                               tb, nl80211_fam.maxattr, nl80211_policy);
1913         /* ignore parse errors for backward compatibility */
1914         if (ret)
1915                 return 0;
1916
1917         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1918         if (tb[NL80211_ATTR_WIPHY])
1919                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1920         if (tb[NL80211_ATTR_WDEV])
1921                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1922         if (tb[NL80211_ATTR_IFINDEX]) {
1923                 struct net_device *netdev;
1924                 struct cfg80211_registered_device *rdev;
1925                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1926
1927                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1928                 if (!netdev)
1929                         return -ENODEV;
1930                 if (netdev->ieee80211_ptr) {
1931                         rdev = wiphy_to_rdev(
1932                                 netdev->ieee80211_ptr->wiphy);
1933                         state->filter_wiphy = rdev->wiphy_idx;
1934                 }
1935         }
1936
1937         return 0;
1938 }
1939
1940 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1941 {
1942         int idx = 0, ret;
1943         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1944         struct cfg80211_registered_device *rdev;
1945
1946         rtnl_lock();
1947         if (!state) {
1948                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1949                 if (!state) {
1950                         rtnl_unlock();
1951                         return -ENOMEM;
1952                 }
1953                 state->filter_wiphy = -1;
1954                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1955                 if (ret) {
1956                         kfree(state);
1957                         rtnl_unlock();
1958                         return ret;
1959                 }
1960                 cb->args[0] = (long)state;
1961         }
1962
1963         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1964                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1965                         continue;
1966                 if (++idx <= state->start)
1967                         continue;
1968                 if (state->filter_wiphy != -1 &&
1969                     state->filter_wiphy != rdev->wiphy_idx)
1970                         continue;
1971                 /* attempt to fit multiple wiphy data chunks into the skb */
1972                 do {
1973                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1974                                                  skb,
1975                                                  NETLINK_CB(cb->skb).portid,
1976                                                  cb->nlh->nlmsg_seq,
1977                                                  NLM_F_MULTI, state);
1978                         if (ret < 0) {
1979                                 /*
1980                                  * If sending the wiphy data didn't fit (ENOBUFS
1981                                  * or EMSGSIZE returned), this SKB is still
1982                                  * empty (so it's not too big because another
1983                                  * wiphy dataset is already in the skb) and
1984                                  * we've not tried to adjust the dump allocation
1985                                  * yet ... then adjust the alloc size to be
1986                                  * bigger, and return 1 but with the empty skb.
1987                                  * This results in an empty message being RX'ed
1988                                  * in userspace, but that is ignored.
1989                                  *
1990                                  * We can then retry with the larger buffer.
1991                                  */
1992                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1993                                     !skb->len && !state->split &&
1994                                     cb->min_dump_alloc < 4096) {
1995                                         cb->min_dump_alloc = 4096;
1996                                         state->split_start = 0;
1997                                         rtnl_unlock();
1998                                         return 1;
1999                                 }
2000                                 idx--;
2001                                 break;
2002                         }
2003                 } while (state->split_start > 0);
2004                 break;
2005         }
2006         rtnl_unlock();
2007
2008         state->start = idx;
2009
2010         return skb->len;
2011 }
2012
2013 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2014 {
2015         kfree((void *)cb->args[0]);
2016         return 0;
2017 }
2018
2019 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2020 {
2021         struct sk_buff *msg;
2022         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2023         struct nl80211_dump_wiphy_state state = {};
2024
2025         msg = nlmsg_new(4096, GFP_KERNEL);
2026         if (!msg)
2027                 return -ENOMEM;
2028
2029         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2030                                info->snd_portid, info->snd_seq, 0,
2031                                &state) < 0) {
2032                 nlmsg_free(msg);
2033                 return -ENOBUFS;
2034         }
2035
2036         return genlmsg_reply(msg, info);
2037 }
2038
2039 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2040         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2041         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2042         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2043         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2044         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2045 };
2046
2047 static int parse_txq_params(struct nlattr *tb[],
2048                             struct ieee80211_txq_params *txq_params)
2049 {
2050         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2051             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2052             !tb[NL80211_TXQ_ATTR_AIFS])
2053                 return -EINVAL;
2054
2055         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2056         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2057         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2058         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2059         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2060
2061         if (txq_params->ac >= NL80211_NUM_ACS)
2062                 return -EINVAL;
2063
2064         return 0;
2065 }
2066
2067 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2068 {
2069         /*
2070          * You can only set the channel explicitly for WDS interfaces,
2071          * all others have their channel managed via their respective
2072          * "establish a connection" command (connect, join, ...)
2073          *
2074          * For AP/GO and mesh mode, the channel can be set with the
2075          * channel userspace API, but is only stored and passed to the
2076          * low-level driver when the AP starts or the mesh is joined.
2077          * This is for backward compatibility, userspace can also give
2078          * the channel in the start-ap or join-mesh commands instead.
2079          *
2080          * Monitors are special as they are normally slaved to
2081          * whatever else is going on, so they have their own special
2082          * operation to set the monitor channel if possible.
2083          */
2084         return !wdev ||
2085                 wdev->iftype == NL80211_IFTYPE_AP ||
2086                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2087                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2088                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2089 }
2090
2091 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2092                                  struct genl_info *info,
2093                                  struct cfg80211_chan_def *chandef)
2094 {
2095         u32 control_freq;
2096
2097         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2098                 return -EINVAL;
2099
2100         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2101
2102         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2103         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2104         chandef->center_freq1 = control_freq;
2105         chandef->center_freq2 = 0;
2106
2107         /* Primary channel not allowed */
2108         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2109                 return -EINVAL;
2110
2111         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2112                 enum nl80211_channel_type chantype;
2113
2114                 chantype = nla_get_u32(
2115                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2116
2117                 switch (chantype) {
2118                 case NL80211_CHAN_NO_HT:
2119                 case NL80211_CHAN_HT20:
2120                 case NL80211_CHAN_HT40PLUS:
2121                 case NL80211_CHAN_HT40MINUS:
2122                         cfg80211_chandef_create(chandef, chandef->chan,
2123                                                 chantype);
2124                         break;
2125                 default:
2126                         return -EINVAL;
2127                 }
2128         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2129                 chandef->width =
2130                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2131                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2132                         chandef->center_freq1 =
2133                                 nla_get_u32(
2134                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2135                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2136                         chandef->center_freq2 =
2137                                 nla_get_u32(
2138                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2139         }
2140
2141         if (!cfg80211_chandef_valid(chandef))
2142                 return -EINVAL;
2143
2144         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2145                                      IEEE80211_CHAN_DISABLED))
2146                 return -EINVAL;
2147
2148         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2149              chandef->width == NL80211_CHAN_WIDTH_10) &&
2150             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2151                 return -EINVAL;
2152
2153         return 0;
2154 }
2155
2156 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2157                                  struct net_device *dev,
2158                                  struct genl_info *info)
2159 {
2160         struct cfg80211_chan_def chandef;
2161         int result;
2162         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2163         struct wireless_dev *wdev = NULL;
2164
2165         if (dev)
2166                 wdev = dev->ieee80211_ptr;
2167         if (!nl80211_can_set_dev_channel(wdev))
2168                 return -EOPNOTSUPP;
2169         if (wdev)
2170                 iftype = wdev->iftype;
2171
2172         result = nl80211_parse_chandef(rdev, info, &chandef);
2173         if (result)
2174                 return result;
2175
2176         switch (iftype) {
2177         case NL80211_IFTYPE_AP:
2178         case NL80211_IFTYPE_P2P_GO:
2179                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2180                                                    iftype)) {
2181                         result = -EINVAL;
2182                         break;
2183                 }
2184                 if (wdev->beacon_interval) {
2185                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2186                             !(rdev->wiphy.features &
2187                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2188                                 result = -EBUSY;
2189                                 break;
2190                         }
2191
2192                         /* Only allow dynamic channel width changes */
2193                         if (chandef.chan != wdev->preset_chandef.chan) {
2194                                 result = -EBUSY;
2195                                 break;
2196                         }
2197                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2198                         if (result)
2199                                 break;
2200                 }
2201                 wdev->preset_chandef = chandef;
2202                 result = 0;
2203                 break;
2204         case NL80211_IFTYPE_MESH_POINT:
2205                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2206                 break;
2207         case NL80211_IFTYPE_MONITOR:
2208                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2209                 break;
2210         default:
2211                 result = -EINVAL;
2212         }
2213
2214         return result;
2215 }
2216
2217 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2218 {
2219         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2220         struct net_device *netdev = info->user_ptr[1];
2221
2222         return __nl80211_set_channel(rdev, netdev, info);
2223 }
2224
2225 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2226 {
2227         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2228         struct net_device *dev = info->user_ptr[1];
2229         struct wireless_dev *wdev = dev->ieee80211_ptr;
2230         const u8 *bssid;
2231
2232         if (!info->attrs[NL80211_ATTR_MAC])
2233                 return -EINVAL;
2234
2235         if (netif_running(dev))
2236                 return -EBUSY;
2237
2238         if (!rdev->ops->set_wds_peer)
2239                 return -EOPNOTSUPP;
2240
2241         if (wdev->iftype != NL80211_IFTYPE_WDS)
2242                 return -EOPNOTSUPP;
2243
2244         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2245         return rdev_set_wds_peer(rdev, dev, bssid);
2246 }
2247
2248 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2249 {
2250         struct cfg80211_registered_device *rdev;
2251         struct net_device *netdev = NULL;
2252         struct wireless_dev *wdev;
2253         int result = 0, rem_txq_params = 0;
2254         struct nlattr *nl_txq_params;
2255         u32 changed;
2256         u8 retry_short = 0, retry_long = 0;
2257         u32 frag_threshold = 0, rts_threshold = 0;
2258         u8 coverage_class = 0;
2259
2260         ASSERT_RTNL();
2261
2262         /*
2263          * Try to find the wiphy and netdev. Normally this
2264          * function shouldn't need the netdev, but this is
2265          * done for backward compatibility -- previously
2266          * setting the channel was done per wiphy, but now
2267          * it is per netdev. Previous userland like hostapd
2268          * also passed a netdev to set_wiphy, so that it is
2269          * possible to let that go to the right netdev!
2270          */
2271
2272         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2273                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2274
2275                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2276                 if (netdev && netdev->ieee80211_ptr)
2277                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2278                 else
2279                         netdev = NULL;
2280         }
2281
2282         if (!netdev) {
2283                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2284                                                   info->attrs);
2285                 if (IS_ERR(rdev))
2286                         return PTR_ERR(rdev);
2287                 wdev = NULL;
2288                 netdev = NULL;
2289                 result = 0;
2290         } else
2291                 wdev = netdev->ieee80211_ptr;
2292
2293         /*
2294          * end workaround code, by now the rdev is available
2295          * and locked, and wdev may or may not be NULL.
2296          */
2297
2298         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2299                 result = cfg80211_dev_rename(
2300                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2301
2302         if (result)
2303                 return result;
2304
2305         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2306                 struct ieee80211_txq_params txq_params;
2307                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2308
2309                 if (!rdev->ops->set_txq_params)
2310                         return -EOPNOTSUPP;
2311
2312                 if (!netdev)
2313                         return -EINVAL;
2314
2315                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2316                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2317                         return -EINVAL;
2318
2319                 if (!netif_running(netdev))
2320                         return -ENETDOWN;
2321
2322                 nla_for_each_nested(nl_txq_params,
2323                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2324                                     rem_txq_params) {
2325                         result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2326                                                   nl_txq_params,
2327                                                   txq_params_policy);
2328                         if (result)
2329                                 return result;
2330                         result = parse_txq_params(tb, &txq_params);
2331                         if (result)
2332                                 return result;
2333
2334                         result = rdev_set_txq_params(rdev, netdev,
2335                                                      &txq_params);
2336                         if (result)
2337                                 return result;
2338                 }
2339         }
2340
2341         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2342                 result = __nl80211_set_channel(
2343                         rdev,
2344                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2345                         info);
2346                 if (result)
2347                         return result;
2348         }
2349
2350         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2351                 struct wireless_dev *txp_wdev = wdev;
2352                 enum nl80211_tx_power_setting type;
2353                 int idx, mbm = 0;
2354
2355                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2356                         txp_wdev = NULL;
2357
2358                 if (!rdev->ops->set_tx_power)
2359                         return -EOPNOTSUPP;
2360
2361                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2362                 type = nla_get_u32(info->attrs[idx]);
2363
2364                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2365                     (type != NL80211_TX_POWER_AUTOMATIC))
2366                         return -EINVAL;
2367
2368                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2369                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2370                         mbm = nla_get_u32(info->attrs[idx]);
2371                 }
2372
2373                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2374                 if (result)
2375                         return result;
2376         }
2377
2378         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2379             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2380                 u32 tx_ant, rx_ant;
2381
2382                 if ((!rdev->wiphy.available_antennas_tx &&
2383                      !rdev->wiphy.available_antennas_rx) ||
2384                     !rdev->ops->set_antenna)
2385                         return -EOPNOTSUPP;
2386
2387                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2388                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2389
2390                 /* reject antenna configurations which don't match the
2391                  * available antenna masks, except for the "all" mask */
2392                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2393                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2394                         return -EINVAL;
2395
2396                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2397                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2398
2399                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2400                 if (result)
2401                         return result;
2402         }
2403
2404         changed = 0;
2405
2406         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2407                 retry_short = nla_get_u8(
2408                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2409                 if (retry_short == 0)
2410                         return -EINVAL;
2411
2412                 changed |= WIPHY_PARAM_RETRY_SHORT;
2413         }
2414
2415         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2416                 retry_long = nla_get_u8(
2417                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2418                 if (retry_long == 0)
2419                         return -EINVAL;
2420
2421                 changed |= WIPHY_PARAM_RETRY_LONG;
2422         }
2423
2424         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2425                 frag_threshold = nla_get_u32(
2426                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2427                 if (frag_threshold < 256)
2428                         return -EINVAL;
2429
2430                 if (frag_threshold != (u32) -1) {
2431                         /*
2432                          * Fragments (apart from the last one) are required to
2433                          * have even length. Make the fragmentation code
2434                          * simpler by stripping LSB should someone try to use
2435                          * odd threshold value.
2436                          */
2437                         frag_threshold &= ~0x1;
2438                 }
2439                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2440         }
2441
2442         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2443                 rts_threshold = nla_get_u32(
2444                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2445                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2446         }
2447
2448         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2449                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2450                         return -EINVAL;
2451
2452                 coverage_class = nla_get_u8(
2453                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2454                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2455         }
2456
2457         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2458                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2459                         return -EOPNOTSUPP;
2460
2461                 changed |= WIPHY_PARAM_DYN_ACK;
2462         }
2463
2464         if (changed) {
2465                 u8 old_retry_short, old_retry_long;
2466                 u32 old_frag_threshold, old_rts_threshold;
2467                 u8 old_coverage_class;
2468
2469                 if (!rdev->ops->set_wiphy_params)
2470                         return -EOPNOTSUPP;
2471
2472                 old_retry_short = rdev->wiphy.retry_short;
2473                 old_retry_long = rdev->wiphy.retry_long;
2474                 old_frag_threshold = rdev->wiphy.frag_threshold;
2475                 old_rts_threshold = rdev->wiphy.rts_threshold;
2476                 old_coverage_class = rdev->wiphy.coverage_class;
2477
2478                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2479                         rdev->wiphy.retry_short = retry_short;
2480                 if (changed & WIPHY_PARAM_RETRY_LONG)
2481                         rdev->wiphy.retry_long = retry_long;
2482                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2483                         rdev->wiphy.frag_threshold = frag_threshold;
2484                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2485                         rdev->wiphy.rts_threshold = rts_threshold;
2486                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2487                         rdev->wiphy.coverage_class = coverage_class;
2488
2489                 result = rdev_set_wiphy_params(rdev, changed);
2490                 if (result) {
2491                         rdev->wiphy.retry_short = old_retry_short;
2492                         rdev->wiphy.retry_long = old_retry_long;
2493                         rdev->wiphy.frag_threshold = old_frag_threshold;
2494                         rdev->wiphy.rts_threshold = old_rts_threshold;
2495                         rdev->wiphy.coverage_class = old_coverage_class;
2496                         return result;
2497                 }
2498         }
2499         return 0;
2500 }
2501
2502 static inline u64 wdev_id(struct wireless_dev *wdev)
2503 {
2504         return (u64)wdev->identifier |
2505                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2506 }
2507
2508 static int nl80211_send_chandef(struct sk_buff *msg,
2509                                 const struct cfg80211_chan_def *chandef)
2510 {
2511         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2512                 return -EINVAL;
2513
2514         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2515                         chandef->chan->center_freq))
2516                 return -ENOBUFS;
2517         switch (chandef->width) {
2518         case NL80211_CHAN_WIDTH_20_NOHT:
2519         case NL80211_CHAN_WIDTH_20:
2520         case NL80211_CHAN_WIDTH_40:
2521                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2522                                 cfg80211_get_chandef_type(chandef)))
2523                         return -ENOBUFS;
2524                 break;
2525         default:
2526                 break;
2527         }
2528         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2529                 return -ENOBUFS;
2530         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2531                 return -ENOBUFS;
2532         if (chandef->center_freq2 &&
2533             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2534                 return -ENOBUFS;
2535         return 0;
2536 }
2537
2538 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2539                               struct cfg80211_registered_device *rdev,
2540                               struct wireless_dev *wdev, bool removal)
2541 {
2542         struct net_device *dev = wdev->netdev;
2543         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2544         void *hdr;
2545
2546         if (removal)
2547                 cmd = NL80211_CMD_DEL_INTERFACE;
2548
2549         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2550         if (!hdr)
2551                 return -1;
2552
2553         if (dev &&
2554             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2555              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2556                 goto nla_put_failure;
2557
2558         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2559             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2560             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2561                               NL80211_ATTR_PAD) ||
2562             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2563             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2564                         rdev->devlist_generation ^
2565                         (cfg80211_rdev_list_generation << 2)))
2566                 goto nla_put_failure;
2567
2568         if (rdev->ops->get_channel) {
2569                 int ret;
2570                 struct cfg80211_chan_def chandef;
2571
2572                 ret = rdev_get_channel(rdev, wdev, &chandef);
2573                 if (ret == 0) {
2574                         if (nl80211_send_chandef(msg, &chandef))
2575                                 goto nla_put_failure;
2576                 }
2577         }
2578
2579         if (rdev->ops->get_tx_power) {
2580                 int dbm, ret;
2581
2582                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2583                 if (ret == 0 &&
2584                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2585                                 DBM_TO_MBM(dbm)))
2586                         goto nla_put_failure;
2587         }
2588
2589         if (wdev->ssid_len) {
2590                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2591                         goto nla_put_failure;
2592         }
2593
2594         genlmsg_end(msg, hdr);
2595         return 0;
2596
2597  nla_put_failure:
2598         genlmsg_cancel(msg, hdr);
2599         return -EMSGSIZE;
2600 }
2601
2602 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2603 {
2604         int wp_idx = 0;
2605         int if_idx = 0;
2606         int wp_start = cb->args[0];
2607         int if_start = cb->args[1];
2608         int filter_wiphy = -1;
2609         struct cfg80211_registered_device *rdev;
2610         struct wireless_dev *wdev;
2611
2612         rtnl_lock();
2613         if (!cb->args[2]) {
2614                 struct nl80211_dump_wiphy_state state = {
2615                         .filter_wiphy = -1,
2616                 };
2617                 int ret;
2618
2619                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2620                 if (ret)
2621                         return ret;
2622
2623                 filter_wiphy = state.filter_wiphy;
2624
2625                 /*
2626                  * if filtering, set cb->args[2] to +1 since 0 is the default
2627                  * value needed to determine that parsing is necessary.
2628                  */
2629                 if (filter_wiphy >= 0)
2630                         cb->args[2] = filter_wiphy + 1;
2631                 else
2632                         cb->args[2] = -1;
2633         } else if (cb->args[2] > 0) {
2634                 filter_wiphy = cb->args[2] - 1;
2635         }
2636
2637         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2638                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2639                         continue;
2640                 if (wp_idx < wp_start) {
2641                         wp_idx++;
2642                         continue;
2643                 }
2644
2645                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2646                         continue;
2647
2648                 if_idx = 0;
2649
2650                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2651                         if (if_idx < if_start) {
2652                                 if_idx++;
2653                                 continue;
2654                         }
2655                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2656                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2657                                                rdev, wdev, false) < 0) {
2658                                 goto out;
2659                         }
2660                         if_idx++;
2661                 }
2662
2663                 wp_idx++;
2664         }
2665  out:
2666         rtnl_unlock();
2667
2668         cb->args[0] = wp_idx;
2669         cb->args[1] = if_idx;
2670
2671         return skb->len;
2672 }
2673
2674 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2675 {
2676         struct sk_buff *msg;
2677         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2678         struct wireless_dev *wdev = info->user_ptr[1];
2679
2680         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2681         if (!msg)
2682                 return -ENOMEM;
2683
2684         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2685                                rdev, wdev, false) < 0) {
2686                 nlmsg_free(msg);
2687                 return -ENOBUFS;
2688         }
2689
2690         return genlmsg_reply(msg, info);
2691 }
2692
2693 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2694         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2695         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2696         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2697         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2698         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2699         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2700 };
2701
2702 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2703 {
2704         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2705         int flag;
2706
2707         *mntrflags = 0;
2708
2709         if (!nla)
2710                 return -EINVAL;
2711
2712         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2713                              nla, mntr_flags_policy))
2714                 return -EINVAL;
2715
2716         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2717                 if (flags[flag])
2718                         *mntrflags |= (1<<flag);
2719
2720         return 0;
2721 }
2722
2723 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2724                                struct net_device *netdev, u8 use_4addr,
2725                                enum nl80211_iftype iftype)
2726 {
2727         if (!use_4addr) {
2728                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2729                         return -EBUSY;
2730                 return 0;
2731         }
2732
2733         switch (iftype) {
2734         case NL80211_IFTYPE_AP_VLAN:
2735                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2736                         return 0;
2737                 break;
2738         case NL80211_IFTYPE_STATION:
2739                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2740                         return 0;
2741                 break;
2742         default:
2743                 break;
2744         }
2745
2746         return -EOPNOTSUPP;
2747 }
2748
2749 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2750 {
2751         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2752         struct vif_params params;
2753         int err;
2754         enum nl80211_iftype otype, ntype;
2755         struct net_device *dev = info->user_ptr[1];
2756         u32 _flags, *flags = NULL;
2757         bool change = false;
2758
2759         memset(&params, 0, sizeof(params));
2760
2761         otype = ntype = dev->ieee80211_ptr->iftype;
2762
2763         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2764                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2765                 if (otype != ntype)
2766                         change = true;
2767                 if (ntype > NL80211_IFTYPE_MAX)
2768                         return -EINVAL;
2769         }
2770
2771         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2772                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2773
2774                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2775                         return -EINVAL;
2776                 if (netif_running(dev))
2777                         return -EBUSY;
2778
2779                 wdev_lock(wdev);
2780                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2781                              IEEE80211_MAX_MESH_ID_LEN);
2782                 wdev->mesh_id_up_len =
2783                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2784                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2785                        wdev->mesh_id_up_len);
2786                 wdev_unlock(wdev);
2787         }
2788
2789         if (info->attrs[NL80211_ATTR_4ADDR]) {
2790                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2791                 change = true;
2792                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2793                 if (err)
2794                         return err;
2795         } else {
2796                 params.use_4addr = -1;
2797         }
2798
2799         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2800                 if (ntype != NL80211_IFTYPE_MONITOR)
2801                         return -EINVAL;
2802                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2803                                           &_flags);
2804                 if (err)
2805                         return err;
2806
2807                 flags = &_flags;
2808                 change = true;
2809         }
2810
2811         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
2812                 const u8 *mumimo_groups;
2813                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2814
2815                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2816                         return -EOPNOTSUPP;
2817
2818                 mumimo_groups =
2819                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
2820
2821                 /* bits 0 and 63 are reserved and must be zero */
2822                 if ((mumimo_groups[0] & BIT(7)) ||
2823                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(0)))
2824                         return -EINVAL;
2825
2826                 memcpy(params.vht_mumimo_groups, mumimo_groups,
2827                        VHT_MUMIMO_GROUPS_DATA_LEN);
2828                 change = true;
2829         }
2830
2831         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
2832                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2833
2834                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2835                         return -EOPNOTSUPP;
2836
2837                 nla_memcpy(params.macaddr,
2838                            info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR],
2839                            ETH_ALEN);
2840                 change = true;
2841         }
2842
2843         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2844             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2845                 return -EOPNOTSUPP;
2846
2847         if (change)
2848                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2849         else
2850                 err = 0;
2851
2852         if (!err && params.use_4addr != -1)
2853                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2854
2855         return err;
2856 }
2857
2858 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2859 {
2860         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2861         struct vif_params params;
2862         struct wireless_dev *wdev;
2863         struct sk_buff *msg;
2864         int err;
2865         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2866         u32 flags;
2867
2868         /* to avoid failing a new interface creation due to pending removal */
2869         cfg80211_destroy_ifaces(rdev);
2870
2871         memset(&params, 0, sizeof(params));
2872
2873         if (!info->attrs[NL80211_ATTR_IFNAME])
2874                 return -EINVAL;
2875
2876         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2877                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2878                 if (type > NL80211_IFTYPE_MAX)
2879                         return -EINVAL;
2880         }
2881
2882         if (!rdev->ops->add_virtual_intf ||
2883             !(rdev->wiphy.interface_modes & (1 << type)))
2884                 return -EOPNOTSUPP;
2885
2886         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
2887              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2888             info->attrs[NL80211_ATTR_MAC]) {
2889                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2890                            ETH_ALEN);
2891                 if (!is_valid_ether_addr(params.macaddr))
2892                         return -EADDRNOTAVAIL;
2893         }
2894
2895         if (info->attrs[NL80211_ATTR_4ADDR]) {
2896                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2897                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2898                 if (err)
2899                         return err;
2900         }
2901
2902         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2903                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2904                                   &flags);
2905
2906         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2907             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2908                 return -EOPNOTSUPP;
2909
2910         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2911         if (!msg)
2912                 return -ENOMEM;
2913
2914         wdev = rdev_add_virtual_intf(rdev,
2915                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2916                                 NET_NAME_USER, type, err ? NULL : &flags,
2917                                 &params);
2918         if (WARN_ON(!wdev)) {
2919                 nlmsg_free(msg);
2920                 return -EPROTO;
2921         } else if (IS_ERR(wdev)) {
2922                 nlmsg_free(msg);
2923                 return PTR_ERR(wdev);
2924         }
2925
2926         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2927                 wdev->owner_nlportid = info->snd_portid;
2928
2929         switch (type) {
2930         case NL80211_IFTYPE_MESH_POINT:
2931                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2932                         break;
2933                 wdev_lock(wdev);
2934                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2935                              IEEE80211_MAX_MESH_ID_LEN);
2936                 wdev->mesh_id_up_len =
2937                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2938                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2939                        wdev->mesh_id_up_len);
2940                 wdev_unlock(wdev);
2941                 break;
2942         case NL80211_IFTYPE_NAN:
2943         case NL80211_IFTYPE_P2P_DEVICE:
2944                 /*
2945                  * P2P Device and NAN do not have a netdev, so don't go
2946                  * through the netdev notifier and must be added here
2947                  */
2948                 mutex_init(&wdev->mtx);
2949                 INIT_LIST_HEAD(&wdev->event_list);
2950                 spin_lock_init(&wdev->event_lock);
2951                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2952                 spin_lock_init(&wdev->mgmt_registrations_lock);
2953
2954                 wdev->identifier = ++rdev->wdev_id;
2955                 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
2956                 rdev->devlist_generation++;
2957                 break;
2958         default:
2959                 break;
2960         }
2961
2962         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2963                                rdev, wdev, false) < 0) {
2964                 nlmsg_free(msg);
2965                 return -ENOBUFS;
2966         }
2967
2968         /*
2969          * For wdevs which have no associated netdev object (e.g. of type
2970          * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
2971          * For all other types, the event will be generated from the
2972          * netdev notifier
2973          */
2974         if (!wdev->netdev)
2975                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
2976
2977         return genlmsg_reply(msg, info);
2978 }
2979
2980 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2981 {
2982         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2983         struct wireless_dev *wdev = info->user_ptr[1];
2984
2985         if (!rdev->ops->del_virtual_intf)
2986                 return -EOPNOTSUPP;
2987
2988         /*
2989          * If we remove a wireless device without a netdev then clear
2990          * user_ptr[1] so that nl80211_post_doit won't dereference it
2991          * to check if it needs to do dev_put(). Otherwise it crashes
2992          * since the wdev has been freed, unlike with a netdev where
2993          * we need the dev_put() for the netdev to really be freed.
2994          */
2995         if (!wdev->netdev)
2996                 info->user_ptr[1] = NULL;
2997
2998         return rdev_del_virtual_intf(rdev, wdev);
2999 }
3000
3001 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3002 {
3003         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3004         struct net_device *dev = info->user_ptr[1];
3005         u16 noack_map;
3006
3007         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3008                 return -EINVAL;
3009
3010         if (!rdev->ops->set_noack_map)
3011                 return -EOPNOTSUPP;
3012
3013         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3014
3015         return rdev_set_noack_map(rdev, dev, noack_map);
3016 }
3017
3018 struct get_key_cookie {
3019         struct sk_buff *msg;
3020         int error;
3021         int idx;
3022 };
3023
3024 static void get_key_callback(void *c, struct key_params *params)
3025 {
3026         struct nlattr *key;
3027         struct get_key_cookie *cookie = c;
3028
3029         if ((params->key &&
3030              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3031                      params->key_len, params->key)) ||
3032             (params->seq &&
3033              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3034                      params->seq_len, params->seq)) ||
3035             (params->cipher &&
3036              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3037                          params->cipher)))
3038                 goto nla_put_failure;
3039
3040         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3041         if (!key)
3042                 goto nla_put_failure;
3043
3044         if ((params->key &&
3045              nla_put(cookie->msg, NL80211_KEY_DATA,
3046                      params->key_len, params->key)) ||
3047             (params->seq &&
3048              nla_put(cookie->msg, NL80211_KEY_SEQ,
3049                      params->seq_len, params->seq)) ||
3050             (params->cipher &&
3051              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3052                          params->cipher)))
3053                 goto nla_put_failure;
3054
3055         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
3056                 goto nla_put_failure;
3057
3058         nla_nest_end(cookie->msg, key);
3059
3060         return;
3061  nla_put_failure:
3062         cookie->error = 1;
3063 }
3064
3065 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3066 {
3067         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3068         int err;
3069         struct net_device *dev = info->user_ptr[1];
3070         u8 key_idx = 0;
3071         const u8 *mac_addr = NULL;
3072         bool pairwise;
3073         struct get_key_cookie cookie = {
3074                 .error = 0,
3075         };
3076         void *hdr;
3077         struct sk_buff *msg;
3078
3079         if (info->attrs[NL80211_ATTR_KEY_IDX])
3080                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3081
3082         if (key_idx > 5)
3083                 return -EINVAL;
3084
3085         if (info->attrs[NL80211_ATTR_MAC])
3086                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3087
3088         pairwise = !!mac_addr;
3089         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3090                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3091
3092                 if (kt >= NUM_NL80211_KEYTYPES)
3093                         return -EINVAL;
3094                 if (kt != NL80211_KEYTYPE_GROUP &&
3095                     kt != NL80211_KEYTYPE_PAIRWISE)
3096                         return -EINVAL;
3097                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3098         }
3099
3100         if (!rdev->ops->get_key)
3101                 return -EOPNOTSUPP;
3102
3103         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3104                 return -ENOENT;
3105
3106         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3107         if (!msg)
3108                 return -ENOMEM;
3109
3110         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3111                              NL80211_CMD_NEW_KEY);
3112         if (!hdr)
3113                 goto nla_put_failure;
3114
3115         cookie.msg = msg;
3116         cookie.idx = key_idx;
3117
3118         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3119             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3120                 goto nla_put_failure;
3121         if (mac_addr &&
3122             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3123                 goto nla_put_failure;
3124
3125         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3126                            get_key_callback);
3127
3128         if (err)
3129                 goto free_msg;
3130
3131         if (cookie.error)
3132                 goto nla_put_failure;
3133
3134         genlmsg_end(msg, hdr);
3135         return genlmsg_reply(msg, info);
3136
3137  nla_put_failure:
3138         err = -ENOBUFS;
3139  free_msg:
3140         nlmsg_free(msg);
3141         return err;
3142 }
3143
3144 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3145 {
3146         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3147         struct key_parse key;
3148         int err;
3149         struct net_device *dev = info->user_ptr[1];
3150
3151         err = nl80211_parse_key(info, &key);
3152         if (err)
3153                 return err;
3154
3155         if (key.idx < 0)
3156                 return -EINVAL;
3157
3158         /* only support setting default key */
3159         if (!key.def && !key.defmgmt)
3160                 return -EINVAL;
3161
3162         wdev_lock(dev->ieee80211_ptr);
3163
3164         if (key.def) {
3165                 if (!rdev->ops->set_default_key) {
3166                         err = -EOPNOTSUPP;
3167                         goto out;
3168                 }
3169
3170                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3171                 if (err)
3172                         goto out;
3173
3174                 err = rdev_set_default_key(rdev, dev, key.idx,
3175                                                  key.def_uni, key.def_multi);
3176
3177                 if (err)
3178                         goto out;
3179
3180 #ifdef CONFIG_CFG80211_WEXT
3181                 dev->ieee80211_ptr->wext.default_key = key.idx;
3182 #endif
3183         } else {
3184                 if (key.def_uni || !key.def_multi) {
3185                         err = -EINVAL;
3186                         goto out;
3187                 }
3188
3189                 if (!rdev->ops->set_default_mgmt_key) {
3190                         err = -EOPNOTSUPP;
3191                         goto out;
3192                 }
3193
3194                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3195                 if (err)
3196                         goto out;
3197
3198                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3199                 if (err)
3200                         goto out;
3201
3202 #ifdef CONFIG_CFG80211_WEXT
3203                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3204 #endif
3205         }
3206
3207  out:
3208         wdev_unlock(dev->ieee80211_ptr);
3209
3210         return err;
3211 }
3212
3213 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3214 {
3215         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3216         int err;
3217         struct net_device *dev = info->user_ptr[1];
3218         struct key_parse key;
3219         const u8 *mac_addr = NULL;
3220
3221         err = nl80211_parse_key(info, &key);
3222         if (err)
3223                 return err;
3224
3225         if (!key.p.key)
3226                 return -EINVAL;
3227
3228         if (info->attrs[NL80211_ATTR_MAC])
3229                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3230
3231         if (key.type == -1) {
3232                 if (mac_addr)
3233                         key.type = NL80211_KEYTYPE_PAIRWISE;
3234                 else
3235                         key.type = NL80211_KEYTYPE_GROUP;
3236         }
3237
3238         /* for now */
3239         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3240             key.type != NL80211_KEYTYPE_GROUP)
3241                 return -EINVAL;
3242
3243         if (!rdev->ops->add_key)
3244                 return -EOPNOTSUPP;
3245
3246         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3247                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3248                                            mac_addr))
3249                 return -EINVAL;
3250
3251         wdev_lock(dev->ieee80211_ptr);
3252         err = nl80211_key_allowed(dev->ieee80211_ptr);
3253         if (!err)
3254                 err = rdev_add_key(rdev, dev, key.idx,
3255                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3256                                     mac_addr, &key.p);
3257         wdev_unlock(dev->ieee80211_ptr);
3258
3259         return err;
3260 }
3261
3262 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3263 {
3264         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3265         int err;
3266         struct net_device *dev = info->user_ptr[1];
3267         u8 *mac_addr = NULL;
3268         struct key_parse key;
3269
3270         err = nl80211_parse_key(info, &key);
3271         if (err)
3272                 return err;
3273
3274         if (info->attrs[NL80211_ATTR_MAC])
3275                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3276
3277         if (key.type == -1) {
3278                 if (mac_addr)
3279                         key.type = NL80211_KEYTYPE_PAIRWISE;
3280                 else
3281                         key.type = NL80211_KEYTYPE_GROUP;
3282         }
3283
3284         /* for now */
3285         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3286             key.type != NL80211_KEYTYPE_GROUP)
3287                 return -EINVAL;
3288
3289         if (!rdev->ops->del_key)
3290                 return -EOPNOTSUPP;
3291
3292         wdev_lock(dev->ieee80211_ptr);
3293         err = nl80211_key_allowed(dev->ieee80211_ptr);
3294
3295         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3296             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3297                 err = -ENOENT;
3298
3299         if (!err)
3300                 err = rdev_del_key(rdev, dev, key.idx,
3301                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3302                                    mac_addr);
3303
3304 #ifdef CONFIG_CFG80211_WEXT
3305         if (!err) {
3306                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3307                         dev->ieee80211_ptr->wext.default_key = -1;
3308                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3309                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3310         }
3311 #endif
3312         wdev_unlock(dev->ieee80211_ptr);
3313
3314         return err;
3315 }
3316
3317 /* This function returns an error or the number of nested attributes */
3318 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3319 {
3320         struct nlattr *attr;
3321         int n_entries = 0, tmp;
3322
3323         nla_for_each_nested(attr, nl_attr, tmp) {
3324                 if (nla_len(attr) != ETH_ALEN)
3325                         return -EINVAL;
3326
3327                 n_entries++;
3328         }
3329
3330         return n_entries;
3331 }
3332
3333 /*
3334  * This function parses ACL information and allocates memory for ACL data.
3335  * On successful return, the calling function is responsible to free the
3336  * ACL buffer returned by this function.
3337  */
3338 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3339                                                 struct genl_info *info)
3340 {
3341         enum nl80211_acl_policy acl_policy;
3342         struct nlattr *attr;
3343         struct cfg80211_acl_data *acl;
3344         int i = 0, n_entries, tmp;
3345
3346         if (!wiphy->max_acl_mac_addrs)
3347                 return ERR_PTR(-EOPNOTSUPP);
3348
3349         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3350                 return ERR_PTR(-EINVAL);
3351
3352         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3353         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3354             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3355                 return ERR_PTR(-EINVAL);
3356
3357         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3358                 return ERR_PTR(-EINVAL);
3359
3360         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3361         if (n_entries < 0)
3362                 return ERR_PTR(n_entries);
3363
3364         if (n_entries > wiphy->max_acl_mac_addrs)
3365                 return ERR_PTR(-ENOTSUPP);
3366
3367         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3368                       GFP_KERNEL);
3369         if (!acl)
3370                 return ERR_PTR(-ENOMEM);
3371
3372         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3373                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3374                 i++;
3375         }
3376
3377         acl->n_acl_entries = n_entries;
3378         acl->acl_policy = acl_policy;
3379
3380         return acl;
3381 }
3382
3383 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3384 {
3385         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3386         struct net_device *dev = info->user_ptr[1];
3387         struct cfg80211_acl_data *acl;
3388         int err;
3389
3390         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3391             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3392                 return -EOPNOTSUPP;
3393
3394         if (!dev->ieee80211_ptr->beacon_interval)
3395                 return -EINVAL;
3396
3397         acl = parse_acl_data(&rdev->wiphy, info);
3398         if (IS_ERR(acl))
3399                 return PTR_ERR(acl);
3400
3401         err = rdev_set_mac_acl(rdev, dev, acl);
3402
3403         kfree(acl);
3404
3405         return err;
3406 }
3407
3408 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3409                            u8 *rates, u8 rates_len)
3410 {
3411         u8 i;
3412         u32 mask = 0;
3413
3414         for (i = 0; i < rates_len; i++) {
3415                 int rate = (rates[i] & 0x7f) * 5;
3416                 int ridx;
3417
3418                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3419                         struct ieee80211_rate *srate =
3420                                 &sband->bitrates[ridx];
3421                         if (rate == srate->bitrate) {
3422                                 mask |= 1 << ridx;
3423                                 break;
3424                         }
3425                 }
3426                 if (ridx == sband->n_bitrates)
3427                         return 0; /* rate not found */
3428         }
3429
3430         return mask;
3431 }
3432
3433 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3434                                u8 *rates, u8 rates_len,
3435                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3436 {
3437         u8 i;
3438
3439         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3440
3441         for (i = 0; i < rates_len; i++) {
3442                 int ridx, rbit;
3443
3444                 ridx = rates[i] / 8;
3445                 rbit = BIT(rates[i] % 8);
3446
3447                 /* check validity */
3448                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3449                         return false;
3450
3451                 /* check availability */
3452                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3453                         mcs[ridx] |= rbit;
3454                 else
3455                         return false;
3456         }
3457
3458         return true;
3459 }
3460
3461 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3462 {
3463         u16 mcs_mask = 0;
3464
3465         switch (vht_mcs_map) {
3466         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3467                 break;
3468         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3469                 mcs_mask = 0x00FF;
3470                 break;
3471         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3472                 mcs_mask = 0x01FF;
3473                 break;
3474         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3475                 mcs_mask = 0x03FF;
3476                 break;
3477         default:
3478                 break;
3479         }
3480
3481         return mcs_mask;
3482 }
3483
3484 static void vht_build_mcs_mask(u16 vht_mcs_map,
3485                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3486 {
3487         u8 nss;
3488
3489         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3490                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3491                 vht_mcs_map >>= 2;
3492         }
3493 }
3494
3495 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3496                              struct nl80211_txrate_vht *txrate,
3497                              u16 mcs[NL80211_VHT_NSS_MAX])
3498 {
3499         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3500         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3501         u8 i;
3502
3503         if (!sband->vht_cap.vht_supported)
3504                 return false;
3505
3506         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3507
3508         /* Build vht_mcs_mask from VHT capabilities */
3509         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3510
3511         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3512                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3513                         mcs[i] = txrate->mcs[i];
3514                 else
3515                         return false;
3516         }
3517
3518         return true;
3519 }
3520
3521 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3522         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3523                                     .len = NL80211_MAX_SUPP_RATES },
3524         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3525                                 .len = NL80211_MAX_SUPP_HT_RATES },
3526         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3527         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3528 };
3529
3530 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3531                                          struct cfg80211_bitrate_mask *mask)
3532 {
3533         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3534         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3535         int rem, i;
3536         struct nlattr *tx_rates;
3537         struct ieee80211_supported_band *sband;
3538         u16 vht_tx_mcs_map;
3539
3540         memset(mask, 0, sizeof(*mask));
3541         /* Default to all rates enabled */
3542         for (i = 0; i < NUM_NL80211_BANDS; i++) {
3543                 sband = rdev->wiphy.bands[i];
3544
3545                 if (!sband)
3546                         continue;
3547
3548                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3549                 memcpy(mask->control[i].ht_mcs,
3550                        sband->ht_cap.mcs.rx_mask,
3551                        sizeof(mask->control[i].ht_mcs));
3552
3553                 if (!sband->vht_cap.vht_supported)
3554                         continue;
3555
3556                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3557                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3558         }
3559
3560         /* if no rates are given set it back to the defaults */
3561         if (!info->attrs[NL80211_ATTR_TX_RATES])
3562                 goto out;
3563
3564         /* The nested attribute uses enum nl80211_band as the index. This maps
3565          * directly to the enum nl80211_band values used in cfg80211.
3566          */
3567         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3568         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3569                 enum nl80211_band band = nla_type(tx_rates);
3570                 int err;
3571
3572                 if (band < 0 || band >= NUM_NL80211_BANDS)
3573                         return -EINVAL;
3574                 sband = rdev->wiphy.bands[band];
3575                 if (sband == NULL)
3576                         return -EINVAL;
3577                 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
3578                                        nl80211_txattr_policy);
3579                 if (err)
3580                         return err;
3581                 if (tb[NL80211_TXRATE_LEGACY]) {
3582                         mask->control[band].legacy = rateset_to_mask(
3583                                 sband,
3584                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
3585                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
3586                         if ((mask->control[band].legacy == 0) &&
3587                             nla_len(tb[NL80211_TXRATE_LEGACY]))
3588                                 return -EINVAL;
3589                 }
3590                 if (tb[NL80211_TXRATE_HT]) {
3591                         if (!ht_rateset_to_mask(
3592                                         sband,
3593                                         nla_data(tb[NL80211_TXRATE_HT]),
3594                                         nla_len(tb[NL80211_TXRATE_HT]),
3595                                         mask->control[band].ht_mcs))
3596                                 return -EINVAL;
3597                 }
3598                 if (tb[NL80211_TXRATE_VHT]) {
3599                         if (!vht_set_mcs_mask(
3600                                         sband,
3601                                         nla_data(tb[NL80211_TXRATE_VHT]),
3602                                         mask->control[band].vht_mcs))
3603                                 return -EINVAL;
3604                 }
3605                 if (tb[NL80211_TXRATE_GI]) {
3606                         mask->control[band].gi =
3607                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
3608                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3609                                 return -EINVAL;
3610                 }
3611
3612                 if (mask->control[band].legacy == 0) {
3613                         /* don't allow empty legacy rates if HT or VHT
3614                          * are not even supported.
3615                          */
3616                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3617                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
3618                                 return -EINVAL;
3619
3620                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3621                                 if (mask->control[band].ht_mcs[i])
3622                                         goto out;
3623
3624                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3625                                 if (mask->control[band].vht_mcs[i])
3626                                         goto out;
3627
3628                         /* legacy and mcs rates may not be both empty */
3629                         return -EINVAL;
3630                 }
3631         }
3632
3633 out:
3634         return 0;
3635 }
3636
3637 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3638                                    enum nl80211_band band,
3639                                    struct cfg80211_bitrate_mask *beacon_rate)
3640 {
3641         u32 count_ht, count_vht, i;
3642         u32 rate = beacon_rate->control[band].legacy;
3643
3644         /* Allow only one rate */
3645         if (hweight32(rate) > 1)
3646                 return -EINVAL;
3647
3648         count_ht = 0;
3649         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3650                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3651                         return -EINVAL;
3652                 } else if (beacon_rate->control[band].ht_mcs[i]) {
3653                         count_ht++;
3654                         if (count_ht > 1)
3655                                 return -EINVAL;
3656                 }
3657                 if (count_ht && rate)
3658                         return -EINVAL;
3659         }
3660
3661         count_vht = 0;
3662         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3663                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3664                         return -EINVAL;
3665                 } else if (beacon_rate->control[band].vht_mcs[i]) {
3666                         count_vht++;
3667                         if (count_vht > 1)
3668                                 return -EINVAL;
3669                 }
3670                 if (count_vht && rate)
3671                         return -EINVAL;
3672         }
3673
3674         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
3675                 return -EINVAL;
3676
3677         if (rate &&
3678             !wiphy_ext_feature_isset(&rdev->wiphy,
3679                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
3680                 return -EINVAL;
3681         if (count_ht &&
3682             !wiphy_ext_feature_isset(&rdev->wiphy,
3683                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
3684                 return -EINVAL;
3685         if (count_vht &&
3686             !wiphy_ext_feature_isset(&rdev->wiphy,
3687                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
3688                 return -EINVAL;
3689
3690         return 0;
3691 }
3692
3693 static int nl80211_parse_beacon(struct nlattr *attrs[],
3694                                 struct cfg80211_beacon_data *bcn)
3695 {
3696         bool haveinfo = false;
3697
3698         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3699             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3700             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3701             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3702                 return -EINVAL;
3703
3704         memset(bcn, 0, sizeof(*bcn));
3705
3706         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3707                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3708                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3709                 if (!bcn->head_len)
3710                         return -EINVAL;
3711                 haveinfo = true;
3712         }
3713
3714         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3715                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3716                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3717                 haveinfo = true;
3718         }
3719
3720         if (!haveinfo)
3721                 return -EINVAL;
3722
3723         if (attrs[NL80211_ATTR_IE]) {
3724                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3725                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3726         }
3727
3728         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3729                 bcn->proberesp_ies =
3730                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3731                 bcn->proberesp_ies_len =
3732                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3733         }
3734
3735         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3736                 bcn->assocresp_ies =
3737                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3738                 bcn->assocresp_ies_len =
3739                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3740         }
3741
3742         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3743                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3744                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3745         }
3746
3747         return 0;
3748 }
3749
3750 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
3751                                             const u8 *rates)
3752 {
3753         int i;
3754
3755         if (!rates)
3756                 return;
3757
3758         for (i = 0; i < rates[1]; i++) {
3759                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
3760                         params->ht_required = true;
3761                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
3762                         params->vht_required = true;
3763         }
3764 }
3765
3766 /*
3767  * Since the nl80211 API didn't include, from the beginning, attributes about
3768  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
3769  * benefit of drivers that rebuild IEs in the firmware.
3770  */
3771 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
3772 {
3773         const struct cfg80211_beacon_data *bcn = &params->beacon;
3774         size_t ies_len = bcn->beacon_ies_len;
3775         const u8 *ies = bcn->beacon_ies;
3776         const u8 *rates;
3777         const u8 *cap;
3778
3779         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
3780         nl80211_check_ap_rate_selectors(params, rates);
3781
3782         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
3783         nl80211_check_ap_rate_selectors(params, rates);
3784
3785         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
3786         if (cap && cap[1] >= sizeof(*params->ht_cap))
3787                 params->ht_cap = (void *)(cap + 2);
3788         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
3789         if (cap && cap[1] >= sizeof(*params->vht_cap))
3790                 params->vht_cap = (void *)(cap + 2);
3791 }
3792
3793 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3794                                    struct cfg80211_ap_settings *params)
3795 {
3796         struct wireless_dev *wdev;
3797         bool ret = false;
3798
3799         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3800                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3801                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3802                         continue;
3803
3804                 if (!wdev->preset_chandef.chan)
3805                         continue;
3806
3807                 params->chandef = wdev->preset_chandef;
3808                 ret = true;
3809                 break;
3810         }
3811
3812         return ret;
3813 }
3814
3815 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3816                                     enum nl80211_auth_type auth_type,
3817                                     enum nl80211_commands cmd)
3818 {
3819         if (auth_type > NL80211_AUTHTYPE_MAX)
3820                 return false;
3821
3822         switch (cmd) {
3823         case NL80211_CMD_AUTHENTICATE:
3824                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3825                     auth_type == NL80211_AUTHTYPE_SAE)
3826                         return false;
3827                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3828                                              NL80211_EXT_FEATURE_FILS_STA) &&
3829                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3830                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3831                      auth_type == NL80211_AUTHTYPE_FILS_PK))
3832                         return false;
3833                 return true;
3834         case NL80211_CMD_CONNECT:
3835         case NL80211_CMD_START_AP:
3836                 /* SAE not supported yet */
3837                 if (auth_type == NL80211_AUTHTYPE_SAE)
3838                         return false;
3839                 /* FILS not supported yet */
3840                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3841                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3842                     auth_type == NL80211_AUTHTYPE_FILS_PK)
3843                         return false;
3844                 return true;
3845         default:
3846                 return false;
3847         }
3848 }
3849
3850 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3851 {
3852         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3853         struct net_device *dev = info->user_ptr[1];
3854         struct wireless_dev *wdev = dev->ieee80211_ptr;
3855         struct cfg80211_ap_settings params;
3856         int err;
3857
3858         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3859             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3860                 return -EOPNOTSUPP;
3861
3862         if (!rdev->ops->start_ap)
3863                 return -EOPNOTSUPP;
3864
3865         if (wdev->beacon_interval)
3866                 return -EALREADY;
3867
3868         memset(&params, 0, sizeof(params));
3869
3870         /* these are required for START_AP */
3871         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3872             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3873             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3874                 return -EINVAL;
3875
3876         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3877         if (err)
3878                 return err;
3879
3880         params.beacon_interval =
3881                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3882         params.dtim_period =
3883                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3884
3885         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
3886                                            params.beacon_interval);
3887         if (err)
3888                 return err;
3889
3890         /*
3891          * In theory, some of these attributes should be required here
3892          * but since they were not used when the command was originally
3893          * added, keep them optional for old user space programs to let
3894          * them continue to work with drivers that do not need the
3895          * additional information -- drivers must check!
3896          */
3897         if (info->attrs[NL80211_ATTR_SSID]) {
3898                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3899                 params.ssid_len =
3900                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3901                 if (params.ssid_len == 0 ||
3902                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3903                         return -EINVAL;
3904         }
3905
3906         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3907                 params.hidden_ssid = nla_get_u32(
3908                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3909                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3910                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3911                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3912                         return -EINVAL;
3913         }
3914
3915         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3916
3917         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3918                 params.auth_type = nla_get_u32(
3919                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3920                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3921                                              NL80211_CMD_START_AP))
3922                         return -EINVAL;
3923         } else
3924                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3925
3926         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3927                                       NL80211_MAX_NR_CIPHER_SUITES);
3928         if (err)
3929                 return err;
3930
3931         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3932                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3933                         return -EOPNOTSUPP;
3934                 params.inactivity_timeout = nla_get_u16(
3935                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3936         }
3937
3938         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3939                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3940                         return -EINVAL;
3941                 params.p2p_ctwindow =
3942                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3943                 if (params.p2p_ctwindow > 127)
3944                         return -EINVAL;
3945                 if (params.p2p_ctwindow != 0 &&
3946                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3947                         return -EINVAL;
3948         }
3949
3950         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3951                 u8 tmp;
3952
3953                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3954                         return -EINVAL;
3955                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3956                 if (tmp > 1)
3957                         return -EINVAL;
3958                 params.p2p_opp_ps = tmp;
3959                 if (params.p2p_opp_ps != 0 &&
3960                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3961                         return -EINVAL;
3962         }
3963
3964         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3965                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3966                 if (err)
3967                         return err;
3968         } else if (wdev->preset_chandef.chan) {
3969                 params.chandef = wdev->preset_chandef;
3970         } else if (!nl80211_get_ap_channel(rdev, &params))
3971                 return -EINVAL;
3972
3973         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
3974                                            wdev->iftype))
3975                 return -EINVAL;
3976
3977         if (info->attrs[NL80211_ATTR_TX_RATES]) {
3978                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
3979                 if (err)
3980                         return err;
3981
3982                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
3983                                               &params.beacon_rate);
3984                 if (err)
3985                         return err;
3986         }
3987
3988         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3989                 params.smps_mode =
3990                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3991                 switch (params.smps_mode) {
3992                 case NL80211_SMPS_OFF:
3993                         break;
3994                 case NL80211_SMPS_STATIC:
3995                         if (!(rdev->wiphy.features &
3996                               NL80211_FEATURE_STATIC_SMPS))
3997                                 return -EINVAL;
3998                         break;
3999                 case NL80211_SMPS_DYNAMIC:
4000                         if (!(rdev->wiphy.features &
4001                               NL80211_FEATURE_DYNAMIC_SMPS))
4002                                 return -EINVAL;
4003                         break;
4004                 default:
4005                         return -EINVAL;
4006                 }
4007         } else {
4008                 params.smps_mode = NL80211_SMPS_OFF;
4009         }
4010
4011         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4012         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4013                 return -EOPNOTSUPP;
4014
4015         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4016                 params.acl = parse_acl_data(&rdev->wiphy, info);
4017                 if (IS_ERR(params.acl))
4018                         return PTR_ERR(params.acl);
4019         }
4020
4021         nl80211_calculate_ap_params(&params);
4022
4023         wdev_lock(wdev);
4024         err = rdev_start_ap(rdev, dev, &params);
4025         if (!err) {
4026                 wdev->preset_chandef = params.chandef;
4027                 wdev->beacon_interval = params.beacon_interval;
4028                 wdev->chandef = params.chandef;
4029                 wdev->ssid_len = params.ssid_len;
4030                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4031         }
4032         wdev_unlock(wdev);
4033
4034         kfree(params.acl);
4035
4036         return err;
4037 }
4038
4039 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4040 {
4041         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4042         struct net_device *dev = info->user_ptr[1];
4043         struct wireless_dev *wdev = dev->ieee80211_ptr;
4044         struct cfg80211_beacon_data params;
4045         int err;
4046
4047         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4048             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4049                 return -EOPNOTSUPP;
4050
4051         if (!rdev->ops->change_beacon)
4052                 return -EOPNOTSUPP;
4053
4054         if (!wdev->beacon_interval)
4055                 return -EINVAL;
4056
4057         err = nl80211_parse_beacon(info->attrs, &params);
4058         if (err)
4059                 return err;
4060
4061         wdev_lock(wdev);
4062         err = rdev_change_beacon(rdev, dev, &params);
4063         wdev_unlock(wdev);
4064
4065         return err;
4066 }
4067
4068 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4069 {
4070         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4071         struct net_device *dev = info->user_ptr[1];
4072
4073         return cfg80211_stop_ap(rdev, dev, false);
4074 }
4075
4076 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4077         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4078         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4079         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4080         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4081         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4082         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4083 };
4084
4085 static int parse_station_flags(struct genl_info *info,
4086                                enum nl80211_iftype iftype,
4087                                struct station_parameters *params)
4088 {
4089         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4090         struct nlattr *nla;
4091         int flag;
4092
4093         /*
4094          * Try parsing the new attribute first so userspace
4095          * can specify both for older kernels.
4096          */
4097         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4098         if (nla) {
4099                 struct nl80211_sta_flag_update *sta_flags;
4100
4101                 sta_flags = nla_data(nla);
4102                 params->sta_flags_mask = sta_flags->mask;
4103                 params->sta_flags_set = sta_flags->set;
4104                 params->sta_flags_set &= params->sta_flags_mask;
4105                 if ((params->sta_flags_mask |
4106                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4107                         return -EINVAL;
4108                 return 0;
4109         }
4110
4111         /* if present, parse the old attribute */
4112
4113         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4114         if (!nla)
4115                 return 0;
4116
4117         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
4118                              nla, sta_flags_policy))
4119                 return -EINVAL;
4120
4121         /*
4122          * Only allow certain flags for interface types so that
4123          * other attributes are silently ignored. Remember that
4124          * this is backward compatibility code with old userspace
4125          * and shouldn't be hit in other cases anyway.
4126          */
4127         switch (iftype) {
4128         case NL80211_IFTYPE_AP:
4129         case NL80211_IFTYPE_AP_VLAN:
4130         case NL80211_IFTYPE_P2P_GO:
4131                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4132                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4133                                          BIT(NL80211_STA_FLAG_WME) |
4134                                          BIT(NL80211_STA_FLAG_MFP);
4135                 break;
4136         case NL80211_IFTYPE_P2P_CLIENT:
4137         case NL80211_IFTYPE_STATION:
4138                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4139                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4140                 break;
4141         case NL80211_IFTYPE_MESH_POINT:
4142                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4143                                          BIT(NL80211_STA_FLAG_MFP) |
4144                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4145         default:
4146                 return -EINVAL;
4147         }
4148
4149         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4150                 if (flags[flag]) {
4151                         params->sta_flags_set |= (1<<flag);
4152
4153                         /* no longer support new API additions in old API */
4154                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4155                                 return -EINVAL;
4156                 }
4157         }
4158
4159         return 0;
4160 }
4161
4162 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4163                                  int attr)
4164 {
4165         struct nlattr *rate;
4166         u32 bitrate;
4167         u16 bitrate_compat;
4168         enum nl80211_attrs rate_flg;
4169
4170         rate = nla_nest_start(msg, attr);
4171         if (!rate)
4172                 return false;
4173
4174         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4175         bitrate = cfg80211_calculate_bitrate(info);
4176         /* report 16-bit bitrate only if we can */
4177         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4178         if (bitrate > 0 &&
4179             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4180                 return false;
4181         if (bitrate_compat > 0 &&
4182             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4183                 return false;
4184
4185         switch (info->bw) {
4186         case RATE_INFO_BW_5:
4187                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4188                 break;
4189         case RATE_INFO_BW_10:
4190                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4191                 break;
4192         default:
4193                 WARN_ON(1);
4194                 /* fall through */
4195         case RATE_INFO_BW_20:
4196                 rate_flg = 0;
4197                 break;
4198         case RATE_INFO_BW_40:
4199                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4200                 break;
4201         case RATE_INFO_BW_80:
4202                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4203                 break;
4204         case RATE_INFO_BW_160:
4205                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4206                 break;
4207         }
4208
4209         if (rate_flg && nla_put_flag(msg, rate_flg))
4210                 return false;
4211
4212         if (info->flags & RATE_INFO_FLAGS_MCS) {
4213                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4214                         return false;
4215                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4216                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4217                         return false;
4218         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4219                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4220                         return false;
4221                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4222                         return false;
4223                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4224                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4225                         return false;
4226         }
4227
4228         nla_nest_end(msg, rate);
4229         return true;
4230 }
4231
4232 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4233                                int id)
4234 {
4235         void *attr;
4236         int i = 0;
4237
4238         if (!mask)
4239                 return true;
4240
4241         attr = nla_nest_start(msg, id);
4242         if (!attr)
4243                 return false;
4244
4245         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4246                 if (!(mask & BIT(i)))
4247                         continue;
4248
4249                 if (nla_put_u8(msg, i, signal[i]))
4250                         return false;
4251         }
4252
4253         nla_nest_end(msg, attr);
4254
4255         return true;
4256 }
4257
4258 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4259                                 u32 seq, int flags,
4260                                 struct cfg80211_registered_device *rdev,
4261                                 struct net_device *dev,
4262                                 const u8 *mac_addr, struct station_info *sinfo)
4263 {
4264         void *hdr;
4265         struct nlattr *sinfoattr, *bss_param;
4266
4267         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4268         if (!hdr)
4269                 return -1;
4270
4271         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4272             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4273             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4274                 goto nla_put_failure;
4275
4276         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4277         if (!sinfoattr)
4278                 goto nla_put_failure;
4279
4280 #define PUT_SINFO(attr, memb, type) do {                                \
4281         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4282         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
4283             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4284                              sinfo->memb))                              \
4285                 goto nla_put_failure;                                   \
4286         } while (0)
4287 #define PUT_SINFO_U64(attr, memb) do {                                  \
4288         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
4289             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4290                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4291                 goto nla_put_failure;                                   \
4292         } while (0)
4293
4294         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4295         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4296
4297         if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
4298                              BIT(NL80211_STA_INFO_RX_BYTES64)) &&
4299             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4300                         (u32)sinfo->rx_bytes))
4301                 goto nla_put_failure;
4302
4303         if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
4304                              BIT(NL80211_STA_INFO_TX_BYTES64)) &&
4305             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4306                         (u32)sinfo->tx_bytes))
4307                 goto nla_put_failure;
4308
4309         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4310         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4311         PUT_SINFO(LLID, llid, u16);
4312         PUT_SINFO(PLID, plid, u16);
4313         PUT_SINFO(PLINK_STATE, plink_state, u8);
4314         PUT_SINFO_U64(RX_DURATION, rx_duration);
4315
4316         switch (rdev->wiphy.signal_type) {
4317         case CFG80211_SIGNAL_TYPE_MBM:
4318                 PUT_SINFO(SIGNAL, signal, u8);
4319                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4320                 break;
4321         default:
4322                 break;
4323         }
4324         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4325                 if (!nl80211_put_signal(msg, sinfo->chains,
4326                                         sinfo->chain_signal,
4327                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4328                         goto nla_put_failure;
4329         }
4330         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4331                 if (!nl80211_put_signal(msg, sinfo->chains,
4332                                         sinfo->chain_signal_avg,
4333                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4334                         goto nla_put_failure;
4335         }
4336         if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
4337                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4338                                           NL80211_STA_INFO_TX_BITRATE))
4339                         goto nla_put_failure;
4340         }
4341         if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
4342                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4343                                           NL80211_STA_INFO_RX_BITRATE))
4344                         goto nla_put_failure;
4345         }
4346
4347         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4348         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4349         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4350         PUT_SINFO(TX_FAILED, tx_failed, u32);
4351         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4352         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4353         PUT_SINFO(LOCAL_PM, local_pm, u32);
4354         PUT_SINFO(PEER_PM, peer_pm, u32);
4355         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4356
4357         if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
4358                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4359                 if (!bss_param)
4360                         goto nla_put_failure;
4361
4362                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4363                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4364                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4365                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4366                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4367                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4368                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4369                                sinfo->bss_param.dtim_period) ||
4370                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4371                                 sinfo->bss_param.beacon_interval))
4372                         goto nla_put_failure;
4373
4374                 nla_nest_end(msg, bss_param);
4375         }
4376         if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
4377             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4378                     sizeof(struct nl80211_sta_flag_update),
4379                     &sinfo->sta_flags))
4380                 goto nla_put_failure;
4381
4382         PUT_SINFO_U64(T_OFFSET, t_offset);
4383         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4384         PUT_SINFO_U64(BEACON_RX, rx_beacon);
4385         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4386
4387 #undef PUT_SINFO
4388 #undef PUT_SINFO_U64
4389
4390         if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
4391                 struct nlattr *tidsattr;
4392                 int tid;
4393
4394                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4395                 if (!tidsattr)
4396                         goto nla_put_failure;
4397
4398                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4399                         struct cfg80211_tid_stats *tidstats;
4400                         struct nlattr *tidattr;
4401
4402                         tidstats = &sinfo->pertid[tid];
4403
4404                         if (!tidstats->filled)
4405                                 continue;
4406
4407                         tidattr = nla_nest_start(msg, tid + 1);
4408                         if (!tidattr)
4409                                 goto nla_put_failure;
4410
4411 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
4412         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
4413             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
4414                               tidstats->memb, NL80211_TID_STATS_PAD))   \
4415                 goto nla_put_failure;                                   \
4416         } while (0)
4417
4418                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4419                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4420                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4421                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4422
4423 #undef PUT_TIDVAL_U64
4424                         nla_nest_end(msg, tidattr);
4425                 }
4426
4427                 nla_nest_end(msg, tidsattr);
4428         }
4429
4430         nla_nest_end(msg, sinfoattr);
4431
4432         if (sinfo->assoc_req_ies_len &&
4433             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4434                     sinfo->assoc_req_ies))
4435                 goto nla_put_failure;
4436
4437         genlmsg_end(msg, hdr);
4438         return 0;
4439
4440  nla_put_failure:
4441         genlmsg_cancel(msg, hdr);
4442         return -EMSGSIZE;
4443 }
4444
4445 static int nl80211_dump_station(struct sk_buff *skb,
4446                                 struct netlink_callback *cb)
4447 {
4448         struct station_info sinfo;
4449         struct cfg80211_registered_device *rdev;
4450         struct wireless_dev *wdev;
4451         u8 mac_addr[ETH_ALEN];
4452         int sta_idx = cb->args[2];
4453         int err;
4454
4455         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4456         if (err)
4457                 return err;
4458
4459         if (!wdev->netdev) {
4460                 err = -EINVAL;
4461                 goto out_err;
4462         }
4463
4464         if (!rdev->ops->dump_station) {
4465                 err = -EOPNOTSUPP;
4466                 goto out_err;
4467         }
4468
4469         while (1) {
4470                 memset(&sinfo, 0, sizeof(sinfo));
4471                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4472                                         mac_addr, &sinfo);
4473                 if (err == -ENOENT)
4474                         break;
4475                 if (err)
4476                         goto out_err;
4477
4478                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4479                                 NETLINK_CB(cb->skb).portid,
4480                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4481                                 rdev, wdev->netdev, mac_addr,
4482                                 &sinfo) < 0)
4483                         goto out;
4484
4485                 sta_idx++;
4486         }
4487
4488  out:
4489         cb->args[2] = sta_idx;
4490         err = skb->len;
4491  out_err:
4492         nl80211_finish_wdev_dump(rdev);
4493
4494         return err;
4495 }
4496
4497 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4498 {
4499         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4500         struct net_device *dev = info->user_ptr[1];
4501         struct station_info sinfo;
4502         struct sk_buff *msg;
4503         u8 *mac_addr = NULL;
4504         int err;
4505
4506         memset(&sinfo, 0, sizeof(sinfo));
4507
4508         if (!info->attrs[NL80211_ATTR_MAC])
4509                 return -EINVAL;
4510
4511         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4512
4513         if (!rdev->ops->get_station)
4514                 return -EOPNOTSUPP;
4515
4516         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4517         if (err)
4518                 return err;
4519
4520         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4521         if (!msg)
4522                 return -ENOMEM;
4523
4524         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4525                                  info->snd_portid, info->snd_seq, 0,
4526                                  rdev, dev, mac_addr, &sinfo) < 0) {
4527                 nlmsg_free(msg);
4528                 return -ENOBUFS;
4529         }
4530
4531         return genlmsg_reply(msg, info);
4532 }
4533
4534 int cfg80211_check_station_change(struct wiphy *wiphy,
4535                                   struct station_parameters *params,
4536                                   enum cfg80211_station_type statype)
4537 {
4538         if (params->listen_interval != -1 &&
4539             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4540                 return -EINVAL;
4541
4542         if (params->support_p2p_ps != -1 &&
4543             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4544                 return -EINVAL;
4545
4546         if (params->aid &&
4547             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4548             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4549                 return -EINVAL;
4550
4551         /* When you run into this, adjust the code below for the new flag */
4552         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4553
4554         switch (statype) {
4555         case CFG80211_STA_MESH_PEER_KERNEL:
4556         case CFG80211_STA_MESH_PEER_USER:
4557                 /*
4558                  * No ignoring the TDLS flag here -- the userspace mesh
4559                  * code doesn't have the bug of including TDLS in the
4560                  * mask everywhere.
4561                  */
4562                 if (params->sta_flags_mask &
4563                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4564                                   BIT(NL80211_STA_FLAG_MFP) |
4565                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
4566                         return -EINVAL;
4567                 break;
4568         case CFG80211_STA_TDLS_PEER_SETUP:
4569         case CFG80211_STA_TDLS_PEER_ACTIVE:
4570                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4571                         return -EINVAL;
4572                 /* ignore since it can't change */
4573                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4574                 break;
4575         default:
4576                 /* disallow mesh-specific things */
4577                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4578                         return -EINVAL;
4579                 if (params->local_pm)
4580                         return -EINVAL;
4581                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4582                         return -EINVAL;
4583         }
4584
4585         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4586             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4587                 /* TDLS can't be set, ... */
4588                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4589                         return -EINVAL;
4590                 /*
4591                  * ... but don't bother the driver with it. This works around
4592                  * a hostapd/wpa_supplicant issue -- it always includes the
4593                  * TLDS_PEER flag in the mask even for AP mode.
4594                  */
4595                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4596         }
4597
4598         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4599             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4600                 /* reject other things that can't change */
4601                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4602                         return -EINVAL;
4603                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4604                         return -EINVAL;
4605                 if (params->supported_rates)
4606                         return -EINVAL;
4607                 if (params->ext_capab || params->ht_capa || params->vht_capa)
4608                         return -EINVAL;
4609         }
4610
4611         if (statype != CFG80211_STA_AP_CLIENT &&
4612             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4613                 if (params->vlan)
4614                         return -EINVAL;
4615         }
4616
4617         switch (statype) {
4618         case CFG80211_STA_AP_MLME_CLIENT:
4619                 /* Use this only for authorizing/unauthorizing a station */
4620                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4621                         return -EOPNOTSUPP;
4622                 break;
4623         case CFG80211_STA_AP_CLIENT:
4624         case CFG80211_STA_AP_CLIENT_UNASSOC:
4625                 /* accept only the listed bits */
4626                 if (params->sta_flags_mask &
4627                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4628                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4629                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4630                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4631                                   BIT(NL80211_STA_FLAG_WME) |
4632                                   BIT(NL80211_STA_FLAG_MFP)))
4633                         return -EINVAL;
4634
4635                 /* but authenticated/associated only if driver handles it */
4636                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4637                     params->sta_flags_mask &
4638                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4639                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4640                         return -EINVAL;
4641                 break;
4642         case CFG80211_STA_IBSS:
4643         case CFG80211_STA_AP_STA:
4644                 /* reject any changes other than AUTHORIZED */
4645                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4646                         return -EINVAL;
4647                 break;
4648         case CFG80211_STA_TDLS_PEER_SETUP:
4649                 /* reject any changes other than AUTHORIZED or WME */
4650                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4651                                                BIT(NL80211_STA_FLAG_WME)))
4652                         return -EINVAL;
4653                 /* force (at least) rates when authorizing */
4654                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4655                     !params->supported_rates)
4656                         return -EINVAL;
4657                 break;
4658         case CFG80211_STA_TDLS_PEER_ACTIVE:
4659                 /* reject any changes */
4660                 return -EINVAL;
4661         case CFG80211_STA_MESH_PEER_KERNEL:
4662                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4663                         return -EINVAL;
4664                 break;
4665         case CFG80211_STA_MESH_PEER_USER:
4666                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4667                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4668                         return -EINVAL;
4669                 break;
4670         }
4671
4672         /*
4673          * Older kernel versions ignored this attribute entirely, so don't
4674          * reject attempts to update it but mark it as unused instead so the
4675          * driver won't look at the data.
4676          */
4677         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
4678             statype != CFG80211_STA_TDLS_PEER_SETUP)
4679                 params->opmode_notif_used = false;
4680
4681         return 0;
4682 }
4683 EXPORT_SYMBOL(cfg80211_check_station_change);
4684
4685 /*
4686  * Get vlan interface making sure it is running and on the right wiphy.
4687  */
4688 static struct net_device *get_vlan(struct genl_info *info,
4689                                    struct cfg80211_registered_device *rdev)
4690 {
4691         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4692         struct net_device *v;
4693         int ret;
4694
4695         if (!vlanattr)
4696                 return NULL;
4697
4698         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4699         if (!v)
4700                 return ERR_PTR(-ENODEV);
4701
4702         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4703                 ret = -EINVAL;
4704                 goto error;
4705         }
4706
4707         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4708             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4709             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4710                 ret = -EINVAL;
4711                 goto error;
4712         }
4713
4714         if (!netif_running(v)) {
4715                 ret = -ENETDOWN;
4716                 goto error;
4717         }
4718
4719         return v;
4720  error:
4721         dev_put(v);
4722         return ERR_PTR(ret);
4723 }
4724
4725 static const struct nla_policy
4726 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4727         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4728         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4729 };
4730
4731 static int nl80211_parse_sta_wme(struct genl_info *info,
4732                                  struct station_parameters *params)
4733 {
4734         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4735         struct nlattr *nla;
4736         int err;
4737
4738         /* parse WME attributes if present */
4739         if (!info->attrs[NL80211_ATTR_STA_WME])
4740                 return 0;
4741
4742         nla = info->attrs[NL80211_ATTR_STA_WME];
4743         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4744                                nl80211_sta_wme_policy);
4745         if (err)
4746                 return err;
4747
4748         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4749                 params->uapsd_queues = nla_get_u8(
4750                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4751         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4752                 return -EINVAL;
4753
4754         if (tb[NL80211_STA_WME_MAX_SP])
4755                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4756
4757         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4758                 return -EINVAL;
4759
4760         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4761
4762         return 0;
4763 }
4764
4765 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4766                                       struct station_parameters *params)
4767 {
4768         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4769                 params->supported_channels =
4770                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4771                 params->supported_channels_len =
4772                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4773                 /*
4774                  * Need to include at least one (first channel, number of
4775                  * channels) tuple for each subband, and must have proper
4776                  * tuples for the rest of the data as well.
4777                  */
4778                 if (params->supported_channels_len < 2)
4779                         return -EINVAL;
4780                 if (params->supported_channels_len % 2)
4781                         return -EINVAL;
4782         }
4783
4784         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4785                 params->supported_oper_classes =
4786                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4787                 params->supported_oper_classes_len =
4788                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4789                 /*
4790                  * The value of the Length field of the Supported Operating
4791                  * Classes element is between 2 and 253.
4792                  */
4793                 if (params->supported_oper_classes_len < 2 ||
4794                     params->supported_oper_classes_len > 253)
4795                         return -EINVAL;
4796         }
4797         return 0;
4798 }
4799
4800 static int nl80211_set_station_tdls(struct genl_info *info,
4801                                     struct station_parameters *params)
4802 {
4803         int err;
4804         /* Dummy STA entry gets updated once the peer capabilities are known */
4805         if (info->attrs[NL80211_ATTR_PEER_AID])
4806                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4807         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4808                 params->ht_capa =
4809                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4810         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4811                 params->vht_capa =
4812                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4813
4814         err = nl80211_parse_sta_channel_info(info, params);
4815         if (err)
4816                 return err;
4817
4818         return nl80211_parse_sta_wme(info, params);
4819 }
4820
4821 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4822 {
4823         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4824         struct net_device *dev = info->user_ptr[1];
4825         struct station_parameters params;
4826         u8 *mac_addr;
4827         int err;
4828
4829         memset(&params, 0, sizeof(params));
4830
4831         if (!rdev->ops->change_station)
4832                 return -EOPNOTSUPP;
4833
4834         /*
4835          * AID and listen_interval properties can be set only for unassociated
4836          * station. Include these parameters here and will check them in
4837          * cfg80211_check_station_change().
4838          */
4839         if (info->attrs[NL80211_ATTR_STA_AID])
4840                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4841
4842         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4843                 params.listen_interval =
4844                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4845         else
4846                 params.listen_interval = -1;
4847
4848         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4849                 u8 tmp;
4850
4851                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4852                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4853                         return -EINVAL;
4854
4855                 params.support_p2p_ps = tmp;
4856         } else {
4857                 params.support_p2p_ps = -1;
4858         }
4859
4860         if (!info->attrs[NL80211_ATTR_MAC])
4861                 return -EINVAL;
4862
4863         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4864
4865         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4866                 params.supported_rates =
4867                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4868                 params.supported_rates_len =
4869                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4870         }
4871
4872         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4873                 params.capability =
4874                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4875                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4876         }
4877
4878         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4879                 params.ext_capab =
4880                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4881                 params.ext_capab_len =
4882                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4883         }
4884
4885         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4886                 return -EINVAL;
4887
4888         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4889                 params.plink_action =
4890                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4891                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4892                         return -EINVAL;
4893         }
4894
4895         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4896                 params.plink_state =
4897                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4898                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4899                         return -EINVAL;
4900                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
4901                         params.peer_aid = nla_get_u16(
4902                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
4903                         if (params.peer_aid > IEEE80211_MAX_AID)
4904                                 return -EINVAL;
4905                 }
4906                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4907         }
4908
4909         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4910                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4911                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4912
4913                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4914                     pm > NL80211_MESH_POWER_MAX)
4915                         return -EINVAL;
4916
4917                 params.local_pm = pm;
4918         }
4919
4920         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4921                 params.opmode_notif_used = true;
4922                 params.opmode_notif =
4923                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4924         }
4925
4926         /* Include parameters for TDLS peer (will check later) */
4927         err = nl80211_set_station_tdls(info, &params);
4928         if (err)
4929                 return err;
4930
4931         params.vlan = get_vlan(info, rdev);
4932         if (IS_ERR(params.vlan))
4933                 return PTR_ERR(params.vlan);
4934
4935         switch (dev->ieee80211_ptr->iftype) {
4936         case NL80211_IFTYPE_AP:
4937         case NL80211_IFTYPE_AP_VLAN:
4938         case NL80211_IFTYPE_P2P_GO:
4939         case NL80211_IFTYPE_P2P_CLIENT:
4940         case NL80211_IFTYPE_STATION:
4941         case NL80211_IFTYPE_ADHOC:
4942         case NL80211_IFTYPE_MESH_POINT:
4943                 break;
4944         default:
4945                 err = -EOPNOTSUPP;
4946                 goto out_put_vlan;
4947         }
4948
4949         /* driver will call cfg80211_check_station_change() */
4950         err = rdev_change_station(rdev, dev, mac_addr, &params);
4951
4952  out_put_vlan:
4953         if (params.vlan)
4954                 dev_put(params.vlan);
4955
4956         return err;
4957 }
4958
4959 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4960 {
4961         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4962         int err;
4963         struct net_device *dev = info->user_ptr[1];
4964         struct station_parameters params;
4965         u8 *mac_addr = NULL;
4966         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4967                          BIT(NL80211_STA_FLAG_ASSOCIATED);
4968
4969         memset(&params, 0, sizeof(params));
4970
4971         if (!rdev->ops->add_station)
4972                 return -EOPNOTSUPP;
4973
4974         if (!info->attrs[NL80211_ATTR_MAC])
4975                 return -EINVAL;
4976
4977         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4978                 return -EINVAL;
4979
4980         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4981                 return -EINVAL;
4982
4983         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4984             !info->attrs[NL80211_ATTR_PEER_AID])
4985                 return -EINVAL;
4986
4987         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4988         params.supported_rates =
4989                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4990         params.supported_rates_len =
4991                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4992         params.listen_interval =
4993                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4994
4995         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4996                 u8 tmp;
4997
4998                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4999                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5000                         return -EINVAL;
5001
5002                 params.support_p2p_ps = tmp;
5003         } else {
5004                 /*
5005                  * if not specified, assume it's supported for P2P GO interface,
5006                  * and is NOT supported for AP interface
5007                  */
5008                 params.support_p2p_ps =
5009                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5010         }
5011
5012         if (info->attrs[NL80211_ATTR_PEER_AID])
5013                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5014         else
5015                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5016         if (!params.aid || params.aid > IEEE80211_MAX_AID)
5017                 return -EINVAL;
5018
5019         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5020                 params.capability =
5021                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5022                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5023         }
5024
5025         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5026                 params.ext_capab =
5027                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5028                 params.ext_capab_len =
5029                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5030         }
5031
5032         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5033                 params.ht_capa =
5034                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5035
5036         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5037                 params.vht_capa =
5038                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5039
5040         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5041                 params.opmode_notif_used = true;
5042                 params.opmode_notif =
5043                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5044         }
5045
5046         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5047                 params.plink_action =
5048                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5049                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5050                         return -EINVAL;
5051         }
5052
5053         err = nl80211_parse_sta_channel_info(info, &params);
5054         if (err)
5055                 return err;
5056
5057         err = nl80211_parse_sta_wme(info, &params);
5058         if (err)
5059                 return err;
5060
5061         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5062                 return -EINVAL;
5063
5064         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5065          * as userspace might just pass through the capabilities from the IEs
5066          * directly, rather than enforcing this restriction and returning an
5067          * error in this case.
5068          */
5069         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5070                 params.ht_capa = NULL;
5071                 params.vht_capa = NULL;
5072         }
5073
5074         /* When you run into this, adjust the code below for the new flag */
5075         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5076
5077         switch (dev->ieee80211_ptr->iftype) {
5078         case NL80211_IFTYPE_AP:
5079         case NL80211_IFTYPE_AP_VLAN:
5080         case NL80211_IFTYPE_P2P_GO:
5081                 /* ignore WME attributes if iface/sta is not capable */
5082                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5083                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5084                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5085
5086                 /* TDLS peers cannot be added */
5087                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5088                     info->attrs[NL80211_ATTR_PEER_AID])
5089                         return -EINVAL;
5090                 /* but don't bother the driver with it */
5091                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5092
5093                 /* allow authenticated/associated only if driver handles it */
5094                 if (!(rdev->wiphy.features &
5095                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5096                     params.sta_flags_mask & auth_assoc)
5097                         return -EINVAL;
5098
5099                 /* Older userspace, or userspace wanting to be compatible with
5100                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5101                  * and assoc flags in the mask, but assumes the station will be
5102                  * added as associated anyway since this was the required driver
5103                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5104                  * introduced.
5105                  * In order to not bother drivers with this quirk in the API
5106                  * set the flags in both the mask and set for new stations in
5107                  * this case.
5108                  */
5109                 if (!(params.sta_flags_mask & auth_assoc)) {
5110                         params.sta_flags_mask |= auth_assoc;
5111                         params.sta_flags_set |= auth_assoc;
5112                 }
5113
5114                 /* must be last in here for error handling */
5115                 params.vlan = get_vlan(info, rdev);
5116                 if (IS_ERR(params.vlan))
5117                         return PTR_ERR(params.vlan);
5118                 break;
5119         case NL80211_IFTYPE_MESH_POINT:
5120                 /* ignore uAPSD data */
5121                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5122
5123                 /* associated is disallowed */
5124                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5125                         return -EINVAL;
5126                 /* TDLS peers cannot be added */
5127                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5128                     info->attrs[NL80211_ATTR_PEER_AID])
5129                         return -EINVAL;
5130                 break;
5131         case NL80211_IFTYPE_STATION:
5132         case NL80211_IFTYPE_P2P_CLIENT:
5133                 /* ignore uAPSD data */
5134                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5135
5136                 /* these are disallowed */
5137                 if (params.sta_flags_mask &
5138                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5139                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5140                         return -EINVAL;
5141                 /* Only TDLS peers can be added */
5142                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5143                         return -EINVAL;
5144                 /* Can only add if TDLS ... */
5145                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5146                         return -EOPNOTSUPP;
5147                 /* ... with external setup is supported */
5148                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5149                         return -EOPNOTSUPP;
5150                 /*
5151                  * Older wpa_supplicant versions always mark the TDLS peer
5152                  * as authorized, but it shouldn't yet be.
5153                  */
5154                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5155                 break;
5156         default:
5157                 return -EOPNOTSUPP;
5158         }
5159
5160         /* be aware of params.vlan when changing code here */
5161
5162         err = rdev_add_station(rdev, dev, mac_addr, &params);
5163
5164         if (params.vlan)
5165                 dev_put(params.vlan);
5166         return err;
5167 }
5168
5169 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5170 {
5171         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5172         struct net_device *dev = info->user_ptr[1];
5173         struct station_del_parameters params;
5174
5175         memset(&params, 0, sizeof(params));
5176
5177         if (info->attrs[NL80211_ATTR_MAC])
5178                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5179
5180         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5181             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5182             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5183             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5184                 return -EINVAL;
5185
5186         if (!rdev->ops->del_station)
5187                 return -EOPNOTSUPP;
5188
5189         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5190                 params.subtype =
5191                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5192                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5193                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5194                         return -EINVAL;
5195         } else {
5196                 /* Default to Deauthentication frame */
5197                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5198         }
5199
5200         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5201                 params.reason_code =
5202                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5203                 if (params.reason_code == 0)
5204                         return -EINVAL; /* 0 is reserved */
5205         } else {
5206                 /* Default to reason code 2 */
5207                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5208         }
5209
5210         return rdev_del_station(rdev, dev, &params);
5211 }
5212
5213 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5214                                 int flags, struct net_device *dev,
5215                                 u8 *dst, u8 *next_hop,
5216                                 struct mpath_info *pinfo)
5217 {
5218         void *hdr;
5219         struct nlattr *pinfoattr;
5220
5221         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5222         if (!hdr)
5223                 return -1;
5224
5225         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5226             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5227             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5228             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5229                 goto nla_put_failure;
5230
5231         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5232         if (!pinfoattr)
5233                 goto nla_put_failure;
5234         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5235             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5236                         pinfo->frame_qlen))
5237                 goto nla_put_failure;
5238         if (((pinfo->filled & MPATH_INFO_SN) &&
5239              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5240             ((pinfo->filled & MPATH_INFO_METRIC) &&
5241              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5242                          pinfo->metric)) ||
5243             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5244              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5245                          pinfo->exptime)) ||
5246             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5247              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5248                         pinfo->flags)) ||
5249             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5250              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5251                          pinfo->discovery_timeout)) ||
5252             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5253              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5254                         pinfo->discovery_retries)))
5255                 goto nla_put_failure;
5256
5257         nla_nest_end(msg, pinfoattr);
5258
5259         genlmsg_end(msg, hdr);
5260         return 0;
5261
5262  nla_put_failure:
5263         genlmsg_cancel(msg, hdr);
5264         return -EMSGSIZE;
5265 }
5266
5267 static int nl80211_dump_mpath(struct sk_buff *skb,
5268                               struct netlink_callback *cb)
5269 {
5270         struct mpath_info pinfo;
5271         struct cfg80211_registered_device *rdev;
5272         struct wireless_dev *wdev;
5273         u8 dst[ETH_ALEN];
5274         u8 next_hop[ETH_ALEN];
5275         int path_idx = cb->args[2];
5276         int err;
5277
5278         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5279         if (err)
5280                 return err;
5281
5282         if (!rdev->ops->dump_mpath) {
5283                 err = -EOPNOTSUPP;
5284                 goto out_err;
5285         }
5286
5287         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5288                 err = -EOPNOTSUPP;
5289                 goto out_err;
5290         }
5291
5292         while (1) {
5293                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5294                                       next_hop, &pinfo);
5295                 if (err == -ENOENT)
5296                         break;
5297                 if (err)
5298                         goto out_err;
5299
5300                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5301                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5302                                        wdev->netdev, dst, next_hop,
5303                                        &pinfo) < 0)
5304                         goto out;
5305
5306                 path_idx++;
5307         }
5308
5309  out:
5310         cb->args[2] = path_idx;
5311         err = skb->len;
5312  out_err:
5313         nl80211_finish_wdev_dump(rdev);
5314         return err;
5315 }
5316
5317 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5318 {
5319         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5320         int err;
5321         struct net_device *dev = info->user_ptr[1];
5322         struct mpath_info pinfo;
5323         struct sk_buff *msg;
5324         u8 *dst = NULL;
5325         u8 next_hop[ETH_ALEN];
5326
5327         memset(&pinfo, 0, sizeof(pinfo));
5328
5329         if (!info->attrs[NL80211_ATTR_MAC])
5330                 return -EINVAL;
5331
5332         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5333
5334         if (!rdev->ops->get_mpath)
5335                 return -EOPNOTSUPP;
5336
5337         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5338                 return -EOPNOTSUPP;
5339
5340         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5341         if (err)
5342                 return err;
5343
5344         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5345         if (!msg)
5346                 return -ENOMEM;
5347
5348         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5349                                  dev, dst, next_hop, &pinfo) < 0) {
5350                 nlmsg_free(msg);
5351                 return -ENOBUFS;
5352         }
5353
5354         return genlmsg_reply(msg, info);
5355 }
5356
5357 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5358 {
5359         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5360         struct net_device *dev = info->user_ptr[1];
5361         u8 *dst = NULL;
5362         u8 *next_hop = NULL;
5363
5364         if (!info->attrs[NL80211_ATTR_MAC])
5365                 return -EINVAL;
5366
5367         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5368                 return -EINVAL;
5369
5370         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5371         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5372
5373         if (!rdev->ops->change_mpath)
5374                 return -EOPNOTSUPP;
5375
5376         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5377                 return -EOPNOTSUPP;
5378
5379         return rdev_change_mpath(rdev, dev, dst, next_hop);
5380 }
5381
5382 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5383 {
5384         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5385         struct net_device *dev = info->user_ptr[1];
5386         u8 *dst = NULL;
5387         u8 *next_hop = NULL;
5388
5389         if (!info->attrs[NL80211_ATTR_MAC])
5390                 return -EINVAL;
5391
5392         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5393                 return -EINVAL;
5394
5395         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5396         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5397
5398         if (!rdev->ops->add_mpath)
5399                 return -EOPNOTSUPP;
5400
5401         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5402                 return -EOPNOTSUPP;
5403
5404         return rdev_add_mpath(rdev, dev, dst, next_hop);
5405 }
5406
5407 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5408 {
5409         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5410         struct net_device *dev = info->user_ptr[1];
5411         u8 *dst = NULL;
5412
5413         if (info->attrs[NL80211_ATTR_MAC])
5414                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5415
5416         if (!rdev->ops->del_mpath)
5417                 return -EOPNOTSUPP;
5418
5419         return rdev_del_mpath(rdev, dev, dst);
5420 }
5421
5422 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5423 {
5424         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5425         int err;
5426         struct net_device *dev = info->user_ptr[1];
5427         struct mpath_info pinfo;
5428         struct sk_buff *msg;
5429         u8 *dst = NULL;
5430         u8 mpp[ETH_ALEN];
5431
5432         memset(&pinfo, 0, sizeof(pinfo));
5433
5434         if (!info->attrs[NL80211_ATTR_MAC])
5435                 return -EINVAL;
5436
5437         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5438
5439         if (!rdev->ops->get_mpp)
5440                 return -EOPNOTSUPP;
5441
5442         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5443                 return -EOPNOTSUPP;
5444
5445         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5446         if (err)
5447                 return err;
5448
5449         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5450         if (!msg)
5451                 return -ENOMEM;
5452
5453         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5454                                dev, dst, mpp, &pinfo) < 0) {
5455                 nlmsg_free(msg);
5456                 return -ENOBUFS;
5457         }
5458
5459         return genlmsg_reply(msg, info);
5460 }
5461
5462 static int nl80211_dump_mpp(struct sk_buff *skb,
5463                             struct netlink_callback *cb)
5464 {
5465         struct mpath_info pinfo;
5466         struct cfg80211_registered_device *rdev;
5467         struct wireless_dev *wdev;
5468         u8 dst[ETH_ALEN];
5469         u8 mpp[ETH_ALEN];
5470         int path_idx = cb->args[2];
5471         int err;
5472
5473         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5474         if (err)
5475                 return err;
5476
5477         if (!rdev->ops->dump_mpp) {
5478                 err = -EOPNOTSUPP;
5479                 goto out_err;
5480         }
5481
5482         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5483                 err = -EOPNOTSUPP;
5484                 goto out_err;
5485         }
5486
5487         while (1) {
5488                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5489                                     mpp, &pinfo);
5490                 if (err == -ENOENT)
5491                         break;
5492                 if (err)
5493                         goto out_err;
5494
5495                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5496                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5497                                        wdev->netdev, dst, mpp,
5498                                        &pinfo) < 0)
5499                         goto out;
5500
5501                 path_idx++;
5502         }
5503
5504  out:
5505         cb->args[2] = path_idx;
5506         err = skb->len;
5507  out_err:
5508         nl80211_finish_wdev_dump(rdev);
5509         return err;
5510 }
5511
5512 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5513 {
5514         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5515         struct net_device *dev = info->user_ptr[1];
5516         struct wireless_dev *wdev = dev->ieee80211_ptr;
5517         struct bss_parameters params;
5518         int err;
5519
5520         memset(&params, 0, sizeof(params));
5521         /* default to not changing parameters */
5522         params.use_cts_prot = -1;
5523         params.use_short_preamble = -1;
5524         params.use_short_slot_time = -1;
5525         params.ap_isolate = -1;
5526         params.ht_opmode = -1;
5527         params.p2p_ctwindow = -1;
5528         params.p2p_opp_ps = -1;
5529
5530         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5531                 params.use_cts_prot =
5532                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5533         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5534                 params.use_short_preamble =
5535                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5536         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5537                 params.use_short_slot_time =
5538                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5539         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5540                 params.basic_rates =
5541                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5542                 params.basic_rates_len =
5543                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5544         }
5545         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5546                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5547         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5548                 params.ht_opmode =
5549                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5550
5551         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5552                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5553                         return -EINVAL;
5554                 params.p2p_ctwindow =
5555                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5556                 if (params.p2p_ctwindow < 0)
5557                         return -EINVAL;
5558                 if (params.p2p_ctwindow != 0 &&
5559                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5560                         return -EINVAL;
5561         }
5562
5563         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5564                 u8 tmp;
5565
5566                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5567                         return -EINVAL;
5568                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5569                 if (tmp > 1)
5570                         return -EINVAL;
5571                 params.p2p_opp_ps = tmp;
5572                 if (params.p2p_opp_ps &&
5573                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5574                         return -EINVAL;
5575         }
5576
5577         if (!rdev->ops->change_bss)
5578                 return -EOPNOTSUPP;
5579
5580         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5581             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5582                 return -EOPNOTSUPP;
5583
5584         wdev_lock(wdev);
5585         err = rdev_change_bss(rdev, dev, &params);
5586         wdev_unlock(wdev);
5587
5588         return err;
5589 }
5590
5591 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5592 {
5593         char *data = NULL;
5594         bool is_indoor;
5595         enum nl80211_user_reg_hint_type user_reg_hint_type;
5596         u32 owner_nlportid;
5597
5598         /*
5599          * You should only get this when cfg80211 hasn't yet initialized
5600          * completely when built-in to the kernel right between the time
5601          * window between nl80211_init() and regulatory_init(), if that is
5602          * even possible.
5603          */
5604         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5605                 return -EINPROGRESS;
5606
5607         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5608                 user_reg_hint_type =
5609                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5610         else
5611                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5612
5613         switch (user_reg_hint_type) {
5614         case NL80211_USER_REG_HINT_USER:
5615         case NL80211_USER_REG_HINT_CELL_BASE:
5616                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5617                         return -EINVAL;
5618
5619                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5620                 return regulatory_hint_user(data, user_reg_hint_type);
5621         case NL80211_USER_REG_HINT_INDOOR:
5622                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5623                         owner_nlportid = info->snd_portid;
5624                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5625                 } else {
5626                         owner_nlportid = 0;
5627                         is_indoor = true;
5628                 }
5629
5630                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
5631         default:
5632                 return -EINVAL;
5633         }
5634 }
5635
5636 static int nl80211_get_mesh_config(struct sk_buff *skb,
5637                                    struct genl_info *info)
5638 {
5639         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5640         struct net_device *dev = info->user_ptr[1];
5641         struct wireless_dev *wdev = dev->ieee80211_ptr;
5642         struct mesh_config cur_params;
5643         int err = 0;
5644         void *hdr;
5645         struct nlattr *pinfoattr;
5646         struct sk_buff *msg;
5647
5648         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5649                 return -EOPNOTSUPP;
5650
5651         if (!rdev->ops->get_mesh_config)
5652                 return -EOPNOTSUPP;
5653
5654         wdev_lock(wdev);
5655         /* If not connected, get default parameters */
5656         if (!wdev->mesh_id_len)
5657                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5658         else
5659                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5660         wdev_unlock(wdev);
5661
5662         if (err)
5663                 return err;
5664
5665         /* Draw up a netlink message to send back */
5666         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5667         if (!msg)
5668                 return -ENOMEM;
5669         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5670                              NL80211_CMD_GET_MESH_CONFIG);
5671         if (!hdr)
5672                 goto out;
5673         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5674         if (!pinfoattr)
5675                 goto nla_put_failure;
5676         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5677             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5678                         cur_params.dot11MeshRetryTimeout) ||
5679             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5680                         cur_params.dot11MeshConfirmTimeout) ||
5681             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5682                         cur_params.dot11MeshHoldingTimeout) ||
5683             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5684                         cur_params.dot11MeshMaxPeerLinks) ||
5685             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5686                        cur_params.dot11MeshMaxRetries) ||
5687             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5688                        cur_params.dot11MeshTTL) ||
5689             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5690                        cur_params.element_ttl) ||
5691             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5692                        cur_params.auto_open_plinks) ||
5693             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5694                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5695             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5696                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5697             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5698                         cur_params.path_refresh_time) ||
5699             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5700                         cur_params.min_discovery_timeout) ||
5701             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5702                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5703             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5704                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5705             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5706                         cur_params.dot11MeshHWMPperrMinInterval) ||
5707             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5708                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5709             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5710                        cur_params.dot11MeshHWMPRootMode) ||
5711             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5712                         cur_params.dot11MeshHWMPRannInterval) ||
5713             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5714                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5715             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5716                        cur_params.dot11MeshForwarding) ||
5717             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5718                         cur_params.rssi_threshold) ||
5719             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5720                         cur_params.ht_opmode) ||
5721             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5722                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5723             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5724                         cur_params.dot11MeshHWMProotInterval) ||
5725             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5726                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5727             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5728                         cur_params.power_mode) ||
5729             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5730                         cur_params.dot11MeshAwakeWindowDuration) ||
5731             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5732                         cur_params.plink_timeout))
5733                 goto nla_put_failure;
5734         nla_nest_end(msg, pinfoattr);
5735         genlmsg_end(msg, hdr);
5736         return genlmsg_reply(msg, info);
5737
5738  nla_put_failure:
5739         genlmsg_cancel(msg, hdr);
5740  out:
5741         nlmsg_free(msg);
5742         return -ENOBUFS;
5743 }
5744
5745 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5746         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5747         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5748         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5749         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5750         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5751         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5752         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5753         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5754         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5755         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5756         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5757         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5758         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5759         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5760         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5761         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5762         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5763         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5764         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5765         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5766         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5767         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5768         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5769         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5770         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5771         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5772         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5773         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5774 };
5775
5776 static const struct nla_policy
5777         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5778         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5779         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5780         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5781         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5782         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5783         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5784         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5785                                     .len = IEEE80211_MAX_DATA_LEN },
5786         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5787 };
5788
5789 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
5790 {
5791         u8 val = nla_get_u8(nla);
5792         if (val < min || val > max)
5793                 return -EINVAL;
5794         *out = val;
5795         return 0;
5796 }
5797
5798 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
5799 {
5800         u8 val = nla_get_u8(nla);
5801         if (val < min || val > max)
5802                 return -EINVAL;
5803         *out = val;
5804         return 0;
5805 }
5806
5807 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
5808 {
5809         u16 val = nla_get_u16(nla);
5810         if (val < min || val > max)
5811                 return -EINVAL;
5812         *out = val;
5813         return 0;
5814 }
5815
5816 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
5817 {
5818         u32 val = nla_get_u32(nla);
5819         if (val < min || val > max)
5820                 return -EINVAL;
5821         *out = val;
5822         return 0;
5823 }
5824
5825 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
5826 {
5827         s32 val = nla_get_s32(nla);
5828         if (val < min || val > max)
5829                 return -EINVAL;
5830         *out = val;
5831         return 0;
5832 }
5833
5834 static int nl80211_check_power_mode(const struct nlattr *nla,
5835                                     enum nl80211_mesh_power_mode min,
5836                                     enum nl80211_mesh_power_mode max,
5837                                     enum nl80211_mesh_power_mode *out)
5838 {
5839         u32 val = nla_get_u32(nla);
5840         if (val < min || val > max)
5841                 return -EINVAL;
5842         *out = val;
5843         return 0;
5844 }
5845
5846 static int nl80211_parse_mesh_config(struct genl_info *info,
5847                                      struct mesh_config *cfg,
5848                                      u32 *mask_out)
5849 {
5850         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5851         u32 mask = 0;
5852         u16 ht_opmode;
5853
5854 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5855 do {                                                                        \
5856         if (tb[attr]) {                                                     \
5857                 if (fn(tb[attr], min, max, &cfg->param))                    \
5858                         return -EINVAL;                                     \
5859                 mask |= (1 << (attr - 1));                                  \
5860         }                                                                   \
5861 } while (0)
5862
5863         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5864                 return -EINVAL;
5865         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5866                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5867                              nl80211_meshconf_params_policy))
5868                 return -EINVAL;
5869
5870         /* This makes sure that there aren't more than 32 mesh config
5871          * parameters (otherwise our bitfield scheme would not work.) */
5872         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5873
5874         /* Fill in the params struct */
5875         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5876                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5877                                   nl80211_check_u16);
5878         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5879                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5880                                   nl80211_check_u16);
5881         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5882                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5883                                   nl80211_check_u16);
5884         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5885                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5886                                   nl80211_check_u16);
5887         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5888                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5889                                   nl80211_check_u8);
5890         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5891                                   mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
5892         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5893                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5894                                   nl80211_check_u8);
5895         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5896                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5897                                   nl80211_check_bool);
5898         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5899                                   1, 255, mask,
5900                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5901                                   nl80211_check_u32);
5902         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5903                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5904                                   nl80211_check_u8);
5905         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5906                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5907                                   nl80211_check_u32);
5908         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5909                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5910                                   nl80211_check_u16);
5911         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5912                                   1, 65535, mask,
5913                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5914                                   nl80211_check_u32);
5915         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5916                                   1, 65535, mask,
5917                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5918                                   nl80211_check_u16);
5919         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5920                                   1, 65535, mask,
5921                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5922                                   nl80211_check_u16);
5923         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5924                                   dot11MeshHWMPnetDiameterTraversalTime,
5925                                   1, 65535, mask,
5926                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5927                                   nl80211_check_u16);
5928         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5929                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5930                                   nl80211_check_u8);
5931         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5932                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5933                                   nl80211_check_u16);
5934         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5935                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5936                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5937                                   nl80211_check_bool);
5938         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5939                                   mask, NL80211_MESHCONF_FORWARDING,
5940                                   nl80211_check_bool);
5941         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5942                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5943                                   nl80211_check_s32);
5944         /*
5945          * Check HT operation mode based on
5946          * IEEE 802.11 2012 8.4.2.59 HT Operation element.
5947          */
5948         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
5949                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
5950
5951                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
5952                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
5953                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5954                         return -EINVAL;
5955
5956                 if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
5957                     (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5958                         return -EINVAL;
5959
5960                 switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
5961                 case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
5962                 case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
5963                         if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
5964                                 return -EINVAL;
5965                         break;
5966                 case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
5967                 case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
5968                         if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5969                                 return -EINVAL;
5970                         break;
5971                 }
5972                 cfg->ht_opmode = ht_opmode;
5973                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
5974         }
5975         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5976                                   1, 65535, mask,
5977                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5978                                   nl80211_check_u32);
5979         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5980                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5981                                   nl80211_check_u16);
5982         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5983                                   dot11MeshHWMPconfirmationInterval,
5984                                   1, 65535, mask,
5985                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5986                                   nl80211_check_u16);
5987         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5988                                   NL80211_MESH_POWER_ACTIVE,
5989                                   NL80211_MESH_POWER_MAX,
5990                                   mask, NL80211_MESHCONF_POWER_MODE,
5991                                   nl80211_check_power_mode);
5992         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5993                                   0, 65535, mask,
5994                                   NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
5995         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
5996                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5997                                   nl80211_check_u32);
5998         if (mask_out)
5999                 *mask_out = mask;
6000
6001         return 0;
6002
6003 #undef FILL_IN_MESH_PARAM_IF_SET
6004 }
6005
6006 static int nl80211_parse_mesh_setup(struct genl_info *info,
6007                                      struct mesh_setup *setup)
6008 {
6009         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6010         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6011
6012         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6013                 return -EINVAL;
6014         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6015                              info->attrs[NL80211_ATTR_MESH_SETUP],
6016                              nl80211_mesh_setup_params_policy))
6017                 return -EINVAL;
6018
6019         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6020                 setup->sync_method =
6021                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6022                  IEEE80211_SYNC_METHOD_VENDOR :
6023                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6024
6025         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6026                 setup->path_sel_proto =
6027                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6028                  IEEE80211_PATH_PROTOCOL_VENDOR :
6029                  IEEE80211_PATH_PROTOCOL_HWMP;
6030
6031         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6032                 setup->path_metric =
6033                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6034                  IEEE80211_PATH_METRIC_VENDOR :
6035                  IEEE80211_PATH_METRIC_AIRTIME;
6036
6037         if (tb[NL80211_MESH_SETUP_IE]) {
6038                 struct nlattr *ieattr =
6039                         tb[NL80211_MESH_SETUP_IE];
6040                 if (!is_valid_ie_attr(ieattr))
6041                         return -EINVAL;
6042                 setup->ie = nla_data(ieattr);
6043                 setup->ie_len = nla_len(ieattr);
6044         }
6045         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6046             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6047                 return -EINVAL;
6048         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6049         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6050         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6051         if (setup->is_secure)
6052                 setup->user_mpm = true;
6053
6054         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6055                 if (!setup->user_mpm)
6056                         return -EINVAL;
6057                 setup->auth_id =
6058                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6059         }
6060
6061         return 0;
6062 }
6063
6064 static int nl80211_update_mesh_config(struct sk_buff *skb,
6065                                       struct genl_info *info)
6066 {
6067         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6068         struct net_device *dev = info->user_ptr[1];
6069         struct wireless_dev *wdev = dev->ieee80211_ptr;
6070         struct mesh_config cfg;
6071         u32 mask;
6072         int err;
6073
6074         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6075                 return -EOPNOTSUPP;
6076
6077         if (!rdev->ops->update_mesh_config)
6078                 return -EOPNOTSUPP;
6079
6080         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6081         if (err)
6082                 return err;
6083
6084         wdev_lock(wdev);
6085         if (!wdev->mesh_id_len)
6086                 err = -ENOLINK;
6087
6088         if (!err)
6089                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6090
6091         wdev_unlock(wdev);
6092
6093         return err;
6094 }
6095
6096 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6097                               struct sk_buff *msg)
6098 {
6099         struct nlattr *nl_reg_rules;
6100         unsigned int i;
6101
6102         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6103             (regdom->dfs_region &&
6104              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6105                 goto nla_put_failure;
6106
6107         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6108         if (!nl_reg_rules)
6109                 goto nla_put_failure;
6110
6111         for (i = 0; i < regdom->n_reg_rules; i++) {
6112                 struct nlattr *nl_reg_rule;
6113                 const struct ieee80211_reg_rule *reg_rule;
6114                 const struct ieee80211_freq_range *freq_range;
6115                 const struct ieee80211_power_rule *power_rule;
6116                 unsigned int max_bandwidth_khz;
6117
6118                 reg_rule = &regdom->reg_rules[i];
6119                 freq_range = &reg_rule->freq_range;
6120                 power_rule = &reg_rule->power_rule;
6121
6122                 nl_reg_rule = nla_nest_start(msg, i);
6123                 if (!nl_reg_rule)
6124                         goto nla_put_failure;
6125
6126                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6127                 if (!max_bandwidth_khz)
6128                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6129                                                                   reg_rule);
6130
6131                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6132                                 reg_rule->flags) ||
6133                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6134                                 freq_range->start_freq_khz) ||
6135                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6136                                 freq_range->end_freq_khz) ||
6137                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6138                                 max_bandwidth_khz) ||
6139                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6140                                 power_rule->max_antenna_gain) ||
6141                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6142                                 power_rule->max_eirp) ||
6143                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6144                                 reg_rule->dfs_cac_ms))
6145                         goto nla_put_failure;
6146
6147                 nla_nest_end(msg, nl_reg_rule);
6148         }
6149
6150         nla_nest_end(msg, nl_reg_rules);
6151         return 0;
6152
6153 nla_put_failure:
6154         return -EMSGSIZE;
6155 }
6156
6157 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6158 {
6159         const struct ieee80211_regdomain *regdom = NULL;
6160         struct cfg80211_registered_device *rdev;
6161         struct wiphy *wiphy = NULL;
6162         struct sk_buff *msg;
6163         void *hdr;
6164
6165         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6166         if (!msg)
6167                 return -ENOBUFS;
6168
6169         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6170                              NL80211_CMD_GET_REG);
6171         if (!hdr)
6172                 goto put_failure;
6173
6174         if (info->attrs[NL80211_ATTR_WIPHY]) {
6175                 bool self_managed;
6176
6177                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6178                 if (IS_ERR(rdev)) {
6179                         nlmsg_free(msg);
6180                         return PTR_ERR(rdev);
6181                 }
6182
6183                 wiphy = &rdev->wiphy;
6184                 self_managed = wiphy->regulatory_flags &
6185                                REGULATORY_WIPHY_SELF_MANAGED;
6186                 regdom = get_wiphy_regdom(wiphy);
6187
6188                 /* a self-managed-reg device must have a private regdom */
6189                 if (WARN_ON(!regdom && self_managed)) {
6190                         nlmsg_free(msg);
6191                         return -EINVAL;
6192                 }
6193
6194                 if (regdom &&
6195                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6196                         goto nla_put_failure;
6197         }
6198
6199         if (!wiphy && reg_last_request_cell_base() &&
6200             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6201                         NL80211_USER_REG_HINT_CELL_BASE))
6202                 goto nla_put_failure;
6203
6204         rcu_read_lock();
6205
6206         if (!regdom)
6207                 regdom = rcu_dereference(cfg80211_regdomain);
6208
6209         if (nl80211_put_regdom(regdom, msg))
6210                 goto nla_put_failure_rcu;
6211
6212         rcu_read_unlock();
6213
6214         genlmsg_end(msg, hdr);
6215         return genlmsg_reply(msg, info);
6216
6217 nla_put_failure_rcu:
6218         rcu_read_unlock();
6219 nla_put_failure:
6220         genlmsg_cancel(msg, hdr);
6221 put_failure:
6222         nlmsg_free(msg);
6223         return -EMSGSIZE;
6224 }
6225
6226 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6227                                u32 seq, int flags, struct wiphy *wiphy,
6228                                const struct ieee80211_regdomain *regdom)
6229 {
6230         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6231                                    NL80211_CMD_GET_REG);
6232
6233         if (!hdr)
6234                 return -1;
6235
6236         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6237
6238         if (nl80211_put_regdom(regdom, msg))
6239                 goto nla_put_failure;
6240
6241         if (!wiphy && reg_last_request_cell_base() &&
6242             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6243                         NL80211_USER_REG_HINT_CELL_BASE))
6244                 goto nla_put_failure;
6245
6246         if (wiphy &&
6247             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6248                 goto nla_put_failure;
6249
6250         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6251             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6252                 goto nla_put_failure;
6253
6254         genlmsg_end(msg, hdr);
6255         return 0;
6256
6257 nla_put_failure:
6258         genlmsg_cancel(msg, hdr);
6259         return -EMSGSIZE;
6260 }
6261
6262 static int nl80211_get_reg_dump(struct sk_buff *skb,
6263                                 struct netlink_callback *cb)
6264 {
6265         const struct ieee80211_regdomain *regdom = NULL;
6266         struct cfg80211_registered_device *rdev;
6267         int err, reg_idx, start = cb->args[2];
6268
6269         rtnl_lock();
6270
6271         if (cfg80211_regdomain && start == 0) {
6272                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6273                                           NLM_F_MULTI, NULL,
6274                                           rtnl_dereference(cfg80211_regdomain));
6275                 if (err < 0)
6276                         goto out_err;
6277         }
6278
6279         /* the global regdom is idx 0 */
6280         reg_idx = 1;
6281         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6282                 regdom = get_wiphy_regdom(&rdev->wiphy);
6283                 if (!regdom)
6284                         continue;
6285
6286                 if (++reg_idx <= start)
6287                         continue;
6288
6289                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6290                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6291                 if (err < 0) {
6292                         reg_idx--;
6293                         break;
6294                 }
6295         }
6296
6297         cb->args[2] = reg_idx;
6298         err = skb->len;
6299 out_err:
6300         rtnl_unlock();
6301         return err;
6302 }
6303
6304 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6305 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6306         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6307         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6308         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6309         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6310         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6311         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6312         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6313 };
6314
6315 static int parse_reg_rule(struct nlattr *tb[],
6316         struct ieee80211_reg_rule *reg_rule)
6317 {
6318         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6319         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6320
6321         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6322                 return -EINVAL;
6323         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6324                 return -EINVAL;
6325         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6326                 return -EINVAL;
6327         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6328                 return -EINVAL;
6329         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6330                 return -EINVAL;
6331
6332         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6333
6334         freq_range->start_freq_khz =
6335                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6336         freq_range->end_freq_khz =
6337                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6338         freq_range->max_bandwidth_khz =
6339                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6340
6341         power_rule->max_eirp =
6342                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6343
6344         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6345                 power_rule->max_antenna_gain =
6346                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6347
6348         if (tb[NL80211_ATTR_DFS_CAC_TIME])
6349                 reg_rule->dfs_cac_ms =
6350                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6351
6352         return 0;
6353 }
6354
6355 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6356 {
6357         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6358         struct nlattr *nl_reg_rule;
6359         char *alpha2;
6360         int rem_reg_rules, r;
6361         u32 num_rules = 0, rule_idx = 0, size_of_regd;
6362         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6363         struct ieee80211_regdomain *rd;
6364
6365         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6366                 return -EINVAL;
6367
6368         if (!info->attrs[NL80211_ATTR_REG_RULES])
6369                 return -EINVAL;
6370
6371         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6372
6373         if (info->attrs[NL80211_ATTR_DFS_REGION])
6374                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6375
6376         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6377                             rem_reg_rules) {
6378                 num_rules++;
6379                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6380                         return -EINVAL;
6381         }
6382
6383         if (!reg_is_valid_request(alpha2))
6384                 return -EINVAL;
6385
6386         size_of_regd = sizeof(struct ieee80211_regdomain) +
6387                        num_rules * sizeof(struct ieee80211_reg_rule);
6388
6389         rd = kzalloc(size_of_regd, GFP_KERNEL);
6390         if (!rd)
6391                 return -ENOMEM;
6392
6393         rd->n_reg_rules = num_rules;
6394         rd->alpha2[0] = alpha2[0];
6395         rd->alpha2[1] = alpha2[1];
6396
6397         /*
6398          * Disable DFS master mode if the DFS region was
6399          * not supported or known on this kernel.
6400          */
6401         if (reg_supported_dfs_region(dfs_region))
6402                 rd->dfs_region = dfs_region;
6403
6404         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6405                             rem_reg_rules) {
6406                 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6407                                      nl_reg_rule, reg_rule_policy);
6408                 if (r)
6409                         goto bad_reg;
6410                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6411                 if (r)
6412                         goto bad_reg;
6413
6414                 rule_idx++;
6415
6416                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6417                         r = -EINVAL;
6418                         goto bad_reg;
6419                 }
6420         }
6421
6422         /* set_regdom takes ownership of rd */
6423         return set_regdom(rd, REGD_SOURCE_CRDA);
6424  bad_reg:
6425         kfree(rd);
6426         return r;
6427 }
6428 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6429
6430 static int validate_scan_freqs(struct nlattr *freqs)
6431 {
6432         struct nlattr *attr1, *attr2;
6433         int n_channels = 0, tmp1, tmp2;
6434
6435         nla_for_each_nested(attr1, freqs, tmp1) {
6436                 n_channels++;
6437                 /*
6438                  * Some hardware has a limited channel list for
6439                  * scanning, and it is pretty much nonsensical
6440                  * to scan for a channel twice, so disallow that
6441                  * and don't require drivers to check that the
6442                  * channel list they get isn't longer than what
6443                  * they can scan, as long as they can scan all
6444                  * the channels they registered at once.
6445                  */
6446                 nla_for_each_nested(attr2, freqs, tmp2)
6447                         if (attr1 != attr2 &&
6448                             nla_get_u32(attr1) == nla_get_u32(attr2))
6449                                 return 0;
6450         }
6451
6452         return n_channels;
6453 }
6454
6455 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6456 {
6457         return b < NUM_NL80211_BANDS && wiphy->bands[b];
6458 }
6459
6460 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6461                             struct cfg80211_bss_selection *bss_select)
6462 {
6463         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6464         struct nlattr *nest;
6465         int err;
6466         bool found = false;
6467         int i;
6468
6469         /* only process one nested attribute */
6470         nest = nla_data(nla);
6471         if (!nla_ok(nest, nla_len(nest)))
6472                 return -EINVAL;
6473
6474         err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
6475                                nl80211_bss_select_policy);
6476         if (err)
6477                 return err;
6478
6479         /* only one attribute may be given */
6480         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6481                 if (attr[i]) {
6482                         if (found)
6483                                 return -EINVAL;
6484                         found = true;
6485                 }
6486         }
6487
6488         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6489
6490         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6491                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6492
6493         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6494                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6495                 bss_select->param.band_pref =
6496                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6497                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6498                         return -EINVAL;
6499         }
6500
6501         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6502                 struct nl80211_bss_select_rssi_adjust *adj_param;
6503
6504                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6505                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6506                 bss_select->param.adjust.band = adj_param->band;
6507                 bss_select->param.adjust.delta = adj_param->delta;
6508                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6509                         return -EINVAL;
6510         }
6511
6512         /* user-space did not provide behaviour attribute */
6513         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6514                 return -EINVAL;
6515
6516         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6517                 return -EINVAL;
6518
6519         return 0;
6520 }
6521
6522 static int nl80211_parse_random_mac(struct nlattr **attrs,
6523                                     u8 *mac_addr, u8 *mac_addr_mask)
6524 {
6525         int i;
6526
6527         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6528                 eth_zero_addr(mac_addr);
6529                 eth_zero_addr(mac_addr_mask);
6530                 mac_addr[0] = 0x2;
6531                 mac_addr_mask[0] = 0x3;
6532
6533                 return 0;
6534         }
6535
6536         /* need both or none */
6537         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6538                 return -EINVAL;
6539
6540         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6541         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6542
6543         /* don't allow or configure an mcast address */
6544         if (!is_multicast_ether_addr(mac_addr_mask) ||
6545             is_multicast_ether_addr(mac_addr))
6546                 return -EINVAL;
6547
6548         /*
6549          * allow users to pass a MAC address that has bits set outside
6550          * of the mask, but don't bother drivers with having to deal
6551          * with such bits
6552          */
6553         for (i = 0; i < ETH_ALEN; i++)
6554                 mac_addr[i] &= mac_addr_mask[i];
6555
6556         return 0;
6557 }
6558
6559 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
6560 {
6561         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6562         struct wireless_dev *wdev = info->user_ptr[1];
6563         struct cfg80211_scan_request *request;
6564         struct nlattr *attr;
6565         struct wiphy *wiphy;
6566         int err, tmp, n_ssids = 0, n_channels, i;
6567         size_t ie_len;
6568
6569         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6570                 return -EINVAL;
6571
6572         wiphy = &rdev->wiphy;
6573
6574         if (wdev->iftype == NL80211_IFTYPE_NAN)
6575                 return -EOPNOTSUPP;
6576
6577         if (!rdev->ops->scan)
6578                 return -EOPNOTSUPP;
6579
6580         if (rdev->scan_req || rdev->scan_msg) {
6581                 err = -EBUSY;
6582                 goto unlock;
6583         }
6584
6585         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6586                 n_channels = validate_scan_freqs(
6587                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6588                 if (!n_channels) {
6589                         err = -EINVAL;
6590                         goto unlock;
6591                 }
6592         } else {
6593                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6594         }
6595
6596         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
6597                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
6598                         n_ssids++;
6599
6600         if (n_ssids > wiphy->max_scan_ssids) {
6601                 err = -EINVAL;
6602                 goto unlock;
6603         }
6604
6605         if (info->attrs[NL80211_ATTR_IE])
6606                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6607         else
6608                 ie_len = 0;
6609
6610         if (ie_len > wiphy->max_scan_ie_len) {
6611                 err = -EINVAL;
6612                 goto unlock;
6613         }
6614
6615         request = kzalloc(sizeof(*request)
6616                         + sizeof(*request->ssids) * n_ssids
6617                         + sizeof(*request->channels) * n_channels
6618                         + ie_len, GFP_KERNEL);
6619         if (!request) {
6620                 err = -ENOMEM;
6621                 goto unlock;
6622         }
6623
6624         if (n_ssids)
6625                 request->ssids = (void *)&request->channels[n_channels];
6626         request->n_ssids = n_ssids;
6627         if (ie_len) {
6628                 if (n_ssids)
6629                         request->ie = (void *)(request->ssids + n_ssids);
6630                 else
6631                         request->ie = (void *)(request->channels + n_channels);
6632         }
6633
6634         i = 0;
6635         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6636                 /* user specified, bail out if channel not found */
6637                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
6638                         struct ieee80211_channel *chan;
6639
6640                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6641
6642                         if (!chan) {
6643                                 err = -EINVAL;
6644                                 goto out_free;
6645                         }
6646
6647                         /* ignore disabled channels */
6648                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6649                                 continue;
6650
6651                         request->channels[i] = chan;
6652                         i++;
6653                 }
6654         } else {
6655                 enum nl80211_band band;
6656
6657                 /* all channels */
6658                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6659                         int j;
6660
6661                         if (!wiphy->bands[band])
6662                                 continue;
6663                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6664                                 struct ieee80211_channel *chan;
6665
6666                                 chan = &wiphy->bands[band]->channels[j];
6667
6668                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6669                                         continue;
6670
6671                                 request->channels[i] = chan;
6672                                 i++;
6673                         }
6674                 }
6675         }
6676
6677         if (!i) {
6678                 err = -EINVAL;
6679                 goto out_free;
6680         }
6681
6682         request->n_channels = i;
6683
6684         i = 0;
6685         if (n_ssids) {
6686                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
6687                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6688                                 err = -EINVAL;
6689                                 goto out_free;
6690                         }
6691                         request->ssids[i].ssid_len = nla_len(attr);
6692                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
6693                         i++;
6694                 }
6695         }
6696
6697         if (info->attrs[NL80211_ATTR_IE]) {
6698                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6699                 memcpy((void *)request->ie,
6700                        nla_data(info->attrs[NL80211_ATTR_IE]),
6701                        request->ie_len);
6702         }
6703
6704         for (i = 0; i < NUM_NL80211_BANDS; i++)
6705                 if (wiphy->bands[i])
6706                         request->rates[i] =
6707                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
6708
6709         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
6710                 nla_for_each_nested(attr,
6711                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
6712                                     tmp) {
6713                         enum nl80211_band band = nla_type(attr);
6714
6715                         if (band < 0 || band >= NUM_NL80211_BANDS) {
6716                                 err = -EINVAL;
6717                                 goto out_free;
6718                         }
6719
6720                         if (!wiphy->bands[band])
6721                                 continue;
6722
6723                         err = ieee80211_get_ratemask(wiphy->bands[band],
6724                                                      nla_data(attr),
6725                                                      nla_len(attr),
6726                                                      &request->rates[band]);
6727                         if (err)
6728                                 goto out_free;
6729                 }
6730         }
6731
6732         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
6733                 if (!wiphy_ext_feature_isset(wiphy,
6734                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
6735                         err = -EOPNOTSUPP;
6736                         goto out_free;
6737                 }
6738
6739                 request->duration =
6740                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
6741                 request->duration_mandatory =
6742                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
6743         }
6744
6745         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
6746                 request->flags = nla_get_u32(
6747                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
6748                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6749                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6750                         err = -EOPNOTSUPP;
6751                         goto out_free;
6752                 }
6753
6754                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6755                         if (!(wiphy->features &
6756                                         NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
6757                                 err = -EOPNOTSUPP;
6758                                 goto out_free;
6759                         }
6760
6761                         if (wdev->current_bss) {
6762                                 err = -EOPNOTSUPP;
6763                                 goto out_free;
6764                         }
6765
6766                         err = nl80211_parse_random_mac(info->attrs,
6767                                                        request->mac_addr,
6768                                                        request->mac_addr_mask);
6769                         if (err)
6770                                 goto out_free;
6771                 }
6772         }
6773
6774         request->no_cck =
6775                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6776
6777         /* Initial implementation used NL80211_ATTR_MAC to set the specific
6778          * BSSID to scan for. This was problematic because that same attribute
6779          * was already used for another purpose (local random MAC address). The
6780          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
6781          * compatibility with older userspace components, also use the
6782          * NL80211_ATTR_MAC value here if it can be determined to be used for
6783          * the specific BSSID use case instead of the random MAC address
6784          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
6785          */
6786         if (info->attrs[NL80211_ATTR_BSSID])
6787                 memcpy(request->bssid,
6788                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
6789         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
6790                  info->attrs[NL80211_ATTR_MAC])
6791                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
6792                        ETH_ALEN);
6793         else
6794                 eth_broadcast_addr(request->bssid);
6795
6796         request->wdev = wdev;
6797         request->wiphy = &rdev->wiphy;
6798         request->scan_start = jiffies;
6799
6800         rdev->scan_req = request;
6801         err = rdev_scan(rdev, request);
6802
6803         if (!err) {
6804                 nl80211_send_scan_start(rdev, wdev);
6805                 if (wdev->netdev)
6806                         dev_hold(wdev->netdev);
6807         } else {
6808  out_free:
6809                 rdev->scan_req = NULL;
6810                 kfree(request);
6811         }
6812
6813  unlock:
6814         return err;
6815 }
6816
6817 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
6818 {
6819         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6820         struct wireless_dev *wdev = info->user_ptr[1];
6821
6822         if (!rdev->ops->abort_scan)
6823                 return -EOPNOTSUPP;
6824
6825         if (rdev->scan_msg)
6826                 return 0;
6827
6828         if (!rdev->scan_req)
6829                 return -ENOENT;
6830
6831         rdev_abort_scan(rdev, wdev);
6832         return 0;
6833 }
6834
6835 static int
6836 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
6837                                struct cfg80211_sched_scan_request *request,
6838                                struct nlattr **attrs)
6839 {
6840         int tmp, err, i = 0;
6841         struct nlattr *attr;
6842
6843         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6844                 u32 interval;
6845
6846                 /*
6847                  * If scan plans are not specified,
6848                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
6849                  * case one scan plan will be set with the specified scan
6850                  * interval and infinite number of iterations.
6851                  */
6852                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
6853                 if (!interval)
6854                         return -EINVAL;
6855
6856                 request->scan_plans[0].interval =
6857                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
6858                 if (!request->scan_plans[0].interval)
6859                         return -EINVAL;
6860
6861                 if (request->scan_plans[0].interval >
6862                     wiphy->max_sched_scan_plan_interval)
6863                         request->scan_plans[0].interval =
6864                                 wiphy->max_sched_scan_plan_interval;
6865
6866                 return 0;
6867         }
6868
6869         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
6870                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
6871
6872                 if (WARN_ON(i >= n_plans))
6873                         return -EINVAL;
6874
6875                 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
6876                                        attr, nl80211_plan_policy);
6877                 if (err)
6878                         return err;
6879
6880                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
6881                         return -EINVAL;
6882
6883                 request->scan_plans[i].interval =
6884                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
6885                 if (!request->scan_plans[i].interval ||
6886                     request->scan_plans[i].interval >
6887                     wiphy->max_sched_scan_plan_interval)
6888                         return -EINVAL;
6889
6890                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
6891                         request->scan_plans[i].iterations =
6892                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
6893                         if (!request->scan_plans[i].iterations ||
6894                             (request->scan_plans[i].iterations >
6895                              wiphy->max_sched_scan_plan_iterations))
6896                                 return -EINVAL;
6897                 } else if (i < n_plans - 1) {
6898                         /*
6899                          * All scan plans but the last one must specify
6900                          * a finite number of iterations
6901                          */
6902                         return -EINVAL;
6903                 }
6904
6905                 i++;
6906         }
6907
6908         /*
6909          * The last scan plan must not specify the number of
6910          * iterations, it is supposed to run infinitely
6911          */
6912         if (request->scan_plans[n_plans - 1].iterations)
6913                 return  -EINVAL;
6914
6915         return 0;
6916 }
6917
6918 static struct cfg80211_sched_scan_request *
6919 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
6920                          struct nlattr **attrs, int max_match_sets)
6921 {
6922         struct cfg80211_sched_scan_request *request;
6923         struct nlattr *attr;
6924         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
6925         enum nl80211_band band;
6926         size_t ie_len;
6927         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
6928         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
6929
6930         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
6931                 return ERR_PTR(-EINVAL);
6932
6933         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6934                 n_channels = validate_scan_freqs(
6935                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6936                 if (!n_channels)
6937                         return ERR_PTR(-EINVAL);
6938         } else {
6939                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6940         }
6941
6942         if (attrs[NL80211_ATTR_SCAN_SSIDS])
6943                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6944                                     tmp)
6945                         n_ssids++;
6946
6947         if (n_ssids > wiphy->max_sched_scan_ssids)
6948                 return ERR_PTR(-EINVAL);
6949
6950         /*
6951          * First, count the number of 'real' matchsets. Due to an issue with
6952          * the old implementation, matchsets containing only the RSSI attribute
6953          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
6954          * RSSI for all matchsets, rather than their own matchset for reporting
6955          * all APs with a strong RSSI. This is needed to be compatible with
6956          * older userspace that treated a matchset with only the RSSI as the
6957          * global RSSI for all other matchsets - if there are other matchsets.
6958          */
6959         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6960                 nla_for_each_nested(attr,
6961                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6962                                     tmp) {
6963                         struct nlattr *rssi;
6964
6965                         err = nla_parse_nested(tb,
6966                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6967                                                attr, nl80211_match_policy);
6968                         if (err)
6969                                 return ERR_PTR(err);
6970                         /* add other standalone attributes here */
6971                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
6972                                 n_match_sets++;
6973                                 continue;
6974                         }
6975                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6976                         if (rssi)
6977                                 default_match_rssi = nla_get_s32(rssi);
6978                 }
6979         }
6980
6981         /* However, if there's no other matchset, add the RSSI one */
6982         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
6983                 n_match_sets = 1;
6984
6985         if (n_match_sets > max_match_sets)
6986                 return ERR_PTR(-EINVAL);
6987
6988         if (attrs[NL80211_ATTR_IE])
6989                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
6990         else
6991                 ie_len = 0;
6992
6993         if (ie_len > wiphy->max_sched_scan_ie_len)
6994                 return ERR_PTR(-EINVAL);
6995
6996         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6997                 /*
6998                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
6999                  * each scan plan already specifies its own interval
7000                  */
7001                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7002                         return ERR_PTR(-EINVAL);
7003
7004                 nla_for_each_nested(attr,
7005                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7006                         n_plans++;
7007         } else {
7008                 /*
7009                  * The scan interval attribute is kept for backward
7010                  * compatibility. If no scan plans are specified and sched scan
7011                  * interval is specified, one scan plan will be set with this
7012                  * scan interval and infinite number of iterations.
7013                  */
7014                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7015                         return ERR_PTR(-EINVAL);
7016
7017                 n_plans = 1;
7018         }
7019
7020         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7021                 return ERR_PTR(-EINVAL);
7022
7023         if (!wiphy_ext_feature_isset(
7024                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7025             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7026              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7027                 return ERR_PTR(-EINVAL);
7028
7029         request = kzalloc(sizeof(*request)
7030                         + sizeof(*request->ssids) * n_ssids
7031                         + sizeof(*request->match_sets) * n_match_sets
7032                         + sizeof(*request->scan_plans) * n_plans
7033                         + sizeof(*request->channels) * n_channels
7034                         + ie_len, GFP_KERNEL);
7035         if (!request)
7036                 return ERR_PTR(-ENOMEM);
7037
7038         if (n_ssids)
7039                 request->ssids = (void *)&request->channels[n_channels];
7040         request->n_ssids = n_ssids;
7041         if (ie_len) {
7042                 if (n_ssids)
7043                         request->ie = (void *)(request->ssids + n_ssids);
7044                 else
7045                         request->ie = (void *)(request->channels + n_channels);
7046         }
7047
7048         if (n_match_sets) {
7049                 if (request->ie)
7050                         request->match_sets = (void *)(request->ie + ie_len);
7051                 else if (n_ssids)
7052                         request->match_sets =
7053                                 (void *)(request->ssids + n_ssids);
7054                 else
7055                         request->match_sets =
7056                                 (void *)(request->channels + n_channels);
7057         }
7058         request->n_match_sets = n_match_sets;
7059
7060         if (n_match_sets)
7061                 request->scan_plans = (void *)(request->match_sets +
7062                                                n_match_sets);
7063         else if (request->ie)
7064                 request->scan_plans = (void *)(request->ie + ie_len);
7065         else if (n_ssids)
7066                 request->scan_plans = (void *)(request->ssids + n_ssids);
7067         else
7068                 request->scan_plans = (void *)(request->channels + n_channels);
7069
7070         request->n_scan_plans = n_plans;
7071
7072         i = 0;
7073         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7074                 /* user specified, bail out if channel not found */
7075                 nla_for_each_nested(attr,
7076                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7077                                     tmp) {
7078                         struct ieee80211_channel *chan;
7079
7080                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7081
7082                         if (!chan) {
7083                                 err = -EINVAL;
7084                                 goto out_free;
7085                         }
7086
7087                         /* ignore disabled channels */
7088                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7089                                 continue;
7090
7091                         request->channels[i] = chan;
7092                         i++;
7093                 }
7094         } else {
7095                 /* all channels */
7096                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7097                         int j;
7098
7099                         if (!wiphy->bands[band])
7100                                 continue;
7101                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7102                                 struct ieee80211_channel *chan;
7103
7104                                 chan = &wiphy->bands[band]->channels[j];
7105
7106                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7107                                         continue;
7108
7109                                 request->channels[i] = chan;
7110                                 i++;
7111                         }
7112                 }
7113         }
7114
7115         if (!i) {
7116                 err = -EINVAL;
7117                 goto out_free;
7118         }
7119
7120         request->n_channels = i;
7121
7122         i = 0;
7123         if (n_ssids) {
7124                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7125                                     tmp) {
7126                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7127                                 err = -EINVAL;
7128                                 goto out_free;
7129                         }
7130                         request->ssids[i].ssid_len = nla_len(attr);
7131                         memcpy(request->ssids[i].ssid, nla_data(attr),
7132                                nla_len(attr));
7133                         i++;
7134                 }
7135         }
7136
7137         i = 0;
7138         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7139                 nla_for_each_nested(attr,
7140                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7141                                     tmp) {
7142                         struct nlattr *ssid, *rssi;
7143
7144                         err = nla_parse_nested(tb,
7145                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7146                                                attr, nl80211_match_policy);
7147                         if (err)
7148                                 goto out_free;
7149                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7150                         if (ssid) {
7151                                 if (WARN_ON(i >= n_match_sets)) {
7152                                         /* this indicates a programming error,
7153                                          * the loop above should have verified
7154                                          * things properly
7155                                          */
7156                                         err = -EINVAL;
7157                                         goto out_free;
7158                                 }
7159
7160                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7161                                         err = -EINVAL;
7162                                         goto out_free;
7163                                 }
7164                                 memcpy(request->match_sets[i].ssid.ssid,
7165                                        nla_data(ssid), nla_len(ssid));
7166                                 request->match_sets[i].ssid.ssid_len =
7167                                         nla_len(ssid);
7168                                 /* special attribute - old implementation w/a */
7169                                 request->match_sets[i].rssi_thold =
7170                                         default_match_rssi;
7171                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7172                                 if (rssi)
7173                                         request->match_sets[i].rssi_thold =
7174                                                 nla_get_s32(rssi);
7175                         }
7176                         i++;
7177                 }
7178
7179                 /* there was no other matchset, so the RSSI one is alone */
7180                 if (i == 0 && n_match_sets)
7181                         request->match_sets[0].rssi_thold = default_match_rssi;
7182
7183                 request->min_rssi_thold = INT_MAX;
7184                 for (i = 0; i < n_match_sets; i++)
7185                         request->min_rssi_thold =
7186                                 min(request->match_sets[i].rssi_thold,
7187                                     request->min_rssi_thold);
7188         } else {
7189                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7190         }
7191
7192         if (ie_len) {
7193                 request->ie_len = ie_len;
7194                 memcpy((void *)request->ie,
7195                        nla_data(attrs[NL80211_ATTR_IE]),
7196                        request->ie_len);
7197         }
7198
7199         if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
7200                 request->flags = nla_get_u32(
7201                         attrs[NL80211_ATTR_SCAN_FLAGS]);
7202                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
7203                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
7204                         err = -EOPNOTSUPP;
7205                         goto out_free;
7206                 }
7207
7208                 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7209                         u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
7210
7211                         if (!wdev) /* must be net-detect */
7212                                 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7213
7214                         if (!(wiphy->features & flg)) {
7215                                 err = -EOPNOTSUPP;
7216                                 goto out_free;
7217                         }
7218
7219                         if (wdev && wdev->current_bss) {
7220                                 err = -EOPNOTSUPP;
7221                                 goto out_free;
7222                         }
7223
7224                         err = nl80211_parse_random_mac(attrs, request->mac_addr,
7225                                                        request->mac_addr_mask);
7226                         if (err)
7227                                 goto out_free;
7228                 }
7229         }
7230
7231         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7232                 request->delay =
7233                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7234
7235         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7236                 request->relative_rssi = nla_get_s8(
7237                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7238                 request->relative_rssi_set = true;
7239         }
7240
7241         if (request->relative_rssi_set &&
7242             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7243                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7244
7245                 rssi_adjust = nla_data(
7246                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7247                 request->rssi_adjust.band = rssi_adjust->band;
7248                 request->rssi_adjust.delta = rssi_adjust->delta;
7249                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7250                         err = -EINVAL;
7251                         goto out_free;
7252                 }
7253         }
7254
7255         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7256         if (err)
7257                 goto out_free;
7258
7259         request->scan_start = jiffies;
7260
7261         return request;
7262
7263 out_free:
7264         kfree(request);
7265         return ERR_PTR(err);
7266 }
7267
7268 static int nl80211_start_sched_scan(struct sk_buff *skb,
7269                                     struct genl_info *info)
7270 {
7271         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7272         struct net_device *dev = info->user_ptr[1];
7273         struct wireless_dev *wdev = dev->ieee80211_ptr;
7274         struct cfg80211_sched_scan_request *sched_scan_req;
7275         int err;
7276
7277         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
7278             !rdev->ops->sched_scan_start)
7279                 return -EOPNOTSUPP;
7280
7281         if (rdev->sched_scan_req)
7282                 return -EINPROGRESS;
7283
7284         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7285                                                   info->attrs,
7286                                                   rdev->wiphy.max_match_sets);
7287
7288         err = PTR_ERR_OR_ZERO(sched_scan_req);
7289         if (err)
7290                 goto out_err;
7291
7292         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7293         if (err)
7294                 goto out_free;
7295
7296         sched_scan_req->dev = dev;
7297         sched_scan_req->wiphy = &rdev->wiphy;
7298
7299         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7300                 sched_scan_req->owner_nlportid = info->snd_portid;
7301
7302         rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
7303
7304         nl80211_send_sched_scan(rdev, dev,
7305                                 NL80211_CMD_START_SCHED_SCAN);
7306         return 0;
7307
7308 out_free:
7309         kfree(sched_scan_req);
7310 out_err:
7311         return err;
7312 }
7313
7314 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7315                                    struct genl_info *info)
7316 {
7317         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7318
7319         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
7320             !rdev->ops->sched_scan_stop)
7321                 return -EOPNOTSUPP;
7322
7323         return __cfg80211_stop_sched_scan(rdev, false);
7324 }
7325
7326 static int nl80211_start_radar_detection(struct sk_buff *skb,
7327                                          struct genl_info *info)
7328 {
7329         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7330         struct net_device *dev = info->user_ptr[1];
7331         struct wireless_dev *wdev = dev->ieee80211_ptr;
7332         struct cfg80211_chan_def chandef;
7333         enum nl80211_dfs_regions dfs_region;
7334         unsigned int cac_time_ms;
7335         int err;
7336
7337         dfs_region = reg_get_dfs_region(wdev->wiphy);
7338         if (dfs_region == NL80211_DFS_UNSET)
7339                 return -EINVAL;
7340
7341         err = nl80211_parse_chandef(rdev, info, &chandef);
7342         if (err)
7343                 return err;
7344
7345         if (netif_carrier_ok(dev))
7346                 return -EBUSY;
7347
7348         if (wdev->cac_started)
7349                 return -EBUSY;
7350
7351         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
7352                                             wdev->iftype);
7353         if (err < 0)
7354                 return err;
7355
7356         if (err == 0)
7357                 return -EINVAL;
7358
7359         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
7360                 return -EINVAL;
7361
7362         if (!rdev->ops->start_radar_detection)
7363                 return -EOPNOTSUPP;
7364
7365         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7366         if (WARN_ON(!cac_time_ms))
7367                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7368
7369         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7370         if (!err) {
7371                 wdev->chandef = chandef;
7372                 wdev->cac_started = true;
7373                 wdev->cac_start_time = jiffies;
7374                 wdev->cac_time_ms = cac_time_ms;
7375         }
7376         return err;
7377 }
7378
7379 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7380 {
7381         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7382         struct net_device *dev = info->user_ptr[1];
7383         struct wireless_dev *wdev = dev->ieee80211_ptr;
7384         struct cfg80211_csa_settings params;
7385         /* csa_attrs is defined static to avoid waste of stack size - this
7386          * function is called under RTNL lock, so this should not be a problem.
7387          */
7388         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7389         int err;
7390         bool need_new_beacon = false;
7391         int len, i;
7392         u32 cs_count;
7393
7394         if (!rdev->ops->channel_switch ||
7395             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7396                 return -EOPNOTSUPP;
7397
7398         switch (dev->ieee80211_ptr->iftype) {
7399         case NL80211_IFTYPE_AP:
7400         case NL80211_IFTYPE_P2P_GO:
7401                 need_new_beacon = true;
7402
7403                 /* useless if AP is not running */
7404                 if (!wdev->beacon_interval)
7405                         return -ENOTCONN;
7406                 break;
7407         case NL80211_IFTYPE_ADHOC:
7408                 if (!wdev->ssid_len)
7409                         return -ENOTCONN;
7410                 break;
7411         case NL80211_IFTYPE_MESH_POINT:
7412                 if (!wdev->mesh_id_len)
7413                         return -ENOTCONN;
7414                 break;
7415         default:
7416                 return -EOPNOTSUPP;
7417         }
7418
7419         memset(&params, 0, sizeof(params));
7420
7421         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7422             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7423                 return -EINVAL;
7424
7425         /* only important for AP, IBSS and mesh create IEs internally */
7426         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7427                 return -EINVAL;
7428
7429         /* Even though the attribute is u32, the specification says
7430          * u8, so let's make sure we don't overflow.
7431          */
7432         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7433         if (cs_count > 255)
7434                 return -EINVAL;
7435
7436         params.count = cs_count;
7437
7438         if (!need_new_beacon)
7439                 goto skip_beacons;
7440
7441         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
7442         if (err)
7443                 return err;
7444
7445         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7446                                info->attrs[NL80211_ATTR_CSA_IES],
7447                                nl80211_policy);
7448         if (err)
7449                 return err;
7450
7451         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
7452         if (err)
7453                 return err;
7454
7455         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7456                 return -EINVAL;
7457
7458         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7459         if (!len || (len % sizeof(u16)))
7460                 return -EINVAL;
7461
7462         params.n_counter_offsets_beacon = len / sizeof(u16);
7463         if (rdev->wiphy.max_num_csa_counters &&
7464             (params.n_counter_offsets_beacon >
7465              rdev->wiphy.max_num_csa_counters))
7466                 return -EINVAL;
7467
7468         params.counter_offsets_beacon =
7469                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7470
7471         /* sanity checks - counters should fit and be the same */
7472         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7473                 u16 offset = params.counter_offsets_beacon[i];
7474
7475                 if (offset >= params.beacon_csa.tail_len)
7476                         return -EINVAL;
7477
7478                 if (params.beacon_csa.tail[offset] != params.count)
7479                         return -EINVAL;
7480         }
7481
7482         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7483                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7484                 if (!len || (len % sizeof(u16)))
7485                         return -EINVAL;
7486
7487                 params.n_counter_offsets_presp = len / sizeof(u16);
7488                 if (rdev->wiphy.max_num_csa_counters &&
7489                     (params.n_counter_offsets_presp >
7490                      rdev->wiphy.max_num_csa_counters))
7491                         return -EINVAL;
7492
7493                 params.counter_offsets_presp =
7494                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7495
7496                 /* sanity checks - counters should fit and be the same */
7497                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
7498                         u16 offset = params.counter_offsets_presp[i];
7499
7500                         if (offset >= params.beacon_csa.probe_resp_len)
7501                                 return -EINVAL;
7502
7503                         if (params.beacon_csa.probe_resp[offset] !=
7504                             params.count)
7505                                 return -EINVAL;
7506                 }
7507         }
7508
7509 skip_beacons:
7510         err = nl80211_parse_chandef(rdev, info, &params.chandef);
7511         if (err)
7512                 return err;
7513
7514         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
7515                                            wdev->iftype))
7516                 return -EINVAL;
7517
7518         err = cfg80211_chandef_dfs_required(wdev->wiphy,
7519                                             &params.chandef,
7520                                             wdev->iftype);
7521         if (err < 0)
7522                 return err;
7523
7524         if (err > 0)
7525                 params.radar_required = true;
7526
7527         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
7528                 params.block_tx = true;
7529
7530         wdev_lock(wdev);
7531         err = rdev_channel_switch(rdev, dev, &params);
7532         wdev_unlock(wdev);
7533
7534         return err;
7535 }
7536
7537 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
7538                             u32 seq, int flags,
7539                             struct cfg80211_registered_device *rdev,
7540                             struct wireless_dev *wdev,
7541                             struct cfg80211_internal_bss *intbss)
7542 {
7543         struct cfg80211_bss *res = &intbss->pub;
7544         const struct cfg80211_bss_ies *ies;
7545         void *hdr;
7546         struct nlattr *bss;
7547
7548         ASSERT_WDEV_LOCK(wdev);
7549
7550         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7551                              NL80211_CMD_NEW_SCAN_RESULTS);
7552         if (!hdr)
7553                 return -1;
7554
7555         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
7556
7557         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
7558                 goto nla_put_failure;
7559         if (wdev->netdev &&
7560             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
7561                 goto nla_put_failure;
7562         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
7563                               NL80211_ATTR_PAD))
7564                 goto nla_put_failure;
7565
7566         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
7567         if (!bss)
7568                 goto nla_put_failure;
7569         if ((!is_zero_ether_addr(res->bssid) &&
7570              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
7571                 goto nla_put_failure;
7572
7573         rcu_read_lock();
7574         /* indicate whether we have probe response data or not */
7575         if (rcu_access_pointer(res->proberesp_ies) &&
7576             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
7577                 goto fail_unlock_rcu;
7578
7579         /* this pointer prefers to be pointed to probe response data
7580          * but is always valid
7581          */
7582         ies = rcu_dereference(res->ies);
7583         if (ies) {
7584                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
7585                                       NL80211_BSS_PAD))
7586                         goto fail_unlock_rcu;
7587                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
7588                                         ies->len, ies->data))
7589                         goto fail_unlock_rcu;
7590         }
7591
7592         /* and this pointer is always (unless driver didn't know) beacon data */
7593         ies = rcu_dereference(res->beacon_ies);
7594         if (ies && ies->from_beacon) {
7595                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
7596                                       NL80211_BSS_PAD))
7597                         goto fail_unlock_rcu;
7598                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
7599                                         ies->len, ies->data))
7600                         goto fail_unlock_rcu;
7601         }
7602         rcu_read_unlock();
7603
7604         if (res->beacon_interval &&
7605             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
7606                 goto nla_put_failure;
7607         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
7608             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
7609             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
7610             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
7611                         jiffies_to_msecs(jiffies - intbss->ts)))
7612                 goto nla_put_failure;
7613
7614         if (intbss->parent_tsf &&
7615             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
7616                                intbss->parent_tsf, NL80211_BSS_PAD) ||
7617              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
7618                      intbss->parent_bssid)))
7619                 goto nla_put_failure;
7620
7621         if (intbss->ts_boottime &&
7622             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
7623                               intbss->ts_boottime, NL80211_BSS_PAD))
7624                 goto nla_put_failure;
7625
7626         switch (rdev->wiphy.signal_type) {
7627         case CFG80211_SIGNAL_TYPE_MBM:
7628                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
7629                         goto nla_put_failure;
7630                 break;
7631         case CFG80211_SIGNAL_TYPE_UNSPEC:
7632                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
7633                         goto nla_put_failure;
7634                 break;
7635         default:
7636                 break;
7637         }
7638
7639         switch (wdev->iftype) {
7640         case NL80211_IFTYPE_P2P_CLIENT:
7641         case NL80211_IFTYPE_STATION:
7642                 if (intbss == wdev->current_bss &&
7643                     nla_put_u32(msg, NL80211_BSS_STATUS,
7644                                 NL80211_BSS_STATUS_ASSOCIATED))
7645                         goto nla_put_failure;
7646                 break;
7647         case NL80211_IFTYPE_ADHOC:
7648                 if (intbss == wdev->current_bss &&
7649                     nla_put_u32(msg, NL80211_BSS_STATUS,
7650                                 NL80211_BSS_STATUS_IBSS_JOINED))
7651                         goto nla_put_failure;
7652                 break;
7653         default:
7654                 break;
7655         }
7656
7657         nla_nest_end(msg, bss);
7658
7659         genlmsg_end(msg, hdr);
7660         return 0;
7661
7662  fail_unlock_rcu:
7663         rcu_read_unlock();
7664  nla_put_failure:
7665         genlmsg_cancel(msg, hdr);
7666         return -EMSGSIZE;
7667 }
7668
7669 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
7670 {
7671         struct cfg80211_registered_device *rdev;
7672         struct cfg80211_internal_bss *scan;
7673         struct wireless_dev *wdev;
7674         int start = cb->args[2], idx = 0;
7675         int err;
7676
7677         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7678         if (err)
7679                 return err;
7680
7681         wdev_lock(wdev);
7682         spin_lock_bh(&rdev->bss_lock);
7683         cfg80211_bss_expire(rdev);
7684
7685         cb->seq = rdev->bss_generation;
7686
7687         list_for_each_entry(scan, &rdev->bss_list, list) {
7688                 if (++idx <= start)
7689                         continue;
7690                 if (nl80211_send_bss(skb, cb,
7691                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7692                                 rdev, wdev, scan) < 0) {
7693                         idx--;
7694                         break;
7695                 }
7696         }
7697
7698         spin_unlock_bh(&rdev->bss_lock);
7699         wdev_unlock(wdev);
7700
7701         cb->args[2] = idx;
7702         nl80211_finish_wdev_dump(rdev);
7703
7704         return skb->len;
7705 }
7706
7707 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
7708                                int flags, struct net_device *dev,
7709                                bool allow_radio_stats,
7710                                struct survey_info *survey)
7711 {
7712         void *hdr;
7713         struct nlattr *infoattr;
7714
7715         /* skip radio stats if userspace didn't request them */
7716         if (!survey->channel && !allow_radio_stats)
7717                 return 0;
7718
7719         hdr = nl80211hdr_put(msg, portid, seq, flags,
7720                              NL80211_CMD_NEW_SURVEY_RESULTS);
7721         if (!hdr)
7722                 return -ENOMEM;
7723
7724         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
7725                 goto nla_put_failure;
7726
7727         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
7728         if (!infoattr)
7729                 goto nla_put_failure;
7730
7731         if (survey->channel &&
7732             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
7733                         survey->channel->center_freq))
7734                 goto nla_put_failure;
7735
7736         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
7737             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
7738                 goto nla_put_failure;
7739         if ((survey->filled & SURVEY_INFO_IN_USE) &&
7740             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
7741                 goto nla_put_failure;
7742         if ((survey->filled & SURVEY_INFO_TIME) &&
7743             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
7744                         survey->time, NL80211_SURVEY_INFO_PAD))
7745                 goto nla_put_failure;
7746         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
7747             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
7748                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
7749                 goto nla_put_failure;
7750         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
7751             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
7752                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
7753                 goto nla_put_failure;
7754         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
7755             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
7756                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
7757                 goto nla_put_failure;
7758         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
7759             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
7760                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
7761                 goto nla_put_failure;
7762         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
7763             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
7764                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
7765                 goto nla_put_failure;
7766
7767         nla_nest_end(msg, infoattr);
7768
7769         genlmsg_end(msg, hdr);
7770         return 0;
7771
7772  nla_put_failure:
7773         genlmsg_cancel(msg, hdr);
7774         return -EMSGSIZE;
7775 }
7776
7777 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
7778 {
7779         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
7780         struct survey_info survey;
7781         struct cfg80211_registered_device *rdev;
7782         struct wireless_dev *wdev;
7783         int survey_idx = cb->args[2];
7784         int res;
7785         bool radio_stats;
7786
7787         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7788         if (res)
7789                 return res;
7790
7791         /* prepare_wdev_dump parsed the attributes */
7792         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
7793
7794         if (!wdev->netdev) {
7795                 res = -EINVAL;
7796                 goto out_err;
7797         }
7798
7799         if (!rdev->ops->dump_survey) {
7800                 res = -EOPNOTSUPP;
7801                 goto out_err;
7802         }
7803
7804         while (1) {
7805                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
7806                 if (res == -ENOENT)
7807                         break;
7808                 if (res)
7809                         goto out_err;
7810
7811                 /* don't send disabled channels, but do send non-channel data */
7812                 if (survey.channel &&
7813                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
7814                         survey_idx++;
7815                         continue;
7816                 }
7817
7818                 if (nl80211_send_survey(skb,
7819                                 NETLINK_CB(cb->skb).portid,
7820                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7821                                 wdev->netdev, radio_stats, &survey) < 0)
7822                         goto out;
7823                 survey_idx++;
7824         }
7825
7826  out:
7827         cb->args[2] = survey_idx;
7828         res = skb->len;
7829  out_err:
7830         nl80211_finish_wdev_dump(rdev);
7831         return res;
7832 }
7833
7834 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
7835 {
7836         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
7837                                   NL80211_WPA_VERSION_2));
7838 }
7839
7840 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
7841 {
7842         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7843         struct net_device *dev = info->user_ptr[1];
7844         struct ieee80211_channel *chan;
7845         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
7846         int err, ssid_len, ie_len = 0, auth_data_len = 0;
7847         enum nl80211_auth_type auth_type;
7848         struct key_parse key;
7849         bool local_state_change;
7850
7851         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7852                 return -EINVAL;
7853
7854         if (!info->attrs[NL80211_ATTR_MAC])
7855                 return -EINVAL;
7856
7857         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
7858                 return -EINVAL;
7859
7860         if (!info->attrs[NL80211_ATTR_SSID])
7861                 return -EINVAL;
7862
7863         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7864                 return -EINVAL;
7865
7866         err = nl80211_parse_key(info, &key);
7867         if (err)
7868                 return err;
7869
7870         if (key.idx >= 0) {
7871                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
7872                         return -EINVAL;
7873                 if (!key.p.key || !key.p.key_len)
7874                         return -EINVAL;
7875                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
7876                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
7877                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
7878                      key.p.key_len != WLAN_KEY_LEN_WEP104))
7879                         return -EINVAL;
7880                 if (key.idx > 3)
7881                         return -EINVAL;
7882         } else {
7883                 key.p.key_len = 0;
7884                 key.p.key = NULL;
7885         }
7886
7887         if (key.idx >= 0) {
7888                 int i;
7889                 bool ok = false;
7890
7891                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
7892                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
7893                                 ok = true;
7894                                 break;
7895                         }
7896                 }
7897                 if (!ok)
7898                         return -EINVAL;
7899         }
7900
7901         if (!rdev->ops->auth)
7902                 return -EOPNOTSUPP;
7903
7904         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7905             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7906                 return -EOPNOTSUPP;
7907
7908         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7909         chan = nl80211_get_valid_chan(&rdev->wiphy,
7910                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7911         if (!chan)
7912                 return -EINVAL;
7913
7914         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7915         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7916
7917         if (info->attrs[NL80211_ATTR_IE]) {
7918                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7919                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7920         }
7921
7922         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7923         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
7924                 return -EINVAL;
7925
7926         if ((auth_type == NL80211_AUTHTYPE_SAE ||
7927              auth_type == NL80211_AUTHTYPE_FILS_SK ||
7928              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
7929              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
7930             !info->attrs[NL80211_ATTR_AUTH_DATA])
7931                 return -EINVAL;
7932
7933         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
7934                 if (auth_type != NL80211_AUTHTYPE_SAE &&
7935                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
7936                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
7937                     auth_type != NL80211_AUTHTYPE_FILS_PK)
7938                         return -EINVAL;
7939                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
7940                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
7941                 /* need to include at least Auth Transaction and Status Code */
7942                 if (auth_data_len < 4)
7943                         return -EINVAL;
7944         }
7945
7946         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7947
7948         /*
7949          * Since we no longer track auth state, ignore
7950          * requests to only change local state.
7951          */
7952         if (local_state_change)
7953                 return 0;
7954
7955         wdev_lock(dev->ieee80211_ptr);
7956         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
7957                                  ssid, ssid_len, ie, ie_len,
7958                                  key.p.key, key.p.key_len, key.idx,
7959                                  auth_data, auth_data_len);
7960         wdev_unlock(dev->ieee80211_ptr);
7961         return err;
7962 }
7963
7964 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
7965                                    struct genl_info *info,
7966                                    struct cfg80211_crypto_settings *settings,
7967                                    int cipher_limit)
7968 {
7969         memset(settings, 0, sizeof(*settings));
7970
7971         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
7972
7973         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
7974                 u16 proto;
7975
7976                 proto = nla_get_u16(
7977                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
7978                 settings->control_port_ethertype = cpu_to_be16(proto);
7979                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
7980                     proto != ETH_P_PAE)
7981                         return -EINVAL;
7982                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
7983                         settings->control_port_no_encrypt = true;
7984         } else
7985                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
7986
7987         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
7988                 void *data;
7989                 int len, i;
7990
7991                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7992                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7993                 settings->n_ciphers_pairwise = len / sizeof(u32);
7994
7995                 if (len % sizeof(u32))
7996                         return -EINVAL;
7997
7998                 if (settings->n_ciphers_pairwise > cipher_limit)
7999                         return -EINVAL;
8000
8001                 memcpy(settings->ciphers_pairwise, data, len);
8002
8003                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8004                         if (!cfg80211_supported_cipher_suite(
8005                                         &rdev->wiphy,
8006                                         settings->ciphers_pairwise[i]))
8007                                 return -EINVAL;
8008         }
8009
8010         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8011                 settings->cipher_group =
8012                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8013                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8014                                                      settings->cipher_group))
8015                         return -EINVAL;
8016         }
8017
8018         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8019                 settings->wpa_versions =
8020                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8021                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8022                         return -EINVAL;
8023         }
8024
8025         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8026                 void *data;
8027                 int len;
8028
8029                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8030                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8031                 settings->n_akm_suites = len / sizeof(u32);
8032
8033                 if (len % sizeof(u32))
8034                         return -EINVAL;
8035
8036                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8037                         return -EINVAL;
8038
8039                 memcpy(settings->akm_suites, data, len);
8040         }
8041
8042         return 0;
8043 }
8044
8045 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8046 {
8047         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8048         struct net_device *dev = info->user_ptr[1];
8049         struct ieee80211_channel *chan;
8050         struct cfg80211_assoc_request req = {};
8051         const u8 *bssid, *ssid;
8052         int err, ssid_len = 0;
8053
8054         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8055                 return -EINVAL;
8056
8057         if (!info->attrs[NL80211_ATTR_MAC] ||
8058             !info->attrs[NL80211_ATTR_SSID] ||
8059             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8060                 return -EINVAL;
8061
8062         if (!rdev->ops->assoc)
8063                 return -EOPNOTSUPP;
8064
8065         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8066             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8067                 return -EOPNOTSUPP;
8068
8069         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8070
8071         chan = nl80211_get_valid_chan(&rdev->wiphy,
8072                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8073         if (!chan)
8074                 return -EINVAL;
8075
8076         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8077         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8078
8079         if (info->attrs[NL80211_ATTR_IE]) {
8080                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8081                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8082         }
8083
8084         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8085                 enum nl80211_mfp mfp =
8086                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8087                 if (mfp == NL80211_MFP_REQUIRED)
8088                         req.use_mfp = true;
8089                 else if (mfp != NL80211_MFP_NO)
8090                         return -EINVAL;
8091         }
8092
8093         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8094                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8095
8096         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8097                 req.flags |= ASSOC_REQ_DISABLE_HT;
8098
8099         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8100                 memcpy(&req.ht_capa_mask,
8101                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8102                        sizeof(req.ht_capa_mask));
8103
8104         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8105                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8106                         return -EINVAL;
8107                 memcpy(&req.ht_capa,
8108                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8109                        sizeof(req.ht_capa));
8110         }
8111
8112         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8113                 req.flags |= ASSOC_REQ_DISABLE_VHT;
8114
8115         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8116                 memcpy(&req.vht_capa_mask,
8117                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8118                        sizeof(req.vht_capa_mask));
8119
8120         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8121                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8122                         return -EINVAL;
8123                 memcpy(&req.vht_capa,
8124                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8125                        sizeof(req.vht_capa));
8126         }
8127
8128         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8129                 if (!((rdev->wiphy.features &
8130                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8131                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8132                     !wiphy_ext_feature_isset(&rdev->wiphy,
8133                                              NL80211_EXT_FEATURE_RRM))
8134                         return -EINVAL;
8135                 req.flags |= ASSOC_REQ_USE_RRM;
8136         }
8137
8138         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8139                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8140                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8141                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8142                         return -EINVAL;
8143                 req.fils_nonces =
8144                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8145         }
8146
8147         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8148         if (!err) {
8149                 wdev_lock(dev->ieee80211_ptr);
8150
8151                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8152                                           ssid, ssid_len, &req);
8153
8154                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8155                         dev->ieee80211_ptr->conn_owner_nlportid =
8156                                 info->snd_portid;
8157                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
8158                                bssid, ETH_ALEN);
8159                 }
8160
8161                 wdev_unlock(dev->ieee80211_ptr);
8162         }
8163
8164         return err;
8165 }
8166
8167 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8168 {
8169         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8170         struct net_device *dev = info->user_ptr[1];
8171         const u8 *ie = NULL, *bssid;
8172         int ie_len = 0, err;
8173         u16 reason_code;
8174         bool local_state_change;
8175
8176         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8177                 return -EINVAL;
8178
8179         if (!info->attrs[NL80211_ATTR_MAC])
8180                 return -EINVAL;
8181
8182         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8183                 return -EINVAL;
8184
8185         if (!rdev->ops->deauth)
8186                 return -EOPNOTSUPP;
8187
8188         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8189             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8190                 return -EOPNOTSUPP;
8191
8192         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8193
8194         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8195         if (reason_code == 0) {
8196                 /* Reason Code 0 is reserved */
8197                 return -EINVAL;
8198         }
8199
8200         if (info->attrs[NL80211_ATTR_IE]) {
8201                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8202                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8203         }
8204
8205         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8206
8207         wdev_lock(dev->ieee80211_ptr);
8208         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8209                                    local_state_change);
8210         wdev_unlock(dev->ieee80211_ptr);
8211         return err;
8212 }
8213
8214 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8215 {
8216         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8217         struct net_device *dev = info->user_ptr[1];
8218         const u8 *ie = NULL, *bssid;
8219         int ie_len = 0, err;
8220         u16 reason_code;
8221         bool local_state_change;
8222
8223         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8224                 return -EINVAL;
8225
8226         if (!info->attrs[NL80211_ATTR_MAC])
8227                 return -EINVAL;
8228
8229         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8230                 return -EINVAL;
8231
8232         if (!rdev->ops->disassoc)
8233                 return -EOPNOTSUPP;
8234
8235         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8236             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8237                 return -EOPNOTSUPP;
8238
8239         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8240
8241         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8242         if (reason_code == 0) {
8243                 /* Reason Code 0 is reserved */
8244                 return -EINVAL;
8245         }
8246
8247         if (info->attrs[NL80211_ATTR_IE]) {
8248                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8249                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8250         }
8251
8252         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8253
8254         wdev_lock(dev->ieee80211_ptr);
8255         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8256                                      local_state_change);
8257         wdev_unlock(dev->ieee80211_ptr);
8258         return err;
8259 }
8260
8261 static bool
8262 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8263                          int mcast_rate[NUM_NL80211_BANDS],
8264                          int rateval)
8265 {
8266         struct wiphy *wiphy = &rdev->wiphy;
8267         bool found = false;
8268         int band, i;
8269
8270         for (band = 0; band < NUM_NL80211_BANDS; band++) {
8271                 struct ieee80211_supported_band *sband;
8272
8273                 sband = wiphy->bands[band];
8274                 if (!sband)
8275                         continue;
8276
8277                 for (i = 0; i < sband->n_bitrates; i++) {
8278                         if (sband->bitrates[i].bitrate == rateval) {
8279                                 mcast_rate[band] = i + 1;
8280                                 found = true;
8281                                 break;
8282                         }
8283                 }
8284         }
8285
8286         return found;
8287 }
8288
8289 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8290 {
8291         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8292         struct net_device *dev = info->user_ptr[1];
8293         struct cfg80211_ibss_params ibss;
8294         struct wiphy *wiphy;
8295         struct cfg80211_cached_keys *connkeys = NULL;
8296         int err;
8297
8298         memset(&ibss, 0, sizeof(ibss));
8299
8300         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8301                 return -EINVAL;
8302
8303         if (!info->attrs[NL80211_ATTR_SSID] ||
8304             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8305                 return -EINVAL;
8306
8307         ibss.beacon_interval = 100;
8308
8309         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8310                 ibss.beacon_interval =
8311                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8312
8313         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
8314                                            ibss.beacon_interval);
8315         if (err)
8316                 return err;
8317
8318         if (!rdev->ops->join_ibss)
8319                 return -EOPNOTSUPP;
8320
8321         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8322                 return -EOPNOTSUPP;
8323
8324         wiphy = &rdev->wiphy;
8325
8326         if (info->attrs[NL80211_ATTR_MAC]) {
8327                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8328
8329                 if (!is_valid_ether_addr(ibss.bssid))
8330                         return -EINVAL;
8331         }
8332         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8333         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8334
8335         if (info->attrs[NL80211_ATTR_IE]) {
8336                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8337                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8338         }
8339
8340         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8341         if (err)
8342                 return err;
8343
8344         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8345                                      NL80211_IFTYPE_ADHOC))
8346                 return -EINVAL;
8347
8348         switch (ibss.chandef.width) {
8349         case NL80211_CHAN_WIDTH_5:
8350         case NL80211_CHAN_WIDTH_10:
8351         case NL80211_CHAN_WIDTH_20_NOHT:
8352                 break;
8353         case NL80211_CHAN_WIDTH_20:
8354         case NL80211_CHAN_WIDTH_40:
8355                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8356                         return -EINVAL;
8357                 break;
8358         case NL80211_CHAN_WIDTH_80:
8359         case NL80211_CHAN_WIDTH_80P80:
8360         case NL80211_CHAN_WIDTH_160:
8361                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8362                         return -EINVAL;
8363                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8364                                              NL80211_EXT_FEATURE_VHT_IBSS))
8365                         return -EINVAL;
8366                 break;
8367         default:
8368                 return -EINVAL;
8369         }
8370
8371         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8372         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8373
8374         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8375                 u8 *rates =
8376                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8377                 int n_rates =
8378                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8379                 struct ieee80211_supported_band *sband =
8380                         wiphy->bands[ibss.chandef.chan->band];
8381
8382                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8383                                              &ibss.basic_rates);
8384                 if (err)
8385                         return err;
8386         }
8387
8388         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8389                 memcpy(&ibss.ht_capa_mask,
8390                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8391                        sizeof(ibss.ht_capa_mask));
8392
8393         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8394                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8395                         return -EINVAL;
8396                 memcpy(&ibss.ht_capa,
8397                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8398                        sizeof(ibss.ht_capa));
8399         }
8400
8401         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8402             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8403                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8404                 return -EINVAL;
8405
8406         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8407                 bool no_ht = false;
8408
8409                 connkeys = nl80211_parse_connkeys(rdev,
8410                                           info->attrs[NL80211_ATTR_KEYS],
8411                                           &no_ht);
8412                 if (IS_ERR(connkeys))
8413                         return PTR_ERR(connkeys);
8414
8415                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8416                     no_ht) {
8417                         kzfree(connkeys);
8418                         return -EINVAL;
8419                 }
8420         }
8421
8422         ibss.control_port =
8423                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8424
8425         ibss.userspace_handles_dfs =
8426                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
8427
8428         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
8429         if (err)
8430                 kzfree(connkeys);
8431         return err;
8432 }
8433
8434 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
8435 {
8436         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8437         struct net_device *dev = info->user_ptr[1];
8438
8439         if (!rdev->ops->leave_ibss)
8440                 return -EOPNOTSUPP;
8441
8442         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8443                 return -EOPNOTSUPP;
8444
8445         return cfg80211_leave_ibss(rdev, dev, false);
8446 }
8447
8448 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
8449 {
8450         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8451         struct net_device *dev = info->user_ptr[1];
8452         int mcast_rate[NUM_NL80211_BANDS];
8453         u32 nla_rate;
8454         int err;
8455
8456         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
8457             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
8458             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
8459                 return -EOPNOTSUPP;
8460
8461         if (!rdev->ops->set_mcast_rate)
8462                 return -EOPNOTSUPP;
8463
8464         memset(mcast_rate, 0, sizeof(mcast_rate));
8465
8466         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
8467                 return -EINVAL;
8468
8469         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
8470         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
8471                 return -EINVAL;
8472
8473         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
8474
8475         return err;
8476 }
8477
8478 static struct sk_buff *
8479 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
8480                             struct wireless_dev *wdev, int approxlen,
8481                             u32 portid, u32 seq, enum nl80211_commands cmd,
8482                             enum nl80211_attrs attr,
8483                             const struct nl80211_vendor_cmd_info *info,
8484                             gfp_t gfp)
8485 {
8486         struct sk_buff *skb;
8487         void *hdr;
8488         struct nlattr *data;
8489
8490         skb = nlmsg_new(approxlen + 100, gfp);
8491         if (!skb)
8492                 return NULL;
8493
8494         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
8495         if (!hdr) {
8496                 kfree_skb(skb);
8497                 return NULL;
8498         }
8499
8500         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
8501                 goto nla_put_failure;
8502
8503         if (info) {
8504                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
8505                                 info->vendor_id))
8506                         goto nla_put_failure;
8507                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
8508                                 info->subcmd))
8509                         goto nla_put_failure;
8510         }
8511
8512         if (wdev) {
8513                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
8514                                       wdev_id(wdev), NL80211_ATTR_PAD))
8515                         goto nla_put_failure;
8516                 if (wdev->netdev &&
8517                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
8518                                 wdev->netdev->ifindex))
8519                         goto nla_put_failure;
8520         }
8521
8522         data = nla_nest_start(skb, attr);
8523         if (!data)
8524                 goto nla_put_failure;
8525
8526         ((void **)skb->cb)[0] = rdev;
8527         ((void **)skb->cb)[1] = hdr;
8528         ((void **)skb->cb)[2] = data;
8529
8530         return skb;
8531
8532  nla_put_failure:
8533         kfree_skb(skb);
8534         return NULL;
8535 }
8536
8537 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
8538                                            struct wireless_dev *wdev,
8539                                            enum nl80211_commands cmd,
8540                                            enum nl80211_attrs attr,
8541                                            int vendor_event_idx,
8542                                            int approxlen, gfp_t gfp)
8543 {
8544         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
8545         const struct nl80211_vendor_cmd_info *info;
8546
8547         switch (cmd) {
8548         case NL80211_CMD_TESTMODE:
8549                 if (WARN_ON(vendor_event_idx != -1))
8550                         return NULL;
8551                 info = NULL;
8552                 break;
8553         case NL80211_CMD_VENDOR:
8554                 if (WARN_ON(vendor_event_idx < 0 ||
8555                             vendor_event_idx >= wiphy->n_vendor_events))
8556                         return NULL;
8557                 info = &wiphy->vendor_events[vendor_event_idx];
8558                 break;
8559         default:
8560                 WARN_ON(1);
8561                 return NULL;
8562         }
8563
8564         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
8565                                            cmd, attr, info, gfp);
8566 }
8567 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
8568
8569 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
8570 {
8571         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
8572         void *hdr = ((void **)skb->cb)[1];
8573         struct nlattr *data = ((void **)skb->cb)[2];
8574         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
8575
8576         /* clear CB data for netlink core to own from now on */
8577         memset(skb->cb, 0, sizeof(skb->cb));
8578
8579         nla_nest_end(skb, data);
8580         genlmsg_end(skb, hdr);
8581
8582         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
8583                 mcgrp = NL80211_MCGRP_VENDOR;
8584
8585         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
8586                                 mcgrp, gfp);
8587 }
8588 EXPORT_SYMBOL(__cfg80211_send_event_skb);
8589
8590 #ifdef CONFIG_NL80211_TESTMODE
8591 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
8592 {
8593         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8594         struct wireless_dev *wdev =
8595                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
8596         int err;
8597
8598         if (!rdev->ops->testmode_cmd)
8599                 return -EOPNOTSUPP;
8600
8601         if (IS_ERR(wdev)) {
8602                 err = PTR_ERR(wdev);
8603                 if (err != -EINVAL)
8604                         return err;
8605                 wdev = NULL;
8606         } else if (wdev->wiphy != &rdev->wiphy) {
8607                 return -EINVAL;
8608         }
8609
8610         if (!info->attrs[NL80211_ATTR_TESTDATA])
8611                 return -EINVAL;
8612
8613         rdev->cur_cmd_info = info;
8614         err = rdev_testmode_cmd(rdev, wdev,
8615                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
8616                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
8617         rdev->cur_cmd_info = NULL;
8618
8619         return err;
8620 }
8621
8622 static int nl80211_testmode_dump(struct sk_buff *skb,
8623                                  struct netlink_callback *cb)
8624 {
8625         struct cfg80211_registered_device *rdev;
8626         int err;
8627         long phy_idx;
8628         void *data = NULL;
8629         int data_len = 0;
8630
8631         rtnl_lock();
8632
8633         if (cb->args[0]) {
8634                 /*
8635                  * 0 is a valid index, but not valid for args[0],
8636                  * so we need to offset by 1.
8637                  */
8638                 phy_idx = cb->args[0] - 1;
8639
8640                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
8641                 if (!rdev) {
8642                         err = -ENOENT;
8643                         goto out_err;
8644                 }
8645         } else {
8646                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8647
8648                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
8649                                   attrbuf, nl80211_fam.maxattr, nl80211_policy);
8650                 if (err)
8651                         goto out_err;
8652
8653                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
8654                 if (IS_ERR(rdev)) {
8655                         err = PTR_ERR(rdev);
8656                         goto out_err;
8657                 }
8658                 phy_idx = rdev->wiphy_idx;
8659
8660                 if (attrbuf[NL80211_ATTR_TESTDATA])
8661                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
8662         }
8663
8664         if (cb->args[1]) {
8665                 data = nla_data((void *)cb->args[1]);
8666                 data_len = nla_len((void *)cb->args[1]);
8667         }
8668
8669         if (!rdev->ops->testmode_dump) {
8670                 err = -EOPNOTSUPP;
8671                 goto out_err;
8672         }
8673
8674         while (1) {
8675                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
8676                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
8677                                            NL80211_CMD_TESTMODE);
8678                 struct nlattr *tmdata;
8679
8680                 if (!hdr)
8681                         break;
8682
8683                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
8684                         genlmsg_cancel(skb, hdr);
8685                         break;
8686                 }
8687
8688                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
8689                 if (!tmdata) {
8690                         genlmsg_cancel(skb, hdr);
8691                         break;
8692                 }
8693                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
8694                 nla_nest_end(skb, tmdata);
8695
8696                 if (err == -ENOBUFS || err == -ENOENT) {
8697                         genlmsg_cancel(skb, hdr);
8698                         break;
8699                 } else if (err) {
8700                         genlmsg_cancel(skb, hdr);
8701                         goto out_err;
8702                 }
8703
8704                 genlmsg_end(skb, hdr);
8705         }
8706
8707         err = skb->len;
8708         /* see above */
8709         cb->args[0] = phy_idx + 1;
8710  out_err:
8711         rtnl_unlock();
8712         return err;
8713 }
8714 #endif
8715
8716 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
8717 {
8718         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8719         struct net_device *dev = info->user_ptr[1];
8720         struct cfg80211_connect_params connect;
8721         struct wiphy *wiphy;
8722         struct cfg80211_cached_keys *connkeys = NULL;
8723         int err;
8724
8725         memset(&connect, 0, sizeof(connect));
8726
8727         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8728                 return -EINVAL;
8729
8730         if (!info->attrs[NL80211_ATTR_SSID] ||
8731             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8732                 return -EINVAL;
8733
8734         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
8735                 connect.auth_type =
8736                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8737                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
8738                                              NL80211_CMD_CONNECT))
8739                         return -EINVAL;
8740         } else
8741                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
8742
8743         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
8744
8745         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
8746                                       NL80211_MAX_NR_CIPHER_SUITES);
8747         if (err)
8748                 return err;
8749
8750         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8751             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8752                 return -EOPNOTSUPP;
8753
8754         wiphy = &rdev->wiphy;
8755
8756         connect.bg_scan_period = -1;
8757         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
8758                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
8759                 connect.bg_scan_period =
8760                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
8761         }
8762
8763         if (info->attrs[NL80211_ATTR_MAC])
8764                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8765         else if (info->attrs[NL80211_ATTR_MAC_HINT])
8766                 connect.bssid_hint =
8767                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
8768         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8769         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8770
8771         if (info->attrs[NL80211_ATTR_IE]) {
8772                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8773                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8774         }
8775
8776         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8777                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8778                 if (connect.mfp != NL80211_MFP_REQUIRED &&
8779                     connect.mfp != NL80211_MFP_NO)
8780                         return -EINVAL;
8781         } else {
8782                 connect.mfp = NL80211_MFP_NO;
8783         }
8784
8785         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8786                 connect.prev_bssid =
8787                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8788
8789         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8790                 connect.channel = nl80211_get_valid_chan(
8791                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8792                 if (!connect.channel)
8793                         return -EINVAL;
8794         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
8795                 connect.channel_hint = nl80211_get_valid_chan(
8796                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
8797                 if (!connect.channel_hint)
8798                         return -EINVAL;
8799         }
8800
8801         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8802                 connkeys = nl80211_parse_connkeys(rdev,
8803                                           info->attrs[NL80211_ATTR_KEYS], NULL);
8804                 if (IS_ERR(connkeys))
8805                         return PTR_ERR(connkeys);
8806         }
8807
8808         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8809                 connect.flags |= ASSOC_REQ_DISABLE_HT;
8810
8811         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8812                 memcpy(&connect.ht_capa_mask,
8813                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8814                        sizeof(connect.ht_capa_mask));
8815
8816         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8817                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
8818                         kzfree(connkeys);
8819                         return -EINVAL;
8820                 }
8821                 memcpy(&connect.ht_capa,
8822                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8823                        sizeof(connect.ht_capa));
8824         }
8825
8826         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8827                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
8828
8829         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8830                 memcpy(&connect.vht_capa_mask,
8831                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8832                        sizeof(connect.vht_capa_mask));
8833
8834         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8835                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
8836                         kzfree(connkeys);
8837                         return -EINVAL;
8838                 }
8839                 memcpy(&connect.vht_capa,
8840                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8841                        sizeof(connect.vht_capa));
8842         }
8843
8844         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8845                 if (!((rdev->wiphy.features &
8846                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8847                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8848                     !wiphy_ext_feature_isset(&rdev->wiphy,
8849                                              NL80211_EXT_FEATURE_RRM)) {
8850                         kzfree(connkeys);
8851                         return -EINVAL;
8852                 }
8853                 connect.flags |= ASSOC_REQ_USE_RRM;
8854         }
8855
8856         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
8857         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
8858                 kzfree(connkeys);
8859                 return -EOPNOTSUPP;
8860         }
8861
8862         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
8863                 /* bss selection makes no sense if bssid is set */
8864                 if (connect.bssid) {
8865                         kzfree(connkeys);
8866                         return -EINVAL;
8867                 }
8868
8869                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
8870                                        wiphy, &connect.bss_select);
8871                 if (err) {
8872                         kzfree(connkeys);
8873                         return err;
8874                 }
8875         }
8876
8877         wdev_lock(dev->ieee80211_ptr);
8878
8879         err = cfg80211_connect(rdev, dev, &connect, connkeys,
8880                                connect.prev_bssid);
8881         if (err)
8882                 kzfree(connkeys);
8883
8884         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8885                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
8886                 if (connect.bssid)
8887                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
8888                                connect.bssid, ETH_ALEN);
8889                 else
8890                         memset(dev->ieee80211_ptr->disconnect_bssid,
8891                                0, ETH_ALEN);
8892         }
8893
8894         wdev_unlock(dev->ieee80211_ptr);
8895
8896         return err;
8897 }
8898
8899 static int nl80211_update_connect_params(struct sk_buff *skb,
8900                                          struct genl_info *info)
8901 {
8902         struct cfg80211_connect_params connect = {};
8903         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8904         struct net_device *dev = info->user_ptr[1];
8905         struct wireless_dev *wdev = dev->ieee80211_ptr;
8906         u32 changed = 0;
8907         int ret;
8908
8909         if (!rdev->ops->update_connect_params)
8910                 return -EOPNOTSUPP;
8911
8912         if (info->attrs[NL80211_ATTR_IE]) {
8913                 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8914                         return -EINVAL;
8915                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8916                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8917                 changed |= UPDATE_ASSOC_IES;
8918         }
8919
8920         wdev_lock(dev->ieee80211_ptr);
8921         if (!wdev->current_bss)
8922                 ret = -ENOLINK;
8923         else
8924                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
8925         wdev_unlock(dev->ieee80211_ptr);
8926
8927         return ret;
8928 }
8929
8930 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
8931 {
8932         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8933         struct net_device *dev = info->user_ptr[1];
8934         u16 reason;
8935         int ret;
8936
8937         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8938                 reason = WLAN_REASON_DEAUTH_LEAVING;
8939         else
8940                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8941
8942         if (reason == 0)
8943                 return -EINVAL;
8944
8945         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8946             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8947                 return -EOPNOTSUPP;
8948
8949         wdev_lock(dev->ieee80211_ptr);
8950         ret = cfg80211_disconnect(rdev, dev, reason, true);
8951         wdev_unlock(dev->ieee80211_ptr);
8952         return ret;
8953 }
8954
8955 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
8956 {
8957         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8958         struct net *net;
8959         int err;
8960
8961         if (info->attrs[NL80211_ATTR_PID]) {
8962                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
8963
8964                 net = get_net_ns_by_pid(pid);
8965         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
8966                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
8967
8968                 net = get_net_ns_by_fd(fd);
8969         } else {
8970                 return -EINVAL;
8971         }
8972
8973         if (IS_ERR(net))
8974                 return PTR_ERR(net);
8975
8976         err = 0;
8977
8978         /* check if anything to do */
8979         if (!net_eq(wiphy_net(&rdev->wiphy), net))
8980                 err = cfg80211_switch_netns(rdev, net);
8981
8982         put_net(net);
8983         return err;
8984 }
8985
8986 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
8987 {
8988         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8989         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
8990                         struct cfg80211_pmksa *pmksa) = NULL;
8991         struct net_device *dev = info->user_ptr[1];
8992         struct cfg80211_pmksa pmksa;
8993
8994         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
8995
8996         if (!info->attrs[NL80211_ATTR_MAC])
8997                 return -EINVAL;
8998
8999         if (!info->attrs[NL80211_ATTR_PMKID])
9000                 return -EINVAL;
9001
9002         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9003         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9004
9005         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9006             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9007                 return -EOPNOTSUPP;
9008
9009         switch (info->genlhdr->cmd) {
9010         case NL80211_CMD_SET_PMKSA:
9011                 rdev_ops = rdev->ops->set_pmksa;
9012                 break;
9013         case NL80211_CMD_DEL_PMKSA:
9014                 rdev_ops = rdev->ops->del_pmksa;
9015                 break;
9016         default:
9017                 WARN_ON(1);
9018                 break;
9019         }
9020
9021         if (!rdev_ops)
9022                 return -EOPNOTSUPP;
9023
9024         return rdev_ops(&rdev->wiphy, dev, &pmksa);
9025 }
9026
9027 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9028 {
9029         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9030         struct net_device *dev = info->user_ptr[1];
9031
9032         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9033             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9034                 return -EOPNOTSUPP;
9035
9036         if (!rdev->ops->flush_pmksa)
9037                 return -EOPNOTSUPP;
9038
9039         return rdev_flush_pmksa(rdev, dev);
9040 }
9041
9042 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
9043 {
9044         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9045         struct net_device *dev = info->user_ptr[1];
9046         u8 action_code, dialog_token;
9047         u32 peer_capability = 0;
9048         u16 status_code;
9049         u8 *peer;
9050         bool initiator;
9051
9052         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9053             !rdev->ops->tdls_mgmt)
9054                 return -EOPNOTSUPP;
9055
9056         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
9057             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
9058             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
9059             !info->attrs[NL80211_ATTR_IE] ||
9060             !info->attrs[NL80211_ATTR_MAC])
9061                 return -EINVAL;
9062
9063         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9064         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
9065         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
9066         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
9067         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
9068         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
9069                 peer_capability =
9070                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
9071
9072         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
9073                               dialog_token, status_code, peer_capability,
9074                               initiator,
9075                               nla_data(info->attrs[NL80211_ATTR_IE]),
9076                               nla_len(info->attrs[NL80211_ATTR_IE]));
9077 }
9078
9079 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
9080 {
9081         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9082         struct net_device *dev = info->user_ptr[1];
9083         enum nl80211_tdls_operation operation;
9084         u8 *peer;
9085
9086         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9087             !rdev->ops->tdls_oper)
9088                 return -EOPNOTSUPP;
9089
9090         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
9091             !info->attrs[NL80211_ATTR_MAC])
9092                 return -EINVAL;
9093
9094         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
9095         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9096
9097         return rdev_tdls_oper(rdev, dev, peer, operation);
9098 }
9099
9100 static int nl80211_remain_on_channel(struct sk_buff *skb,
9101                                      struct genl_info *info)
9102 {
9103         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9104         struct wireless_dev *wdev = info->user_ptr[1];
9105         struct cfg80211_chan_def chandef;
9106         struct sk_buff *msg;
9107         void *hdr;
9108         u64 cookie;
9109         u32 duration;
9110         int err;
9111
9112         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9113             !info->attrs[NL80211_ATTR_DURATION])
9114                 return -EINVAL;
9115
9116         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9117
9118         if (!rdev->ops->remain_on_channel ||
9119             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
9120                 return -EOPNOTSUPP;
9121
9122         /*
9123          * We should be on that channel for at least a minimum amount of
9124          * time (10ms) but no longer than the driver supports.
9125          */
9126         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9127             duration > rdev->wiphy.max_remain_on_channel_duration)
9128                 return -EINVAL;
9129
9130         err = nl80211_parse_chandef(rdev, info, &chandef);
9131         if (err)
9132                 return err;
9133
9134         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9135         if (!msg)
9136                 return -ENOMEM;
9137
9138         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9139                              NL80211_CMD_REMAIN_ON_CHANNEL);
9140         if (!hdr) {
9141                 err = -ENOBUFS;
9142                 goto free_msg;
9143         }
9144
9145         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
9146                                      duration, &cookie);
9147
9148         if (err)
9149                 goto free_msg;
9150
9151         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9152                               NL80211_ATTR_PAD))
9153                 goto nla_put_failure;
9154
9155         genlmsg_end(msg, hdr);
9156
9157         return genlmsg_reply(msg, info);
9158
9159  nla_put_failure:
9160         err = -ENOBUFS;
9161  free_msg:
9162         nlmsg_free(msg);
9163         return err;
9164 }
9165
9166 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
9167                                             struct genl_info *info)
9168 {
9169         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9170         struct wireless_dev *wdev = info->user_ptr[1];
9171         u64 cookie;
9172
9173         if (!info->attrs[NL80211_ATTR_COOKIE])
9174                 return -EINVAL;
9175
9176         if (!rdev->ops->cancel_remain_on_channel)
9177                 return -EOPNOTSUPP;
9178
9179         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9180
9181         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9182 }
9183
9184 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9185                                        struct genl_info *info)
9186 {
9187         struct cfg80211_bitrate_mask mask;
9188         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9189         struct net_device *dev = info->user_ptr[1];
9190         int err;
9191
9192         if (!rdev->ops->set_bitrate_mask)
9193                 return -EOPNOTSUPP;
9194
9195         err = nl80211_parse_tx_bitrate_mask(info, &mask);
9196         if (err)
9197                 return err;
9198
9199         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9200 }
9201
9202 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9203 {
9204         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9205         struct wireless_dev *wdev = info->user_ptr[1];
9206         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9207
9208         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9209                 return -EINVAL;
9210
9211         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9212                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9213
9214         switch (wdev->iftype) {
9215         case NL80211_IFTYPE_STATION:
9216         case NL80211_IFTYPE_ADHOC:
9217         case NL80211_IFTYPE_P2P_CLIENT:
9218         case NL80211_IFTYPE_AP:
9219         case NL80211_IFTYPE_AP_VLAN:
9220         case NL80211_IFTYPE_MESH_POINT:
9221         case NL80211_IFTYPE_P2P_GO:
9222         case NL80211_IFTYPE_P2P_DEVICE:
9223                 break;
9224         case NL80211_IFTYPE_NAN:
9225         default:
9226                 return -EOPNOTSUPP;
9227         }
9228
9229         /* not much point in registering if we can't reply */
9230         if (!rdev->ops->mgmt_tx)
9231                 return -EOPNOTSUPP;
9232
9233         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9234                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9235                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9236 }
9237
9238 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9239 {
9240         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9241         struct wireless_dev *wdev = info->user_ptr[1];
9242         struct cfg80211_chan_def chandef;
9243         int err;
9244         void *hdr = NULL;
9245         u64 cookie;
9246         struct sk_buff *msg = NULL;
9247         struct cfg80211_mgmt_tx_params params = {
9248                 .dont_wait_for_ack =
9249                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9250         };
9251
9252         if (!info->attrs[NL80211_ATTR_FRAME])
9253                 return -EINVAL;
9254
9255         if (!rdev->ops->mgmt_tx)
9256                 return -EOPNOTSUPP;
9257
9258         switch (wdev->iftype) {
9259         case NL80211_IFTYPE_P2P_DEVICE:
9260                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9261                         return -EINVAL;
9262         case NL80211_IFTYPE_STATION:
9263         case NL80211_IFTYPE_ADHOC:
9264         case NL80211_IFTYPE_P2P_CLIENT:
9265         case NL80211_IFTYPE_AP:
9266         case NL80211_IFTYPE_AP_VLAN:
9267         case NL80211_IFTYPE_MESH_POINT:
9268         case NL80211_IFTYPE_P2P_GO:
9269                 break;
9270         case NL80211_IFTYPE_NAN:
9271         default:
9272                 return -EOPNOTSUPP;
9273         }
9274
9275         if (info->attrs[NL80211_ATTR_DURATION]) {
9276                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9277                         return -EINVAL;
9278                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9279
9280                 /*
9281                  * We should wait on the channel for at least a minimum amount
9282                  * of time (10ms) but no longer than the driver supports.
9283                  */
9284                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9285                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
9286                         return -EINVAL;
9287         }
9288
9289         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
9290
9291         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9292                 return -EINVAL;
9293
9294         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9295
9296         /* get the channel if any has been specified, otherwise pass NULL to
9297          * the driver. The latter will use the current one
9298          */
9299         chandef.chan = NULL;
9300         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9301                 err = nl80211_parse_chandef(rdev, info, &chandef);
9302                 if (err)
9303                         return err;
9304         }
9305
9306         if (!chandef.chan && params.offchan)
9307                 return -EINVAL;
9308
9309         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
9310         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
9311
9312         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
9313                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9314                 int i;
9315
9316                 if (len % sizeof(u16))
9317                         return -EINVAL;
9318
9319                 params.n_csa_offsets = len / sizeof(u16);
9320                 params.csa_offsets =
9321                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9322
9323                 /* check that all the offsets fit the frame */
9324                 for (i = 0; i < params.n_csa_offsets; i++) {
9325                         if (params.csa_offsets[i] >= params.len)
9326                                 return -EINVAL;
9327                 }
9328         }
9329
9330         if (!params.dont_wait_for_ack) {
9331                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9332                 if (!msg)
9333                         return -ENOMEM;
9334
9335                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9336                                      NL80211_CMD_FRAME);
9337                 if (!hdr) {
9338                         err = -ENOBUFS;
9339                         goto free_msg;
9340                 }
9341         }
9342
9343         params.chan = chandef.chan;
9344         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
9345         if (err)
9346                 goto free_msg;
9347
9348         if (msg) {
9349                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9350                                       NL80211_ATTR_PAD))
9351                         goto nla_put_failure;
9352
9353                 genlmsg_end(msg, hdr);
9354                 return genlmsg_reply(msg, info);
9355         }
9356
9357         return 0;
9358
9359  nla_put_failure:
9360         err = -ENOBUFS;
9361  free_msg:
9362         nlmsg_free(msg);
9363         return err;
9364 }
9365
9366 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
9367 {
9368         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9369         struct wireless_dev *wdev = info->user_ptr[1];
9370         u64 cookie;
9371
9372         if (!info->attrs[NL80211_ATTR_COOKIE])
9373                 return -EINVAL;
9374
9375         if (!rdev->ops->mgmt_tx_cancel_wait)
9376                 return -EOPNOTSUPP;
9377
9378         switch (wdev->iftype) {
9379         case NL80211_IFTYPE_STATION:
9380         case NL80211_IFTYPE_ADHOC:
9381         case NL80211_IFTYPE_P2P_CLIENT:
9382         case NL80211_IFTYPE_AP:
9383         case NL80211_IFTYPE_AP_VLAN:
9384         case NL80211_IFTYPE_P2P_GO:
9385         case NL80211_IFTYPE_P2P_DEVICE:
9386                 break;
9387         case NL80211_IFTYPE_NAN:
9388         default:
9389                 return -EOPNOTSUPP;
9390         }
9391
9392         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9393
9394         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
9395 }
9396
9397 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
9398 {
9399         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9400         struct wireless_dev *wdev;
9401         struct net_device *dev = info->user_ptr[1];
9402         u8 ps_state;
9403         bool state;
9404         int err;
9405
9406         if (!info->attrs[NL80211_ATTR_PS_STATE])
9407                 return -EINVAL;
9408
9409         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
9410
9411         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
9412                 return -EINVAL;
9413
9414         wdev = dev->ieee80211_ptr;
9415
9416         if (!rdev->ops->set_power_mgmt)
9417                 return -EOPNOTSUPP;
9418
9419         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
9420
9421         if (state == wdev->ps)
9422                 return 0;
9423
9424         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
9425         if (!err)
9426                 wdev->ps = state;
9427         return err;
9428 }
9429
9430 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
9431 {
9432         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9433         enum nl80211_ps_state ps_state;
9434         struct wireless_dev *wdev;
9435         struct net_device *dev = info->user_ptr[1];
9436         struct sk_buff *msg;
9437         void *hdr;
9438         int err;
9439
9440         wdev = dev->ieee80211_ptr;
9441
9442         if (!rdev->ops->set_power_mgmt)
9443                 return -EOPNOTSUPP;
9444
9445         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9446         if (!msg)
9447                 return -ENOMEM;
9448
9449         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9450                              NL80211_CMD_GET_POWER_SAVE);
9451         if (!hdr) {
9452                 err = -ENOBUFS;
9453                 goto free_msg;
9454         }
9455
9456         if (wdev->ps)
9457                 ps_state = NL80211_PS_ENABLED;
9458         else
9459                 ps_state = NL80211_PS_DISABLED;
9460
9461         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
9462                 goto nla_put_failure;
9463
9464         genlmsg_end(msg, hdr);
9465         return genlmsg_reply(msg, info);
9466
9467  nla_put_failure:
9468         err = -ENOBUFS;
9469  free_msg:
9470         nlmsg_free(msg);
9471         return err;
9472 }
9473
9474 static const struct nla_policy
9475 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
9476         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
9477         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
9478         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
9479         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
9480         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
9481         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
9482         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
9483 };
9484
9485 static int nl80211_set_cqm_txe(struct genl_info *info,
9486                                u32 rate, u32 pkts, u32 intvl)
9487 {
9488         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9489         struct net_device *dev = info->user_ptr[1];
9490         struct wireless_dev *wdev = dev->ieee80211_ptr;
9491
9492         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
9493                 return -EINVAL;
9494
9495         if (!rdev->ops->set_cqm_txe_config)
9496                 return -EOPNOTSUPP;
9497
9498         if (wdev->iftype != NL80211_IFTYPE_STATION &&
9499             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9500                 return -EOPNOTSUPP;
9501
9502         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
9503 }
9504
9505 static int nl80211_set_cqm_rssi(struct genl_info *info,
9506                                 s32 threshold, u32 hysteresis)
9507 {
9508         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9509         struct net_device *dev = info->user_ptr[1];
9510         struct wireless_dev *wdev = dev->ieee80211_ptr;
9511
9512         if (threshold > 0)
9513                 return -EINVAL;
9514
9515         /* disabling - hysteresis should also be zero then */
9516         if (threshold == 0)
9517                 hysteresis = 0;
9518
9519         if (!rdev->ops->set_cqm_rssi_config)
9520                 return -EOPNOTSUPP;
9521
9522         if (wdev->iftype != NL80211_IFTYPE_STATION &&
9523             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9524                 return -EOPNOTSUPP;
9525
9526         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
9527 }
9528
9529 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
9530 {
9531         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
9532         struct nlattr *cqm;
9533         int err;
9534
9535         cqm = info->attrs[NL80211_ATTR_CQM];
9536         if (!cqm)
9537                 return -EINVAL;
9538
9539         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
9540                                nl80211_attr_cqm_policy);
9541         if (err)
9542                 return err;
9543
9544         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
9545             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
9546                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9547                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
9548
9549                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
9550         }
9551
9552         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
9553             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
9554             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
9555                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
9556                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
9557                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
9558
9559                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
9560         }
9561
9562         return -EINVAL;
9563 }
9564
9565 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
9566 {
9567         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9568         struct net_device *dev = info->user_ptr[1];
9569         struct ocb_setup setup = {};
9570         int err;
9571
9572         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9573         if (err)
9574                 return err;
9575
9576         return cfg80211_join_ocb(rdev, dev, &setup);
9577 }
9578
9579 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
9580 {
9581         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9582         struct net_device *dev = info->user_ptr[1];
9583
9584         return cfg80211_leave_ocb(rdev, dev);
9585 }
9586
9587 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
9588 {
9589         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9590         struct net_device *dev = info->user_ptr[1];
9591         struct mesh_config cfg;
9592         struct mesh_setup setup;
9593         int err;
9594
9595         /* start with default */
9596         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
9597         memcpy(&setup, &default_mesh_setup, sizeof(setup));
9598
9599         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
9600                 /* and parse parameters if given */
9601                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
9602                 if (err)
9603                         return err;
9604         }
9605
9606         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
9607             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
9608                 return -EINVAL;
9609
9610         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
9611         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
9612
9613         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9614             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
9615                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9616                         return -EINVAL;
9617
9618         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
9619                 setup.beacon_interval =
9620                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9621
9622                 err = cfg80211_validate_beacon_int(rdev,
9623                                                    NL80211_IFTYPE_MESH_POINT,
9624                                                    setup.beacon_interval);
9625                 if (err)
9626                         return err;
9627         }
9628
9629         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
9630                 setup.dtim_period =
9631                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
9632                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
9633                         return -EINVAL;
9634         }
9635
9636         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
9637                 /* parse additional setup parameters if given */
9638                 err = nl80211_parse_mesh_setup(info, &setup);
9639                 if (err)
9640                         return err;
9641         }
9642
9643         if (setup.user_mpm)
9644                 cfg.auto_open_plinks = false;
9645
9646         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9647                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9648                 if (err)
9649                         return err;
9650         } else {
9651                 /* cfg80211_join_mesh() will sort it out */
9652                 setup.chandef.chan = NULL;
9653         }
9654
9655         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9656                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9657                 int n_rates =
9658                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9659                 struct ieee80211_supported_band *sband;
9660
9661                 if (!setup.chandef.chan)
9662                         return -EINVAL;
9663
9664                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
9665
9666                 err = ieee80211_get_ratemask(sband, rates, n_rates,
9667                                              &setup.basic_rates);
9668                 if (err)
9669                         return err;
9670         }
9671
9672         if (info->attrs[NL80211_ATTR_TX_RATES]) {
9673                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
9674                 if (err)
9675                         return err;
9676
9677                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
9678                                               &setup.beacon_rate);
9679                 if (err)
9680                         return err;
9681         }
9682
9683         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
9684 }
9685
9686 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
9687 {
9688         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9689         struct net_device *dev = info->user_ptr[1];
9690
9691         return cfg80211_leave_mesh(rdev, dev);
9692 }
9693
9694 #ifdef CONFIG_PM
9695 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
9696                                         struct cfg80211_registered_device *rdev)
9697 {
9698         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
9699         struct nlattr *nl_pats, *nl_pat;
9700         int i, pat_len;
9701
9702         if (!wowlan->n_patterns)
9703                 return 0;
9704
9705         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
9706         if (!nl_pats)
9707                 return -ENOBUFS;
9708
9709         for (i = 0; i < wowlan->n_patterns; i++) {
9710                 nl_pat = nla_nest_start(msg, i + 1);
9711                 if (!nl_pat)
9712                         return -ENOBUFS;
9713                 pat_len = wowlan->patterns[i].pattern_len;
9714                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
9715                             wowlan->patterns[i].mask) ||
9716                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9717                             wowlan->patterns[i].pattern) ||
9718                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9719                                 wowlan->patterns[i].pkt_offset))
9720                         return -ENOBUFS;
9721                 nla_nest_end(msg, nl_pat);
9722         }
9723         nla_nest_end(msg, nl_pats);
9724
9725         return 0;
9726 }
9727
9728 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
9729                                    struct cfg80211_wowlan_tcp *tcp)
9730 {
9731         struct nlattr *nl_tcp;
9732
9733         if (!tcp)
9734                 return 0;
9735
9736         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
9737         if (!nl_tcp)
9738                 return -ENOBUFS;
9739
9740         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
9741             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
9742             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
9743             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
9744             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
9745             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
9746                     tcp->payload_len, tcp->payload) ||
9747             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
9748                         tcp->data_interval) ||
9749             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
9750                     tcp->wake_len, tcp->wake_data) ||
9751             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
9752                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
9753                 return -ENOBUFS;
9754
9755         if (tcp->payload_seq.len &&
9756             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
9757                     sizeof(tcp->payload_seq), &tcp->payload_seq))
9758                 return -ENOBUFS;
9759
9760         if (tcp->payload_tok.len &&
9761             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
9762                     sizeof(tcp->payload_tok) + tcp->tokens_size,
9763                     &tcp->payload_tok))
9764                 return -ENOBUFS;
9765
9766         nla_nest_end(msg, nl_tcp);
9767
9768         return 0;
9769 }
9770
9771 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
9772                                   struct cfg80211_sched_scan_request *req)
9773 {
9774         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
9775         int i;
9776
9777         if (!req)
9778                 return 0;
9779
9780         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
9781         if (!nd)
9782                 return -ENOBUFS;
9783
9784         if (req->n_scan_plans == 1 &&
9785             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
9786                         req->scan_plans[0].interval * 1000))
9787                 return -ENOBUFS;
9788
9789         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
9790                 return -ENOBUFS;
9791
9792         if (req->relative_rssi_set) {
9793                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
9794
9795                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
9796                                req->relative_rssi))
9797                         return -ENOBUFS;
9798
9799                 rssi_adjust.band = req->rssi_adjust.band;
9800                 rssi_adjust.delta = req->rssi_adjust.delta;
9801                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
9802                             sizeof(rssi_adjust), &rssi_adjust))
9803                         return -ENOBUFS;
9804         }
9805
9806         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9807         if (!freqs)
9808                 return -ENOBUFS;
9809
9810         for (i = 0; i < req->n_channels; i++) {
9811                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9812                         return -ENOBUFS;
9813         }
9814
9815         nla_nest_end(msg, freqs);
9816
9817         if (req->n_match_sets) {
9818                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
9819                 if (!matches)
9820                         return -ENOBUFS;
9821
9822                 for (i = 0; i < req->n_match_sets; i++) {
9823                         match = nla_nest_start(msg, i);
9824                         if (!match)
9825                                 return -ENOBUFS;
9826
9827                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
9828                                     req->match_sets[i].ssid.ssid_len,
9829                                     req->match_sets[i].ssid.ssid))
9830                                 return -ENOBUFS;
9831                         nla_nest_end(msg, match);
9832                 }
9833                 nla_nest_end(msg, matches);
9834         }
9835
9836         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
9837         if (!scan_plans)
9838                 return -ENOBUFS;
9839
9840         for (i = 0; i < req->n_scan_plans; i++) {
9841                 scan_plan = nla_nest_start(msg, i + 1);
9842                 if (!scan_plan)
9843                         return -ENOBUFS;
9844
9845                 if (!scan_plan ||
9846                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
9847                                 req->scan_plans[i].interval) ||
9848                     (req->scan_plans[i].iterations &&
9849                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
9850                                  req->scan_plans[i].iterations)))
9851                         return -ENOBUFS;
9852                 nla_nest_end(msg, scan_plan);
9853         }
9854         nla_nest_end(msg, scan_plans);
9855
9856         nla_nest_end(msg, nd);
9857
9858         return 0;
9859 }
9860
9861 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
9862 {
9863         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9864         struct sk_buff *msg;
9865         void *hdr;
9866         u32 size = NLMSG_DEFAULT_SIZE;
9867
9868         if (!rdev->wiphy.wowlan)
9869                 return -EOPNOTSUPP;
9870
9871         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
9872                 /* adjust size to have room for all the data */
9873                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
9874                         rdev->wiphy.wowlan_config->tcp->payload_len +
9875                         rdev->wiphy.wowlan_config->tcp->wake_len +
9876                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
9877         }
9878
9879         msg = nlmsg_new(size, GFP_KERNEL);
9880         if (!msg)
9881                 return -ENOMEM;
9882
9883         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9884                              NL80211_CMD_GET_WOWLAN);
9885         if (!hdr)
9886                 goto nla_put_failure;
9887
9888         if (rdev->wiphy.wowlan_config) {
9889                 struct nlattr *nl_wowlan;
9890
9891                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9892                 if (!nl_wowlan)
9893                         goto nla_put_failure;
9894
9895                 if ((rdev->wiphy.wowlan_config->any &&
9896                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
9897                     (rdev->wiphy.wowlan_config->disconnect &&
9898                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
9899                     (rdev->wiphy.wowlan_config->magic_pkt &&
9900                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
9901                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
9902                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
9903                     (rdev->wiphy.wowlan_config->eap_identity_req &&
9904                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
9905                     (rdev->wiphy.wowlan_config->four_way_handshake &&
9906                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
9907                     (rdev->wiphy.wowlan_config->rfkill_release &&
9908                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
9909                         goto nla_put_failure;
9910
9911                 if (nl80211_send_wowlan_patterns(msg, rdev))
9912                         goto nla_put_failure;
9913
9914                 if (nl80211_send_wowlan_tcp(msg,
9915                                             rdev->wiphy.wowlan_config->tcp))
9916                         goto nla_put_failure;
9917
9918                 if (nl80211_send_wowlan_nd(
9919                             msg,
9920                             rdev->wiphy.wowlan_config->nd_config))
9921                         goto nla_put_failure;
9922
9923                 nla_nest_end(msg, nl_wowlan);
9924         }
9925
9926         genlmsg_end(msg, hdr);
9927         return genlmsg_reply(msg, info);
9928
9929 nla_put_failure:
9930         nlmsg_free(msg);
9931         return -ENOBUFS;
9932 }
9933
9934 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
9935                                     struct nlattr *attr,
9936                                     struct cfg80211_wowlan *trig)
9937 {
9938         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
9939         struct cfg80211_wowlan_tcp *cfg;
9940         struct nl80211_wowlan_tcp_data_token *tok = NULL;
9941         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
9942         u32 size;
9943         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
9944         int err, port;
9945
9946         if (!rdev->wiphy.wowlan->tcp)
9947                 return -EINVAL;
9948
9949         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
9950                                nl80211_wowlan_tcp_policy);
9951         if (err)
9952                 return err;
9953
9954         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
9955             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
9956             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
9957             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
9958             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
9959             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
9960             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
9961             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
9962                 return -EINVAL;
9963
9964         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
9965         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
9966                 return -EINVAL;
9967
9968         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
9969                         rdev->wiphy.wowlan->tcp->data_interval_max ||
9970             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
9971                 return -EINVAL;
9972
9973         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
9974         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
9975                 return -EINVAL;
9976
9977         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
9978         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
9979                 return -EINVAL;
9980
9981         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
9982                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9983
9984                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9985                 tokens_size = tokln - sizeof(*tok);
9986
9987                 if (!tok->len || tokens_size % tok->len)
9988                         return -EINVAL;
9989                 if (!rdev->wiphy.wowlan->tcp->tok)
9990                         return -EINVAL;
9991                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
9992                         return -EINVAL;
9993                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
9994                         return -EINVAL;
9995                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
9996                         return -EINVAL;
9997                 if (tok->offset + tok->len > data_size)
9998                         return -EINVAL;
9999         }
10000
10001         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
10002                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
10003                 if (!rdev->wiphy.wowlan->tcp->seq)
10004                         return -EINVAL;
10005                 if (seq->len == 0 || seq->len > 4)
10006                         return -EINVAL;
10007                 if (seq->len + seq->offset > data_size)
10008                         return -EINVAL;
10009         }
10010
10011         size = sizeof(*cfg);
10012         size += data_size;
10013         size += wake_size + wake_mask_size;
10014         size += tokens_size;
10015
10016         cfg = kzalloc(size, GFP_KERNEL);
10017         if (!cfg)
10018                 return -ENOMEM;
10019         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
10020         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
10021         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
10022                ETH_ALEN);
10023         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
10024                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
10025         else
10026                 port = 0;
10027 #ifdef CONFIG_INET
10028         /* allocate a socket and port for it and use it */
10029         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
10030                             IPPROTO_TCP, &cfg->sock, 1);
10031         if (err) {
10032                 kfree(cfg);
10033                 return err;
10034         }
10035         if (inet_csk_get_port(cfg->sock->sk, port)) {
10036                 sock_release(cfg->sock);
10037                 kfree(cfg);
10038                 return -EADDRINUSE;
10039         }
10040         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
10041 #else
10042         if (!port) {
10043                 kfree(cfg);
10044                 return -EINVAL;
10045         }
10046         cfg->src_port = port;
10047 #endif
10048
10049         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
10050         cfg->payload_len = data_size;
10051         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
10052         memcpy((void *)cfg->payload,
10053                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
10054                data_size);
10055         if (seq)
10056                 cfg->payload_seq = *seq;
10057         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
10058         cfg->wake_len = wake_size;
10059         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
10060         memcpy((void *)cfg->wake_data,
10061                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
10062                wake_size);
10063         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
10064                          data_size + wake_size;
10065         memcpy((void *)cfg->wake_mask,
10066                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
10067                wake_mask_size);
10068         if (tok) {
10069                 cfg->tokens_size = tokens_size;
10070                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
10071         }
10072
10073         trig->tcp = cfg;
10074
10075         return 0;
10076 }
10077
10078 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
10079                                    const struct wiphy_wowlan_support *wowlan,
10080                                    struct nlattr *attr,
10081                                    struct cfg80211_wowlan *trig)
10082 {
10083         struct nlattr **tb;
10084         int err;
10085
10086         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
10087         if (!tb)
10088                 return -ENOMEM;
10089
10090         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
10091                 err = -EOPNOTSUPP;
10092                 goto out;
10093         }
10094
10095         err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy);
10096         if (err)
10097                 goto out;
10098
10099         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
10100                                                    wowlan->max_nd_match_sets);
10101         err = PTR_ERR_OR_ZERO(trig->nd_config);
10102         if (err)
10103                 trig->nd_config = NULL;
10104
10105 out:
10106         kfree(tb);
10107         return err;
10108 }
10109
10110 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
10111 {
10112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10113         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
10114         struct cfg80211_wowlan new_triggers = {};
10115         struct cfg80211_wowlan *ntrig;
10116         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
10117         int err, i;
10118         bool prev_enabled = rdev->wiphy.wowlan_config;
10119         bool regular = false;
10120
10121         if (!wowlan)
10122                 return -EOPNOTSUPP;
10123
10124         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
10125                 cfg80211_rdev_free_wowlan(rdev);
10126                 rdev->wiphy.wowlan_config = NULL;
10127                 goto set_wakeup;
10128         }
10129
10130         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
10131                                info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
10132                                nl80211_wowlan_policy);
10133         if (err)
10134                 return err;
10135
10136         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
10137                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
10138                         return -EINVAL;
10139                 new_triggers.any = true;
10140         }
10141
10142         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
10143                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
10144                         return -EINVAL;
10145                 new_triggers.disconnect = true;
10146                 regular = true;
10147         }
10148
10149         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
10150                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
10151                         return -EINVAL;
10152                 new_triggers.magic_pkt = true;
10153                 regular = true;
10154         }
10155
10156         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
10157                 return -EINVAL;
10158
10159         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
10160                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
10161                         return -EINVAL;
10162                 new_triggers.gtk_rekey_failure = true;
10163                 regular = true;
10164         }
10165
10166         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
10167                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
10168                         return -EINVAL;
10169                 new_triggers.eap_identity_req = true;
10170                 regular = true;
10171         }
10172
10173         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
10174                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
10175                         return -EINVAL;
10176                 new_triggers.four_way_handshake = true;
10177                 regular = true;
10178         }
10179
10180         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
10181                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
10182                         return -EINVAL;
10183                 new_triggers.rfkill_release = true;
10184                 regular = true;
10185         }
10186
10187         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
10188                 struct nlattr *pat;
10189                 int n_patterns = 0;
10190                 int rem, pat_len, mask_len, pkt_offset;
10191                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10192
10193                 regular = true;
10194
10195                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10196                                     rem)
10197                         n_patterns++;
10198                 if (n_patterns > wowlan->n_patterns)
10199                         return -EINVAL;
10200
10201                 new_triggers.patterns = kcalloc(n_patterns,
10202                                                 sizeof(new_triggers.patterns[0]),
10203                                                 GFP_KERNEL);
10204                 if (!new_triggers.patterns)
10205                         return -ENOMEM;
10206
10207                 new_triggers.n_patterns = n_patterns;
10208                 i = 0;
10209
10210                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10211                                     rem) {
10212                         u8 *mask_pat;
10213
10214                         nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
10215                                          NULL);
10216                         err = -EINVAL;
10217                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
10218                             !pat_tb[NL80211_PKTPAT_PATTERN])
10219                                 goto error;
10220                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10221                         mask_len = DIV_ROUND_UP(pat_len, 8);
10222                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10223                                 goto error;
10224                         if (pat_len > wowlan->pattern_max_len ||
10225                             pat_len < wowlan->pattern_min_len)
10226                                 goto error;
10227
10228                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
10229                                 pkt_offset = 0;
10230                         else
10231                                 pkt_offset = nla_get_u32(
10232                                         pat_tb[NL80211_PKTPAT_OFFSET]);
10233                         if (pkt_offset > wowlan->max_pkt_offset)
10234                                 goto error;
10235                         new_triggers.patterns[i].pkt_offset = pkt_offset;
10236
10237                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10238                         if (!mask_pat) {
10239                                 err = -ENOMEM;
10240                                 goto error;
10241                         }
10242                         new_triggers.patterns[i].mask = mask_pat;
10243                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10244                                mask_len);
10245                         mask_pat += mask_len;
10246                         new_triggers.patterns[i].pattern = mask_pat;
10247                         new_triggers.patterns[i].pattern_len = pat_len;
10248                         memcpy(mask_pat,
10249                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10250                                pat_len);
10251                         i++;
10252                 }
10253         }
10254
10255         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
10256                 regular = true;
10257                 err = nl80211_parse_wowlan_tcp(
10258                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
10259                         &new_triggers);
10260                 if (err)
10261                         goto error;
10262         }
10263
10264         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
10265                 regular = true;
10266                 err = nl80211_parse_wowlan_nd(
10267                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
10268                         &new_triggers);
10269                 if (err)
10270                         goto error;
10271         }
10272
10273         /* The 'any' trigger means the device continues operating more or less
10274          * as in its normal operation mode and wakes up the host on most of the
10275          * normal interrupts (like packet RX, ...)
10276          * It therefore makes little sense to combine with the more constrained
10277          * wakeup trigger modes.
10278          */
10279         if (new_triggers.any && regular) {
10280                 err = -EINVAL;
10281                 goto error;
10282         }
10283
10284         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
10285         if (!ntrig) {
10286                 err = -ENOMEM;
10287                 goto error;
10288         }
10289         cfg80211_rdev_free_wowlan(rdev);
10290         rdev->wiphy.wowlan_config = ntrig;
10291
10292  set_wakeup:
10293         if (rdev->ops->set_wakeup &&
10294             prev_enabled != !!rdev->wiphy.wowlan_config)
10295                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
10296
10297         return 0;
10298  error:
10299         for (i = 0; i < new_triggers.n_patterns; i++)
10300                 kfree(new_triggers.patterns[i].mask);
10301         kfree(new_triggers.patterns);
10302         if (new_triggers.tcp && new_triggers.tcp->sock)
10303                 sock_release(new_triggers.tcp->sock);
10304         kfree(new_triggers.tcp);
10305         kfree(new_triggers.nd_config);
10306         return err;
10307 }
10308 #endif
10309
10310 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
10311                                        struct cfg80211_registered_device *rdev)
10312 {
10313         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
10314         int i, j, pat_len;
10315         struct cfg80211_coalesce_rules *rule;
10316
10317         if (!rdev->coalesce->n_rules)
10318                 return 0;
10319
10320         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
10321         if (!nl_rules)
10322                 return -ENOBUFS;
10323
10324         for (i = 0; i < rdev->coalesce->n_rules; i++) {
10325                 nl_rule = nla_nest_start(msg, i + 1);
10326                 if (!nl_rule)
10327                         return -ENOBUFS;
10328
10329                 rule = &rdev->coalesce->rules[i];
10330                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
10331                                 rule->delay))
10332                         return -ENOBUFS;
10333
10334                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
10335                                 rule->condition))
10336                         return -ENOBUFS;
10337
10338                 nl_pats = nla_nest_start(msg,
10339                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
10340                 if (!nl_pats)
10341                         return -ENOBUFS;
10342
10343                 for (j = 0; j < rule->n_patterns; j++) {
10344                         nl_pat = nla_nest_start(msg, j + 1);
10345                         if (!nl_pat)
10346                                 return -ENOBUFS;
10347                         pat_len = rule->patterns[j].pattern_len;
10348                         if (nla_put(msg, NL80211_PKTPAT_MASK,
10349                                     DIV_ROUND_UP(pat_len, 8),
10350                                     rule->patterns[j].mask) ||
10351                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10352                                     rule->patterns[j].pattern) ||
10353                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10354                                         rule->patterns[j].pkt_offset))
10355                                 return -ENOBUFS;
10356                         nla_nest_end(msg, nl_pat);
10357                 }
10358                 nla_nest_end(msg, nl_pats);
10359                 nla_nest_end(msg, nl_rule);
10360         }
10361         nla_nest_end(msg, nl_rules);
10362
10363         return 0;
10364 }
10365
10366 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
10367 {
10368         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10369         struct sk_buff *msg;
10370         void *hdr;
10371
10372         if (!rdev->wiphy.coalesce)
10373                 return -EOPNOTSUPP;
10374
10375         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10376         if (!msg)
10377                 return -ENOMEM;
10378
10379         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10380                              NL80211_CMD_GET_COALESCE);
10381         if (!hdr)
10382                 goto nla_put_failure;
10383
10384         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
10385                 goto nla_put_failure;
10386
10387         genlmsg_end(msg, hdr);
10388         return genlmsg_reply(msg, info);
10389
10390 nla_put_failure:
10391         nlmsg_free(msg);
10392         return -ENOBUFS;
10393 }
10394
10395 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
10396 {
10397         struct cfg80211_coalesce *coalesce = rdev->coalesce;
10398         int i, j;
10399         struct cfg80211_coalesce_rules *rule;
10400
10401         if (!coalesce)
10402                 return;
10403
10404         for (i = 0; i < coalesce->n_rules; i++) {
10405                 rule = &coalesce->rules[i];
10406                 for (j = 0; j < rule->n_patterns; j++)
10407                         kfree(rule->patterns[j].mask);
10408                 kfree(rule->patterns);
10409         }
10410         kfree(coalesce->rules);
10411         kfree(coalesce);
10412         rdev->coalesce = NULL;
10413 }
10414
10415 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
10416                                        struct nlattr *rule,
10417                                        struct cfg80211_coalesce_rules *new_rule)
10418 {
10419         int err, i;
10420         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10421         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
10422         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
10423         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10424
10425         err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
10426                                nl80211_coalesce_policy);
10427         if (err)
10428                 return err;
10429
10430         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
10431                 new_rule->delay =
10432                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
10433         if (new_rule->delay > coalesce->max_delay)
10434                 return -EINVAL;
10435
10436         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
10437                 new_rule->condition =
10438                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
10439         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
10440             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
10441                 return -EINVAL;
10442
10443         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
10444                 return -EINVAL;
10445
10446         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10447                             rem)
10448                 n_patterns++;
10449         if (n_patterns > coalesce->n_patterns)
10450                 return -EINVAL;
10451
10452         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
10453                                      GFP_KERNEL);
10454         if (!new_rule->patterns)
10455                 return -ENOMEM;
10456
10457         new_rule->n_patterns = n_patterns;
10458         i = 0;
10459
10460         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10461                             rem) {
10462                 u8 *mask_pat;
10463
10464                 nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, NULL);
10465                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
10466                     !pat_tb[NL80211_PKTPAT_PATTERN])
10467                         return -EINVAL;
10468                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10469                 mask_len = DIV_ROUND_UP(pat_len, 8);
10470                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10471                         return -EINVAL;
10472                 if (pat_len > coalesce->pattern_max_len ||
10473                     pat_len < coalesce->pattern_min_len)
10474                         return -EINVAL;
10475
10476                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
10477                         pkt_offset = 0;
10478                 else
10479                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
10480                 if (pkt_offset > coalesce->max_pkt_offset)
10481                         return -EINVAL;
10482                 new_rule->patterns[i].pkt_offset = pkt_offset;
10483
10484                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10485                 if (!mask_pat)
10486                         return -ENOMEM;
10487
10488                 new_rule->patterns[i].mask = mask_pat;
10489                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10490                        mask_len);
10491
10492                 mask_pat += mask_len;
10493                 new_rule->patterns[i].pattern = mask_pat;
10494                 new_rule->patterns[i].pattern_len = pat_len;
10495                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10496                        pat_len);
10497                 i++;
10498         }
10499
10500         return 0;
10501 }
10502
10503 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
10504 {
10505         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10506         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10507         struct cfg80211_coalesce new_coalesce = {};
10508         struct cfg80211_coalesce *n_coalesce;
10509         int err, rem_rule, n_rules = 0, i, j;
10510         struct nlattr *rule;
10511         struct cfg80211_coalesce_rules *tmp_rule;
10512
10513         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
10514                 return -EOPNOTSUPP;
10515
10516         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
10517                 cfg80211_rdev_free_coalesce(rdev);
10518                 rdev_set_coalesce(rdev, NULL);
10519                 return 0;
10520         }
10521
10522         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10523                             rem_rule)
10524                 n_rules++;
10525         if (n_rules > coalesce->n_rules)
10526                 return -EINVAL;
10527
10528         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
10529                                      GFP_KERNEL);
10530         if (!new_coalesce.rules)
10531                 return -ENOMEM;
10532
10533         new_coalesce.n_rules = n_rules;
10534         i = 0;
10535
10536         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10537                             rem_rule) {
10538                 err = nl80211_parse_coalesce_rule(rdev, rule,
10539                                                   &new_coalesce.rules[i]);
10540                 if (err)
10541                         goto error;
10542
10543                 i++;
10544         }
10545
10546         err = rdev_set_coalesce(rdev, &new_coalesce);
10547         if (err)
10548                 goto error;
10549
10550         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
10551         if (!n_coalesce) {
10552                 err = -ENOMEM;
10553                 goto error;
10554         }
10555         cfg80211_rdev_free_coalesce(rdev);
10556         rdev->coalesce = n_coalesce;
10557
10558         return 0;
10559 error:
10560         for (i = 0; i < new_coalesce.n_rules; i++) {
10561                 tmp_rule = &new_coalesce.rules[i];
10562                 for (j = 0; j < tmp_rule->n_patterns; j++)
10563                         kfree(tmp_rule->patterns[j].mask);
10564                 kfree(tmp_rule->patterns);
10565         }
10566         kfree(new_coalesce.rules);
10567
10568         return err;
10569 }
10570
10571 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
10572 {
10573         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10574         struct net_device *dev = info->user_ptr[1];
10575         struct wireless_dev *wdev = dev->ieee80211_ptr;
10576         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
10577         struct cfg80211_gtk_rekey_data rekey_data;
10578         int err;
10579
10580         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
10581                 return -EINVAL;
10582
10583         err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
10584                                info->attrs[NL80211_ATTR_REKEY_DATA],
10585                                nl80211_rekey_policy);
10586         if (err)
10587                 return err;
10588
10589         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
10590                 return -ERANGE;
10591         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
10592                 return -ERANGE;
10593         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
10594                 return -ERANGE;
10595
10596         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
10597         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
10598         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
10599
10600         wdev_lock(wdev);
10601         if (!wdev->current_bss) {
10602                 err = -ENOTCONN;
10603                 goto out;
10604         }
10605
10606         if (!rdev->ops->set_rekey_data) {
10607                 err = -EOPNOTSUPP;
10608                 goto out;
10609         }
10610
10611         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
10612  out:
10613         wdev_unlock(wdev);
10614         return err;
10615 }
10616
10617 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
10618                                              struct genl_info *info)
10619 {
10620         struct net_device *dev = info->user_ptr[1];
10621         struct wireless_dev *wdev = dev->ieee80211_ptr;
10622
10623         if (wdev->iftype != NL80211_IFTYPE_AP &&
10624             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10625                 return -EINVAL;
10626
10627         if (wdev->ap_unexpected_nlportid)
10628                 return -EBUSY;
10629
10630         wdev->ap_unexpected_nlportid = info->snd_portid;
10631         return 0;
10632 }
10633
10634 static int nl80211_probe_client(struct sk_buff *skb,
10635                                 struct genl_info *info)
10636 {
10637         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10638         struct net_device *dev = info->user_ptr[1];
10639         struct wireless_dev *wdev = dev->ieee80211_ptr;
10640         struct sk_buff *msg;
10641         void *hdr;
10642         const u8 *addr;
10643         u64 cookie;
10644         int err;
10645
10646         if (wdev->iftype != NL80211_IFTYPE_AP &&
10647             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10648                 return -EOPNOTSUPP;
10649
10650         if (!info->attrs[NL80211_ATTR_MAC])
10651                 return -EINVAL;
10652
10653         if (!rdev->ops->probe_client)
10654                 return -EOPNOTSUPP;
10655
10656         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10657         if (!msg)
10658                 return -ENOMEM;
10659
10660         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10661                              NL80211_CMD_PROBE_CLIENT);
10662         if (!hdr) {
10663                 err = -ENOBUFS;
10664                 goto free_msg;
10665         }
10666
10667         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10668
10669         err = rdev_probe_client(rdev, dev, addr, &cookie);
10670         if (err)
10671                 goto free_msg;
10672
10673         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10674                               NL80211_ATTR_PAD))
10675                 goto nla_put_failure;
10676
10677         genlmsg_end(msg, hdr);
10678
10679         return genlmsg_reply(msg, info);
10680
10681  nla_put_failure:
10682         err = -ENOBUFS;
10683  free_msg:
10684         nlmsg_free(msg);
10685         return err;
10686 }
10687
10688 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
10689 {
10690         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10691         struct cfg80211_beacon_registration *reg, *nreg;
10692         int rv;
10693
10694         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
10695                 return -EOPNOTSUPP;
10696
10697         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
10698         if (!nreg)
10699                 return -ENOMEM;
10700
10701         /* First, check if already registered. */
10702         spin_lock_bh(&rdev->beacon_registrations_lock);
10703         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10704                 if (reg->nlportid == info->snd_portid) {
10705                         rv = -EALREADY;
10706                         goto out_err;
10707                 }
10708         }
10709         /* Add it to the list */
10710         nreg->nlportid = info->snd_portid;
10711         list_add(&nreg->list, &rdev->beacon_registrations);
10712
10713         spin_unlock_bh(&rdev->beacon_registrations_lock);
10714
10715         return 0;
10716 out_err:
10717         spin_unlock_bh(&rdev->beacon_registrations_lock);
10718         kfree(nreg);
10719         return rv;
10720 }
10721
10722 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
10723 {
10724         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10725         struct wireless_dev *wdev = info->user_ptr[1];
10726         int err;
10727
10728         if (!rdev->ops->start_p2p_device)
10729                 return -EOPNOTSUPP;
10730
10731         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10732                 return -EOPNOTSUPP;
10733
10734         if (wdev_running(wdev))
10735                 return 0;
10736
10737         if (rfkill_blocked(rdev->rfkill))
10738                 return -ERFKILL;
10739
10740         err = rdev_start_p2p_device(rdev, wdev);
10741         if (err)
10742                 return err;
10743
10744         wdev->is_running = true;
10745         rdev->opencount++;
10746
10747         return 0;
10748 }
10749
10750 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
10751 {
10752         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10753         struct wireless_dev *wdev = info->user_ptr[1];
10754
10755         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10756                 return -EOPNOTSUPP;
10757
10758         if (!rdev->ops->stop_p2p_device)
10759                 return -EOPNOTSUPP;
10760
10761         cfg80211_stop_p2p_device(rdev, wdev);
10762
10763         return 0;
10764 }
10765
10766 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
10767 {
10768         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10769         struct wireless_dev *wdev = info->user_ptr[1];
10770         struct cfg80211_nan_conf conf = {};
10771         int err;
10772
10773         if (wdev->iftype != NL80211_IFTYPE_NAN)
10774                 return -EOPNOTSUPP;
10775
10776         if (wdev_running(wdev))
10777                 return -EEXIST;
10778
10779         if (rfkill_blocked(rdev->rfkill))
10780                 return -ERFKILL;
10781
10782         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
10783                 return -EINVAL;
10784
10785         conf.master_pref =
10786                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
10787         if (!conf.master_pref)
10788                 return -EINVAL;
10789
10790         if (info->attrs[NL80211_ATTR_BANDS]) {
10791                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
10792
10793                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
10794                         return -EOPNOTSUPP;
10795
10796                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
10797                         return -EINVAL;
10798
10799                 conf.bands = bands;
10800         }
10801
10802         err = rdev_start_nan(rdev, wdev, &conf);
10803         if (err)
10804                 return err;
10805
10806         wdev->is_running = true;
10807         rdev->opencount++;
10808
10809         return 0;
10810 }
10811
10812 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
10813 {
10814         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10815         struct wireless_dev *wdev = info->user_ptr[1];
10816
10817         if (wdev->iftype != NL80211_IFTYPE_NAN)
10818                 return -EOPNOTSUPP;
10819
10820         cfg80211_stop_nan(rdev, wdev);
10821
10822         return 0;
10823 }
10824
10825 static int validate_nan_filter(struct nlattr *filter_attr)
10826 {
10827         struct nlattr *attr;
10828         int len = 0, n_entries = 0, rem;
10829
10830         nla_for_each_nested(attr, filter_attr, rem) {
10831                 len += nla_len(attr);
10832                 n_entries++;
10833         }
10834
10835         if (len >= U8_MAX)
10836                 return -EINVAL;
10837
10838         return n_entries;
10839 }
10840
10841 static int handle_nan_filter(struct nlattr *attr_filter,
10842                              struct cfg80211_nan_func *func,
10843                              bool tx)
10844 {
10845         struct nlattr *attr;
10846         int n_entries, rem, i;
10847         struct cfg80211_nan_func_filter *filter;
10848
10849         n_entries = validate_nan_filter(attr_filter);
10850         if (n_entries < 0)
10851                 return n_entries;
10852
10853         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
10854
10855         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
10856         if (!filter)
10857                 return -ENOMEM;
10858
10859         i = 0;
10860         nla_for_each_nested(attr, attr_filter, rem) {
10861                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
10862                 filter[i].len = nla_len(attr);
10863                 i++;
10864         }
10865         if (tx) {
10866                 func->num_tx_filters = n_entries;
10867                 func->tx_filters = filter;
10868         } else {
10869                 func->num_rx_filters = n_entries;
10870                 func->rx_filters = filter;
10871         }
10872
10873         return 0;
10874 }
10875
10876 static int nl80211_nan_add_func(struct sk_buff *skb,
10877                                 struct genl_info *info)
10878 {
10879         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10880         struct wireless_dev *wdev = info->user_ptr[1];
10881         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
10882         struct cfg80211_nan_func *func;
10883         struct sk_buff *msg = NULL;
10884         void *hdr = NULL;
10885         int err = 0;
10886
10887         if (wdev->iftype != NL80211_IFTYPE_NAN)
10888                 return -EOPNOTSUPP;
10889
10890         if (!wdev_running(wdev))
10891                 return -ENOTCONN;
10892
10893         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
10894                 return -EINVAL;
10895
10896         if (wdev->owner_nlportid &&
10897             wdev->owner_nlportid != info->snd_portid)
10898                 return -ENOTCONN;
10899
10900         err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
10901                                info->attrs[NL80211_ATTR_NAN_FUNC],
10902                                nl80211_nan_func_policy);
10903         if (err)
10904                 return err;
10905
10906         func = kzalloc(sizeof(*func), GFP_KERNEL);
10907         if (!func)
10908                 return -ENOMEM;
10909
10910         func->cookie = wdev->wiphy->cookie_counter++;
10911
10912         if (!tb[NL80211_NAN_FUNC_TYPE] ||
10913             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
10914                 err = -EINVAL;
10915                 goto out;
10916         }
10917
10918
10919         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
10920
10921         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
10922                 err = -EINVAL;
10923                 goto out;
10924         }
10925
10926         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
10927                sizeof(func->service_id));
10928
10929         func->close_range =
10930                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
10931
10932         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
10933                 func->serv_spec_info_len =
10934                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
10935                 func->serv_spec_info =
10936                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
10937                                 func->serv_spec_info_len,
10938                                 GFP_KERNEL);
10939                 if (!func->serv_spec_info) {
10940                         err = -ENOMEM;
10941                         goto out;
10942                 }
10943         }
10944
10945         if (tb[NL80211_NAN_FUNC_TTL])
10946                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
10947
10948         switch (func->type) {
10949         case NL80211_NAN_FUNC_PUBLISH:
10950                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
10951                         err = -EINVAL;
10952                         goto out;
10953                 }
10954
10955                 func->publish_type =
10956                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
10957                 func->publish_bcast =
10958                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
10959
10960                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
10961                         func->publish_bcast) {
10962                         err = -EINVAL;
10963                         goto out;
10964                 }
10965                 break;
10966         case NL80211_NAN_FUNC_SUBSCRIBE:
10967                 func->subscribe_active =
10968                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
10969                 break;
10970         case NL80211_NAN_FUNC_FOLLOW_UP:
10971                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
10972                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) {
10973                         err = -EINVAL;
10974                         goto out;
10975                 }
10976
10977                 func->followup_id =
10978                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
10979                 func->followup_reqid =
10980                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
10981                 memcpy(func->followup_dest.addr,
10982                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
10983                        sizeof(func->followup_dest.addr));
10984                 if (func->ttl) {
10985                         err = -EINVAL;
10986                         goto out;
10987                 }
10988                 break;
10989         default:
10990                 err = -EINVAL;
10991                 goto out;
10992         }
10993
10994         if (tb[NL80211_NAN_FUNC_SRF]) {
10995                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
10996
10997                 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
10998                                        tb[NL80211_NAN_FUNC_SRF],
10999                                        nl80211_nan_srf_policy);
11000                 if (err)
11001                         goto out;
11002
11003                 func->srf_include =
11004                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
11005
11006                 if (srf_tb[NL80211_NAN_SRF_BF]) {
11007                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
11008                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
11009                                 err = -EINVAL;
11010                                 goto out;
11011                         }
11012
11013                         func->srf_bf_len =
11014                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
11015                         func->srf_bf =
11016                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
11017                                         func->srf_bf_len, GFP_KERNEL);
11018                         if (!func->srf_bf) {
11019                                 err = -ENOMEM;
11020                                 goto out;
11021                         }
11022
11023                         func->srf_bf_idx =
11024                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
11025                 } else {
11026                         struct nlattr *attr, *mac_attr =
11027                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
11028                         int n_entries, rem, i = 0;
11029
11030                         if (!mac_attr) {
11031                                 err = -EINVAL;
11032                                 goto out;
11033                         }
11034
11035                         n_entries = validate_acl_mac_addrs(mac_attr);
11036                         if (n_entries <= 0) {
11037                                 err = -EINVAL;
11038                                 goto out;
11039                         }
11040
11041                         func->srf_num_macs = n_entries;
11042                         func->srf_macs =
11043                                 kzalloc(sizeof(*func->srf_macs) * n_entries,
11044                                         GFP_KERNEL);
11045                         if (!func->srf_macs) {
11046                                 err = -ENOMEM;
11047                                 goto out;
11048                         }
11049
11050                         nla_for_each_nested(attr, mac_attr, rem)
11051                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
11052                                        sizeof(*func->srf_macs));
11053                 }
11054         }
11055
11056         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
11057                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
11058                                         func, true);
11059                 if (err)
11060                         goto out;
11061         }
11062
11063         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
11064                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
11065                                         func, false);
11066                 if (err)
11067                         goto out;
11068         }
11069
11070         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11071         if (!msg) {
11072                 err = -ENOMEM;
11073                 goto out;
11074         }
11075
11076         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11077                              NL80211_CMD_ADD_NAN_FUNCTION);
11078         /* This can't really happen - we just allocated 4KB */
11079         if (WARN_ON(!hdr)) {
11080                 err = -ENOMEM;
11081                 goto out;
11082         }
11083
11084         err = rdev_add_nan_func(rdev, wdev, func);
11085 out:
11086         if (err < 0) {
11087                 cfg80211_free_nan_func(func);
11088                 nlmsg_free(msg);
11089                 return err;
11090         }
11091
11092         /* propagate the instance id and cookie to userspace  */
11093         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
11094                               NL80211_ATTR_PAD))
11095                 goto nla_put_failure;
11096
11097         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11098         if (!func_attr)
11099                 goto nla_put_failure;
11100
11101         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
11102                        func->instance_id))
11103                 goto nla_put_failure;
11104
11105         nla_nest_end(msg, func_attr);
11106
11107         genlmsg_end(msg, hdr);
11108         return genlmsg_reply(msg, info);
11109
11110 nla_put_failure:
11111         nlmsg_free(msg);
11112         return -ENOBUFS;
11113 }
11114
11115 static int nl80211_nan_del_func(struct sk_buff *skb,
11116                                struct genl_info *info)
11117 {
11118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11119         struct wireless_dev *wdev = info->user_ptr[1];
11120         u64 cookie;
11121
11122         if (wdev->iftype != NL80211_IFTYPE_NAN)
11123                 return -EOPNOTSUPP;
11124
11125         if (!wdev_running(wdev))
11126                 return -ENOTCONN;
11127
11128         if (!info->attrs[NL80211_ATTR_COOKIE])
11129                 return -EINVAL;
11130
11131         if (wdev->owner_nlportid &&
11132             wdev->owner_nlportid != info->snd_portid)
11133                 return -ENOTCONN;
11134
11135         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11136
11137         rdev_del_nan_func(rdev, wdev, cookie);
11138
11139         return 0;
11140 }
11141
11142 static int nl80211_nan_change_config(struct sk_buff *skb,
11143                                      struct genl_info *info)
11144 {
11145         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11146         struct wireless_dev *wdev = info->user_ptr[1];
11147         struct cfg80211_nan_conf conf = {};
11148         u32 changed = 0;
11149
11150         if (wdev->iftype != NL80211_IFTYPE_NAN)
11151                 return -EOPNOTSUPP;
11152
11153         if (!wdev_running(wdev))
11154                 return -ENOTCONN;
11155
11156         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
11157                 conf.master_pref =
11158                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11159                 if (conf.master_pref <= 1 || conf.master_pref == 255)
11160                         return -EINVAL;
11161
11162                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
11163         }
11164
11165         if (info->attrs[NL80211_ATTR_BANDS]) {
11166                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11167
11168                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11169                         return -EOPNOTSUPP;
11170
11171                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11172                         return -EINVAL;
11173
11174                 conf.bands = bands;
11175                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
11176         }
11177
11178         if (!changed)
11179                 return -EINVAL;
11180
11181         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
11182 }
11183
11184 void cfg80211_nan_match(struct wireless_dev *wdev,
11185                         struct cfg80211_nan_match_params *match, gfp_t gfp)
11186 {
11187         struct wiphy *wiphy = wdev->wiphy;
11188         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11189         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
11190         struct sk_buff *msg;
11191         void *hdr;
11192
11193         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
11194                 return;
11195
11196         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11197         if (!msg)
11198                 return;
11199
11200         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
11201         if (!hdr) {
11202                 nlmsg_free(msg);
11203                 return;
11204         }
11205
11206         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11207             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11208                                          wdev->netdev->ifindex)) ||
11209             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11210                               NL80211_ATTR_PAD))
11211                 goto nla_put_failure;
11212
11213         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
11214                               NL80211_ATTR_PAD) ||
11215             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
11216                 goto nla_put_failure;
11217
11218         match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
11219         if (!match_attr)
11220                 goto nla_put_failure;
11221
11222         local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
11223         if (!local_func_attr)
11224                 goto nla_put_failure;
11225
11226         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
11227                 goto nla_put_failure;
11228
11229         nla_nest_end(msg, local_func_attr);
11230
11231         peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
11232         if (!peer_func_attr)
11233                 goto nla_put_failure;
11234
11235         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
11236             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
11237                 goto nla_put_failure;
11238
11239         if (match->info && match->info_len &&
11240             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
11241                     match->info))
11242                 goto nla_put_failure;
11243
11244         nla_nest_end(msg, peer_func_attr);
11245         nla_nest_end(msg, match_attr);
11246         genlmsg_end(msg, hdr);
11247
11248         if (!wdev->owner_nlportid)
11249                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11250                                         msg, 0, NL80211_MCGRP_NAN, gfp);
11251         else
11252                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11253                                 wdev->owner_nlportid);
11254
11255         return;
11256
11257 nla_put_failure:
11258         nlmsg_free(msg);
11259 }
11260 EXPORT_SYMBOL(cfg80211_nan_match);
11261
11262 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
11263                                   u8 inst_id,
11264                                   enum nl80211_nan_func_term_reason reason,
11265                                   u64 cookie, gfp_t gfp)
11266 {
11267         struct wiphy *wiphy = wdev->wiphy;
11268         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11269         struct sk_buff *msg;
11270         struct nlattr *func_attr;
11271         void *hdr;
11272
11273         if (WARN_ON(!inst_id))
11274                 return;
11275
11276         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11277         if (!msg)
11278                 return;
11279
11280         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
11281         if (!hdr) {
11282                 nlmsg_free(msg);
11283                 return;
11284         }
11285
11286         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11287             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11288                                          wdev->netdev->ifindex)) ||
11289             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11290                               NL80211_ATTR_PAD))
11291                 goto nla_put_failure;
11292
11293         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11294                               NL80211_ATTR_PAD))
11295                 goto nla_put_failure;
11296
11297         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11298         if (!func_attr)
11299                 goto nla_put_failure;
11300
11301         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
11302             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
11303                 goto nla_put_failure;
11304
11305         nla_nest_end(msg, func_attr);
11306         genlmsg_end(msg, hdr);
11307
11308         if (!wdev->owner_nlportid)
11309                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11310                                         msg, 0, NL80211_MCGRP_NAN, gfp);
11311         else
11312                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11313                                 wdev->owner_nlportid);
11314
11315         return;
11316
11317 nla_put_failure:
11318         nlmsg_free(msg);
11319 }
11320 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
11321
11322 static int nl80211_get_protocol_features(struct sk_buff *skb,
11323                                          struct genl_info *info)
11324 {
11325         void *hdr;
11326         struct sk_buff *msg;
11327
11328         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11329         if (!msg)
11330                 return -ENOMEM;
11331
11332         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11333                              NL80211_CMD_GET_PROTOCOL_FEATURES);
11334         if (!hdr)
11335                 goto nla_put_failure;
11336
11337         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
11338                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
11339                 goto nla_put_failure;
11340
11341         genlmsg_end(msg, hdr);
11342         return genlmsg_reply(msg, info);
11343
11344  nla_put_failure:
11345         kfree_skb(msg);
11346         return -ENOBUFS;
11347 }
11348
11349 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
11350 {
11351         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11352         struct cfg80211_update_ft_ies_params ft_params;
11353         struct net_device *dev = info->user_ptr[1];
11354
11355         if (!rdev->ops->update_ft_ies)
11356                 return -EOPNOTSUPP;
11357
11358         if (!info->attrs[NL80211_ATTR_MDID] ||
11359             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
11360                 return -EINVAL;
11361
11362         memset(&ft_params, 0, sizeof(ft_params));
11363         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
11364         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11365         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11366
11367         return rdev_update_ft_ies(rdev, dev, &ft_params);
11368 }
11369
11370 static int nl80211_crit_protocol_start(struct sk_buff *skb,
11371                                        struct genl_info *info)
11372 {
11373         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11374         struct wireless_dev *wdev = info->user_ptr[1];
11375         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
11376         u16 duration;
11377         int ret;
11378
11379         if (!rdev->ops->crit_proto_start)
11380                 return -EOPNOTSUPP;
11381
11382         if (WARN_ON(!rdev->ops->crit_proto_stop))
11383                 return -EINVAL;
11384
11385         if (rdev->crit_proto_nlportid)
11386                 return -EBUSY;
11387
11388         /* determine protocol if provided */
11389         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
11390                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
11391
11392         if (proto >= NUM_NL80211_CRIT_PROTO)
11393                 return -EINVAL;
11394
11395         /* timeout must be provided */
11396         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
11397                 return -EINVAL;
11398
11399         duration =
11400                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
11401
11402         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
11403                 return -ERANGE;
11404
11405         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
11406         if (!ret)
11407                 rdev->crit_proto_nlportid = info->snd_portid;
11408
11409         return ret;
11410 }
11411
11412 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
11413                                       struct genl_info *info)
11414 {
11415         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11416         struct wireless_dev *wdev = info->user_ptr[1];
11417
11418         if (!rdev->ops->crit_proto_stop)
11419                 return -EOPNOTSUPP;
11420
11421         if (rdev->crit_proto_nlportid) {
11422                 rdev->crit_proto_nlportid = 0;
11423                 rdev_crit_proto_stop(rdev, wdev);
11424         }
11425         return 0;
11426 }
11427
11428 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
11429 {
11430         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11431         struct wireless_dev *wdev =
11432                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
11433         int i, err;
11434         u32 vid, subcmd;
11435
11436         if (!rdev->wiphy.vendor_commands)
11437                 return -EOPNOTSUPP;
11438
11439         if (IS_ERR(wdev)) {
11440                 err = PTR_ERR(wdev);
11441                 if (err != -EINVAL)
11442                         return err;
11443                 wdev = NULL;
11444         } else if (wdev->wiphy != &rdev->wiphy) {
11445                 return -EINVAL;
11446         }
11447
11448         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
11449             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
11450                 return -EINVAL;
11451
11452         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
11453         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
11454         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
11455                 const struct wiphy_vendor_command *vcmd;
11456                 void *data = NULL;
11457                 int len = 0;
11458
11459                 vcmd = &rdev->wiphy.vendor_commands[i];
11460
11461                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11462                         continue;
11463
11464                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11465                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11466                         if (!wdev)
11467                                 return -EINVAL;
11468                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11469                             !wdev->netdev)
11470                                 return -EINVAL;
11471
11472                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11473                                 if (!wdev_running(wdev))
11474                                         return -ENETDOWN;
11475                         }
11476
11477                         if (!vcmd->doit)
11478                                 return -EOPNOTSUPP;
11479                 } else {
11480                         wdev = NULL;
11481                 }
11482
11483                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
11484                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11485                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11486                 }
11487
11488                 rdev->cur_cmd_info = info;
11489                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
11490                                                           data, len);
11491                 rdev->cur_cmd_info = NULL;
11492                 return err;
11493         }
11494
11495         return -EOPNOTSUPP;
11496 }
11497
11498 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
11499                                        struct netlink_callback *cb,
11500                                        struct cfg80211_registered_device **rdev,
11501                                        struct wireless_dev **wdev)
11502 {
11503         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
11504         u32 vid, subcmd;
11505         unsigned int i;
11506         int vcmd_idx = -1;
11507         int err;
11508         void *data = NULL;
11509         unsigned int data_len = 0;
11510
11511         rtnl_lock();
11512
11513         if (cb->args[0]) {
11514                 /* subtract the 1 again here */
11515                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
11516                 struct wireless_dev *tmp;
11517
11518                 if (!wiphy) {
11519                         err = -ENODEV;
11520                         goto out_unlock;
11521                 }
11522                 *rdev = wiphy_to_rdev(wiphy);
11523                 *wdev = NULL;
11524
11525                 if (cb->args[1]) {
11526                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
11527                                 if (tmp->identifier == cb->args[1] - 1) {
11528                                         *wdev = tmp;
11529                                         break;
11530                                 }
11531                         }
11532                 }
11533
11534                 /* keep rtnl locked in successful case */
11535                 return 0;
11536         }
11537
11538         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
11539                           attrbuf, nl80211_fam.maxattr, nl80211_policy);
11540         if (err)
11541                 goto out_unlock;
11542
11543         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
11544             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
11545                 err = -EINVAL;
11546                 goto out_unlock;
11547         }
11548
11549         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
11550         if (IS_ERR(*wdev))
11551                 *wdev = NULL;
11552
11553         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11554         if (IS_ERR(*rdev)) {
11555                 err = PTR_ERR(*rdev);
11556                 goto out_unlock;
11557         }
11558
11559         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
11560         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
11561
11562         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
11563                 const struct wiphy_vendor_command *vcmd;
11564
11565                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
11566
11567                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11568                         continue;
11569
11570                 if (!vcmd->dumpit) {
11571                         err = -EOPNOTSUPP;
11572                         goto out_unlock;
11573                 }
11574
11575                 vcmd_idx = i;
11576                 break;
11577         }
11578
11579         if (vcmd_idx < 0) {
11580                 err = -EOPNOTSUPP;
11581                 goto out_unlock;
11582         }
11583
11584         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
11585                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
11586                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
11587         }
11588
11589         /* 0 is the first index - add 1 to parse only once */
11590         cb->args[0] = (*rdev)->wiphy_idx + 1;
11591         /* add 1 to know if it was NULL */
11592         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
11593         cb->args[2] = vcmd_idx;
11594         cb->args[3] = (unsigned long)data;
11595         cb->args[4] = data_len;
11596
11597         /* keep rtnl locked in successful case */
11598         return 0;
11599  out_unlock:
11600         rtnl_unlock();
11601         return err;
11602 }
11603
11604 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
11605                                    struct netlink_callback *cb)
11606 {
11607         struct cfg80211_registered_device *rdev;
11608         struct wireless_dev *wdev;
11609         unsigned int vcmd_idx;
11610         const struct wiphy_vendor_command *vcmd;
11611         void *data;
11612         int data_len;
11613         int err;
11614         struct nlattr *vendor_data;
11615
11616         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
11617         if (err)
11618                 return err;
11619
11620         vcmd_idx = cb->args[2];
11621         data = (void *)cb->args[3];
11622         data_len = cb->args[4];
11623         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
11624
11625         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11626                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11627                 if (!wdev)
11628                         return -EINVAL;
11629                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11630                     !wdev->netdev)
11631                         return -EINVAL;
11632
11633                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11634                         if (!wdev_running(wdev))
11635                                 return -ENETDOWN;
11636                 }
11637         }
11638
11639         while (1) {
11640                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11641                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
11642                                            NL80211_CMD_VENDOR);
11643                 if (!hdr)
11644                         break;
11645
11646                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11647                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11648                                                wdev_id(wdev),
11649                                                NL80211_ATTR_PAD))) {
11650                         genlmsg_cancel(skb, hdr);
11651                         break;
11652                 }
11653
11654                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
11655                 if (!vendor_data) {
11656                         genlmsg_cancel(skb, hdr);
11657                         break;
11658                 }
11659
11660                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
11661                                    (unsigned long *)&cb->args[5]);
11662                 nla_nest_end(skb, vendor_data);
11663
11664                 if (err == -ENOBUFS || err == -ENOENT) {
11665                         genlmsg_cancel(skb, hdr);
11666                         break;
11667                 } else if (err) {
11668                         genlmsg_cancel(skb, hdr);
11669                         goto out;
11670                 }
11671
11672                 genlmsg_end(skb, hdr);
11673         }
11674
11675         err = skb->len;
11676  out:
11677         rtnl_unlock();
11678         return err;
11679 }
11680
11681 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
11682                                            enum nl80211_commands cmd,
11683                                            enum nl80211_attrs attr,
11684                                            int approxlen)
11685 {
11686         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11687
11688         if (WARN_ON(!rdev->cur_cmd_info))
11689                 return NULL;
11690
11691         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
11692                                            rdev->cur_cmd_info->snd_portid,
11693                                            rdev->cur_cmd_info->snd_seq,
11694                                            cmd, attr, NULL, GFP_KERNEL);
11695 }
11696 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
11697
11698 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
11699 {
11700         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11701         void *hdr = ((void **)skb->cb)[1];
11702         struct nlattr *data = ((void **)skb->cb)[2];
11703
11704         /* clear CB data for netlink core to own from now on */
11705         memset(skb->cb, 0, sizeof(skb->cb));
11706
11707         if (WARN_ON(!rdev->cur_cmd_info)) {
11708                 kfree_skb(skb);
11709                 return -EINVAL;
11710         }
11711
11712         nla_nest_end(skb, data);
11713         genlmsg_end(skb, hdr);
11714         return genlmsg_reply(skb, rdev->cur_cmd_info);
11715 }
11716 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
11717
11718 static int nl80211_set_qos_map(struct sk_buff *skb,
11719                                struct genl_info *info)
11720 {
11721         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11722         struct cfg80211_qos_map *qos_map = NULL;
11723         struct net_device *dev = info->user_ptr[1];
11724         u8 *pos, len, num_des, des_len, des;
11725         int ret;
11726
11727         if (!rdev->ops->set_qos_map)
11728                 return -EOPNOTSUPP;
11729
11730         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
11731                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
11732                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
11733
11734                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
11735                     len > IEEE80211_QOS_MAP_LEN_MAX)
11736                         return -EINVAL;
11737
11738                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
11739                 if (!qos_map)
11740                         return -ENOMEM;
11741
11742                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
11743                 if (num_des) {
11744                         des_len = num_des *
11745                                 sizeof(struct cfg80211_dscp_exception);
11746                         memcpy(qos_map->dscp_exception, pos, des_len);
11747                         qos_map->num_des = num_des;
11748                         for (des = 0; des < num_des; des++) {
11749                                 if (qos_map->dscp_exception[des].up > 7) {
11750                                         kfree(qos_map);
11751                                         return -EINVAL;
11752                                 }
11753                         }
11754                         pos += des_len;
11755                 }
11756                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
11757         }
11758
11759         wdev_lock(dev->ieee80211_ptr);
11760         ret = nl80211_key_allowed(dev->ieee80211_ptr);
11761         if (!ret)
11762                 ret = rdev_set_qos_map(rdev, dev, qos_map);
11763         wdev_unlock(dev->ieee80211_ptr);
11764
11765         kfree(qos_map);
11766         return ret;
11767 }
11768
11769 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
11770 {
11771         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11772         struct net_device *dev = info->user_ptr[1];
11773         struct wireless_dev *wdev = dev->ieee80211_ptr;
11774         const u8 *peer;
11775         u8 tsid, up;
11776         u16 admitted_time = 0;
11777         int err;
11778
11779         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
11780                 return -EOPNOTSUPP;
11781
11782         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
11783             !info->attrs[NL80211_ATTR_USER_PRIO])
11784                 return -EINVAL;
11785
11786         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
11787         if (tsid >= IEEE80211_NUM_TIDS)
11788                 return -EINVAL;
11789
11790         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
11791         if (up >= IEEE80211_NUM_UPS)
11792                 return -EINVAL;
11793
11794         /* WMM uses TIDs 0-7 even for TSPEC */
11795         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
11796                 /* TODO: handle 802.11 TSPEC/admission control
11797                  * need more attributes for that (e.g. BA session requirement);
11798                  * change the WMM adminssion test above to allow both then
11799                  */
11800                 return -EINVAL;
11801         }
11802
11803         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11804
11805         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
11806                 admitted_time =
11807                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
11808                 if (!admitted_time)
11809                         return -EINVAL;
11810         }
11811
11812         wdev_lock(wdev);
11813         switch (wdev->iftype) {
11814         case NL80211_IFTYPE_STATION:
11815         case NL80211_IFTYPE_P2P_CLIENT:
11816                 if (wdev->current_bss)
11817                         break;
11818                 err = -ENOTCONN;
11819                 goto out;
11820         default:
11821                 err = -EOPNOTSUPP;
11822                 goto out;
11823         }
11824
11825         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
11826
11827  out:
11828         wdev_unlock(wdev);
11829         return err;
11830 }
11831
11832 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
11833 {
11834         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11835         struct net_device *dev = info->user_ptr[1];
11836         struct wireless_dev *wdev = dev->ieee80211_ptr;
11837         const u8 *peer;
11838         u8 tsid;
11839         int err;
11840
11841         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
11842                 return -EINVAL;
11843
11844         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
11845         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11846
11847         wdev_lock(wdev);
11848         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
11849         wdev_unlock(wdev);
11850
11851         return err;
11852 }
11853
11854 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
11855                                        struct genl_info *info)
11856 {
11857         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11858         struct net_device *dev = info->user_ptr[1];
11859         struct wireless_dev *wdev = dev->ieee80211_ptr;
11860         struct cfg80211_chan_def chandef = {};
11861         const u8 *addr;
11862         u8 oper_class;
11863         int err;
11864
11865         if (!rdev->ops->tdls_channel_switch ||
11866             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
11867                 return -EOPNOTSUPP;
11868
11869         switch (dev->ieee80211_ptr->iftype) {
11870         case NL80211_IFTYPE_STATION:
11871         case NL80211_IFTYPE_P2P_CLIENT:
11872                 break;
11873         default:
11874                 return -EOPNOTSUPP;
11875         }
11876
11877         if (!info->attrs[NL80211_ATTR_MAC] ||
11878             !info->attrs[NL80211_ATTR_OPER_CLASS])
11879                 return -EINVAL;
11880
11881         err = nl80211_parse_chandef(rdev, info, &chandef);
11882         if (err)
11883                 return err;
11884
11885         /*
11886          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
11887          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
11888          * specification is not defined for them.
11889          */
11890         if (chandef.chan->band == NL80211_BAND_2GHZ &&
11891             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
11892             chandef.width != NL80211_CHAN_WIDTH_20)
11893                 return -EINVAL;
11894
11895         /* we will be active on the TDLS link */
11896         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
11897                                            wdev->iftype))
11898                 return -EINVAL;
11899
11900         /* don't allow switching to DFS channels */
11901         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
11902                 return -EINVAL;
11903
11904         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11905         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
11906
11907         wdev_lock(wdev);
11908         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
11909         wdev_unlock(wdev);
11910
11911         return err;
11912 }
11913
11914 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
11915                                               struct genl_info *info)
11916 {
11917         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11918         struct net_device *dev = info->user_ptr[1];
11919         struct wireless_dev *wdev = dev->ieee80211_ptr;
11920         const u8 *addr;
11921
11922         if (!rdev->ops->tdls_channel_switch ||
11923             !rdev->ops->tdls_cancel_channel_switch ||
11924             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
11925                 return -EOPNOTSUPP;
11926
11927         switch (dev->ieee80211_ptr->iftype) {
11928         case NL80211_IFTYPE_STATION:
11929         case NL80211_IFTYPE_P2P_CLIENT:
11930                 break;
11931         default:
11932                 return -EOPNOTSUPP;
11933         }
11934
11935         if (!info->attrs[NL80211_ATTR_MAC])
11936                 return -EINVAL;
11937
11938         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11939
11940         wdev_lock(wdev);
11941         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
11942         wdev_unlock(wdev);
11943
11944         return 0;
11945 }
11946
11947 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
11948                                             struct genl_info *info)
11949 {
11950         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11951         struct net_device *dev = info->user_ptr[1];
11952         struct wireless_dev *wdev = dev->ieee80211_ptr;
11953         const struct nlattr *nla;
11954         bool enabled;
11955
11956         if (!rdev->ops->set_multicast_to_unicast)
11957                 return -EOPNOTSUPP;
11958
11959         if (wdev->iftype != NL80211_IFTYPE_AP &&
11960             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11961                 return -EOPNOTSUPP;
11962
11963         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
11964         enabled = nla_get_flag(nla);
11965
11966         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
11967 }
11968
11969 #define NL80211_FLAG_NEED_WIPHY         0x01
11970 #define NL80211_FLAG_NEED_NETDEV        0x02
11971 #define NL80211_FLAG_NEED_RTNL          0x04
11972 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
11973 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
11974                                          NL80211_FLAG_CHECK_NETDEV_UP)
11975 #define NL80211_FLAG_NEED_WDEV          0x10
11976 /* If a netdev is associated, it must be UP, P2P must be started */
11977 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
11978                                          NL80211_FLAG_CHECK_NETDEV_UP)
11979 #define NL80211_FLAG_CLEAR_SKB          0x20
11980
11981 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
11982                             struct genl_info *info)
11983 {
11984         struct cfg80211_registered_device *rdev;
11985         struct wireless_dev *wdev;
11986         struct net_device *dev;
11987         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
11988
11989         if (rtnl)
11990                 rtnl_lock();
11991
11992         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
11993                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
11994                 if (IS_ERR(rdev)) {
11995                         if (rtnl)
11996                                 rtnl_unlock();
11997                         return PTR_ERR(rdev);
11998                 }
11999                 info->user_ptr[0] = rdev;
12000         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
12001                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
12002                 ASSERT_RTNL();
12003
12004                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
12005                                                   info->attrs);
12006                 if (IS_ERR(wdev)) {
12007                         if (rtnl)
12008                                 rtnl_unlock();
12009                         return PTR_ERR(wdev);
12010                 }
12011
12012                 dev = wdev->netdev;
12013                 rdev = wiphy_to_rdev(wdev->wiphy);
12014
12015                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
12016                         if (!dev) {
12017                                 if (rtnl)
12018                                         rtnl_unlock();
12019                                 return -EINVAL;
12020                         }
12021
12022                         info->user_ptr[1] = dev;
12023                 } else {
12024                         info->user_ptr[1] = wdev;
12025                 }
12026
12027                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
12028                     !wdev_running(wdev)) {
12029                         if (rtnl)
12030                                 rtnl_unlock();
12031                         return -ENETDOWN;
12032                 }
12033
12034                 if (dev)
12035                         dev_hold(dev);
12036
12037                 info->user_ptr[0] = rdev;
12038         }
12039
12040         return 0;
12041 }
12042
12043 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
12044                               struct genl_info *info)
12045 {
12046         if (info->user_ptr[1]) {
12047                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
12048                         struct wireless_dev *wdev = info->user_ptr[1];
12049
12050                         if (wdev->netdev)
12051                                 dev_put(wdev->netdev);
12052                 } else {
12053                         dev_put(info->user_ptr[1]);
12054                 }
12055         }
12056
12057         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
12058                 rtnl_unlock();
12059
12060         /* If needed, clear the netlink message payload from the SKB
12061          * as it might contain key data that shouldn't stick around on
12062          * the heap after the SKB is freed. The netlink message header
12063          * is still needed for further processing, so leave it intact.
12064          */
12065         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
12066                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
12067
12068                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
12069         }
12070 }
12071
12072 static const struct genl_ops nl80211_ops[] = {
12073         {
12074                 .cmd = NL80211_CMD_GET_WIPHY,
12075                 .doit = nl80211_get_wiphy,
12076                 .dumpit = nl80211_dump_wiphy,
12077                 .done = nl80211_dump_wiphy_done,
12078                 .policy = nl80211_policy,
12079                 /* can be retrieved by unprivileged users */
12080                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12081                                   NL80211_FLAG_NEED_RTNL,
12082         },
12083         {
12084                 .cmd = NL80211_CMD_SET_WIPHY,
12085                 .doit = nl80211_set_wiphy,
12086                 .policy = nl80211_policy,
12087                 .flags = GENL_UNS_ADMIN_PERM,
12088                 .internal_flags = NL80211_FLAG_NEED_RTNL,
12089         },
12090         {
12091                 .cmd = NL80211_CMD_GET_INTERFACE,
12092                 .doit = nl80211_get_interface,
12093                 .dumpit = nl80211_dump_interface,
12094                 .policy = nl80211_policy,
12095                 /* can be retrieved by unprivileged users */
12096                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12097                                   NL80211_FLAG_NEED_RTNL,
12098         },
12099         {
12100                 .cmd = NL80211_CMD_SET_INTERFACE,
12101                 .doit = nl80211_set_interface,
12102                 .policy = nl80211_policy,
12103                 .flags = GENL_UNS_ADMIN_PERM,
12104                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12105                                   NL80211_FLAG_NEED_RTNL,
12106         },
12107         {
12108                 .cmd = NL80211_CMD_NEW_INTERFACE,
12109                 .doit = nl80211_new_interface,
12110                 .policy = nl80211_policy,
12111                 .flags = GENL_UNS_ADMIN_PERM,
12112                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12113                                   NL80211_FLAG_NEED_RTNL,
12114         },
12115         {
12116                 .cmd = NL80211_CMD_DEL_INTERFACE,
12117                 .doit = nl80211_del_interface,
12118                 .policy = nl80211_policy,
12119                 .flags = GENL_UNS_ADMIN_PERM,
12120                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12121                                   NL80211_FLAG_NEED_RTNL,
12122         },
12123         {
12124                 .cmd = NL80211_CMD_GET_KEY,
12125                 .doit = nl80211_get_key,
12126                 .policy = nl80211_policy,
12127                 .flags = GENL_UNS_ADMIN_PERM,
12128                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12129                                   NL80211_FLAG_NEED_RTNL,
12130         },
12131         {
12132                 .cmd = NL80211_CMD_SET_KEY,
12133                 .doit = nl80211_set_key,
12134                 .policy = nl80211_policy,
12135                 .flags = GENL_UNS_ADMIN_PERM,
12136                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12137                                   NL80211_FLAG_NEED_RTNL |
12138                                   NL80211_FLAG_CLEAR_SKB,
12139         },
12140         {
12141                 .cmd = NL80211_CMD_NEW_KEY,
12142                 .doit = nl80211_new_key,
12143                 .policy = nl80211_policy,
12144                 .flags = GENL_UNS_ADMIN_PERM,
12145                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12146                                   NL80211_FLAG_NEED_RTNL |
12147                                   NL80211_FLAG_CLEAR_SKB,
12148         },
12149         {
12150                 .cmd = NL80211_CMD_DEL_KEY,
12151                 .doit = nl80211_del_key,
12152                 .policy = nl80211_policy,
12153                 .flags = GENL_UNS_ADMIN_PERM,
12154                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12155                                   NL80211_FLAG_NEED_RTNL,
12156         },
12157         {
12158                 .cmd = NL80211_CMD_SET_BEACON,
12159                 .policy = nl80211_policy,
12160                 .flags = GENL_UNS_ADMIN_PERM,
12161                 .doit = nl80211_set_beacon,
12162                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12163                                   NL80211_FLAG_NEED_RTNL,
12164         },
12165         {
12166                 .cmd = NL80211_CMD_START_AP,
12167                 .policy = nl80211_policy,
12168                 .flags = GENL_UNS_ADMIN_PERM,
12169                 .doit = nl80211_start_ap,
12170                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12171                                   NL80211_FLAG_NEED_RTNL,
12172         },
12173         {
12174                 .cmd = NL80211_CMD_STOP_AP,
12175                 .policy = nl80211_policy,
12176                 .flags = GENL_UNS_ADMIN_PERM,
12177                 .doit = nl80211_stop_ap,
12178                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12179                                   NL80211_FLAG_NEED_RTNL,
12180         },
12181         {
12182                 .cmd = NL80211_CMD_GET_STATION,
12183                 .doit = nl80211_get_station,
12184                 .dumpit = nl80211_dump_station,
12185                 .policy = nl80211_policy,
12186                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12187                                   NL80211_FLAG_NEED_RTNL,
12188         },
12189         {
12190                 .cmd = NL80211_CMD_SET_STATION,
12191                 .doit = nl80211_set_station,
12192                 .policy = nl80211_policy,
12193                 .flags = GENL_UNS_ADMIN_PERM,
12194                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12195                                   NL80211_FLAG_NEED_RTNL,
12196         },
12197         {
12198                 .cmd = NL80211_CMD_NEW_STATION,
12199                 .doit = nl80211_new_station,
12200                 .policy = nl80211_policy,
12201                 .flags = GENL_UNS_ADMIN_PERM,
12202                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12203                                   NL80211_FLAG_NEED_RTNL,
12204         },
12205         {
12206                 .cmd = NL80211_CMD_DEL_STATION,
12207                 .doit = nl80211_del_station,
12208                 .policy = nl80211_policy,
12209                 .flags = GENL_UNS_ADMIN_PERM,
12210                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12211                                   NL80211_FLAG_NEED_RTNL,
12212         },
12213         {
12214                 .cmd = NL80211_CMD_GET_MPATH,
12215                 .doit = nl80211_get_mpath,
12216                 .dumpit = nl80211_dump_mpath,
12217                 .policy = nl80211_policy,
12218                 .flags = GENL_UNS_ADMIN_PERM,
12219                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12220                                   NL80211_FLAG_NEED_RTNL,
12221         },
12222         {
12223                 .cmd = NL80211_CMD_GET_MPP,
12224                 .doit = nl80211_get_mpp,
12225                 .dumpit = nl80211_dump_mpp,
12226                 .policy = nl80211_policy,
12227                 .flags = GENL_UNS_ADMIN_PERM,
12228                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12229                                   NL80211_FLAG_NEED_RTNL,
12230         },
12231         {
12232                 .cmd = NL80211_CMD_SET_MPATH,
12233                 .doit = nl80211_set_mpath,
12234                 .policy = nl80211_policy,
12235                 .flags = GENL_UNS_ADMIN_PERM,
12236                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12237                                   NL80211_FLAG_NEED_RTNL,
12238         },
12239         {
12240                 .cmd = NL80211_CMD_NEW_MPATH,
12241                 .doit = nl80211_new_mpath,
12242                 .policy = nl80211_policy,
12243                 .flags = GENL_UNS_ADMIN_PERM,
12244                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12245                                   NL80211_FLAG_NEED_RTNL,
12246         },
12247         {
12248                 .cmd = NL80211_CMD_DEL_MPATH,
12249                 .doit = nl80211_del_mpath,
12250                 .policy = nl80211_policy,
12251                 .flags = GENL_UNS_ADMIN_PERM,
12252                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12253                                   NL80211_FLAG_NEED_RTNL,
12254         },
12255         {
12256                 .cmd = NL80211_CMD_SET_BSS,
12257                 .doit = nl80211_set_bss,
12258                 .policy = nl80211_policy,
12259                 .flags = GENL_UNS_ADMIN_PERM,
12260                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12261                                   NL80211_FLAG_NEED_RTNL,
12262         },
12263         {
12264                 .cmd = NL80211_CMD_GET_REG,
12265                 .doit = nl80211_get_reg_do,
12266                 .dumpit = nl80211_get_reg_dump,
12267                 .policy = nl80211_policy,
12268                 .internal_flags = NL80211_FLAG_NEED_RTNL,
12269                 /* can be retrieved by unprivileged users */
12270         },
12271 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
12272         {
12273                 .cmd = NL80211_CMD_SET_REG,
12274                 .doit = nl80211_set_reg,
12275                 .policy = nl80211_policy,
12276                 .flags = GENL_ADMIN_PERM,
12277                 .internal_flags = NL80211_FLAG_NEED_RTNL,
12278         },
12279 #endif
12280         {
12281                 .cmd = NL80211_CMD_REQ_SET_REG,
12282                 .doit = nl80211_req_set_reg,
12283                 .policy = nl80211_policy,
12284                 .flags = GENL_ADMIN_PERM,
12285         },
12286         {
12287                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
12288                 .doit = nl80211_get_mesh_config,
12289                 .policy = nl80211_policy,
12290                 /* can be retrieved by unprivileged users */
12291                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12292                                   NL80211_FLAG_NEED_RTNL,
12293         },
12294         {
12295                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
12296                 .doit = nl80211_update_mesh_config,
12297                 .policy = nl80211_policy,
12298                 .flags = GENL_UNS_ADMIN_PERM,
12299                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12300                                   NL80211_FLAG_NEED_RTNL,
12301         },
12302         {
12303                 .cmd = NL80211_CMD_TRIGGER_SCAN,
12304                 .doit = nl80211_trigger_scan,
12305                 .policy = nl80211_policy,
12306                 .flags = GENL_UNS_ADMIN_PERM,
12307                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12308                                   NL80211_FLAG_NEED_RTNL,
12309         },
12310         {
12311                 .cmd = NL80211_CMD_ABORT_SCAN,
12312                 .doit = nl80211_abort_scan,
12313                 .policy = nl80211_policy,
12314                 .flags = GENL_UNS_ADMIN_PERM,
12315                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12316                                   NL80211_FLAG_NEED_RTNL,
12317         },
12318         {
12319                 .cmd = NL80211_CMD_GET_SCAN,
12320                 .policy = nl80211_policy,
12321                 .dumpit = nl80211_dump_scan,
12322         },
12323         {
12324                 .cmd = NL80211_CMD_START_SCHED_SCAN,
12325                 .doit = nl80211_start_sched_scan,
12326                 .policy = nl80211_policy,
12327                 .flags = GENL_UNS_ADMIN_PERM,
12328                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12329                                   NL80211_FLAG_NEED_RTNL,
12330         },
12331         {
12332                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
12333                 .doit = nl80211_stop_sched_scan,
12334                 .policy = nl80211_policy,
12335                 .flags = GENL_UNS_ADMIN_PERM,
12336                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12337                                   NL80211_FLAG_NEED_RTNL,
12338         },
12339         {
12340                 .cmd = NL80211_CMD_AUTHENTICATE,
12341                 .doit = nl80211_authenticate,
12342                 .policy = nl80211_policy,
12343                 .flags = GENL_UNS_ADMIN_PERM,
12344                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12345                                   NL80211_FLAG_NEED_RTNL |
12346                                   NL80211_FLAG_CLEAR_SKB,
12347         },
12348         {
12349                 .cmd = NL80211_CMD_ASSOCIATE,
12350                 .doit = nl80211_associate,
12351                 .policy = nl80211_policy,
12352                 .flags = GENL_UNS_ADMIN_PERM,
12353                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12354                                   NL80211_FLAG_NEED_RTNL,
12355         },
12356         {
12357                 .cmd = NL80211_CMD_DEAUTHENTICATE,
12358                 .doit = nl80211_deauthenticate,
12359                 .policy = nl80211_policy,
12360                 .flags = GENL_UNS_ADMIN_PERM,
12361                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12362                                   NL80211_FLAG_NEED_RTNL,
12363         },
12364         {
12365                 .cmd = NL80211_CMD_DISASSOCIATE,
12366                 .doit = nl80211_disassociate,
12367                 .policy = nl80211_policy,
12368                 .flags = GENL_UNS_ADMIN_PERM,
12369                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12370                                   NL80211_FLAG_NEED_RTNL,
12371         },
12372         {
12373                 .cmd = NL80211_CMD_JOIN_IBSS,
12374                 .doit = nl80211_join_ibss,
12375                 .policy = nl80211_policy,
12376                 .flags = GENL_UNS_ADMIN_PERM,
12377                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12378                                   NL80211_FLAG_NEED_RTNL,
12379         },
12380         {
12381                 .cmd = NL80211_CMD_LEAVE_IBSS,
12382                 .doit = nl80211_leave_ibss,
12383                 .policy = nl80211_policy,
12384                 .flags = GENL_UNS_ADMIN_PERM,
12385                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12386                                   NL80211_FLAG_NEED_RTNL,
12387         },
12388 #ifdef CONFIG_NL80211_TESTMODE
12389         {
12390                 .cmd = NL80211_CMD_TESTMODE,
12391                 .doit = nl80211_testmode_do,
12392                 .dumpit = nl80211_testmode_dump,
12393                 .policy = nl80211_policy,
12394                 .flags = GENL_UNS_ADMIN_PERM,
12395                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12396                                   NL80211_FLAG_NEED_RTNL,
12397         },
12398 #endif
12399         {
12400                 .cmd = NL80211_CMD_CONNECT,
12401                 .doit = nl80211_connect,
12402                 .policy = nl80211_policy,
12403                 .flags = GENL_UNS_ADMIN_PERM,
12404                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12405                                   NL80211_FLAG_NEED_RTNL,
12406         },
12407         {
12408                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
12409                 .doit = nl80211_update_connect_params,
12410                 .policy = nl80211_policy,
12411                 .flags = GENL_ADMIN_PERM,
12412                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12413                                   NL80211_FLAG_NEED_RTNL,
12414         },
12415         {
12416                 .cmd = NL80211_CMD_DISCONNECT,
12417                 .doit = nl80211_disconnect,
12418                 .policy = nl80211_policy,
12419                 .flags = GENL_UNS_ADMIN_PERM,
12420                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12421                                   NL80211_FLAG_NEED_RTNL,
12422         },
12423         {
12424                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
12425                 .doit = nl80211_wiphy_netns,
12426                 .policy = nl80211_policy,
12427                 .flags = GENL_UNS_ADMIN_PERM,
12428                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12429                                   NL80211_FLAG_NEED_RTNL,
12430         },
12431         {
12432                 .cmd = NL80211_CMD_GET_SURVEY,
12433                 .policy = nl80211_policy,
12434                 .dumpit = nl80211_dump_survey,
12435         },
12436         {
12437                 .cmd = NL80211_CMD_SET_PMKSA,
12438                 .doit = nl80211_setdel_pmksa,
12439                 .policy = nl80211_policy,
12440                 .flags = GENL_UNS_ADMIN_PERM,
12441                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12442                                   NL80211_FLAG_NEED_RTNL,
12443         },
12444         {
12445                 .cmd = NL80211_CMD_DEL_PMKSA,
12446                 .doit = nl80211_setdel_pmksa,
12447                 .policy = nl80211_policy,
12448                 .flags = GENL_UNS_ADMIN_PERM,
12449                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12450                                   NL80211_FLAG_NEED_RTNL,
12451         },
12452         {
12453                 .cmd = NL80211_CMD_FLUSH_PMKSA,
12454                 .doit = nl80211_flush_pmksa,
12455                 .policy = nl80211_policy,
12456                 .flags = GENL_UNS_ADMIN_PERM,
12457                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12458                                   NL80211_FLAG_NEED_RTNL,
12459         },
12460         {
12461                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
12462                 .doit = nl80211_remain_on_channel,
12463                 .policy = nl80211_policy,
12464                 .flags = GENL_UNS_ADMIN_PERM,
12465                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12466                                   NL80211_FLAG_NEED_RTNL,
12467         },
12468         {
12469                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12470                 .doit = nl80211_cancel_remain_on_channel,
12471                 .policy = nl80211_policy,
12472                 .flags = GENL_UNS_ADMIN_PERM,
12473                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12474                                   NL80211_FLAG_NEED_RTNL,
12475         },
12476         {
12477                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
12478                 .doit = nl80211_set_tx_bitrate_mask,
12479                 .policy = nl80211_policy,
12480                 .flags = GENL_UNS_ADMIN_PERM,
12481                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12482                                   NL80211_FLAG_NEED_RTNL,
12483         },
12484         {
12485                 .cmd = NL80211_CMD_REGISTER_FRAME,
12486                 .doit = nl80211_register_mgmt,
12487                 .policy = nl80211_policy,
12488                 .flags = GENL_UNS_ADMIN_PERM,
12489                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12490                                   NL80211_FLAG_NEED_RTNL,
12491         },
12492         {
12493                 .cmd = NL80211_CMD_FRAME,
12494                 .doit = nl80211_tx_mgmt,
12495                 .policy = nl80211_policy,
12496                 .flags = GENL_UNS_ADMIN_PERM,
12497                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12498                                   NL80211_FLAG_NEED_RTNL,
12499         },
12500         {
12501                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
12502                 .doit = nl80211_tx_mgmt_cancel_wait,
12503                 .policy = nl80211_policy,
12504                 .flags = GENL_UNS_ADMIN_PERM,
12505                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12506                                   NL80211_FLAG_NEED_RTNL,
12507         },
12508         {
12509                 .cmd = NL80211_CMD_SET_POWER_SAVE,
12510                 .doit = nl80211_set_power_save,
12511                 .policy = nl80211_policy,
12512                 .flags = GENL_UNS_ADMIN_PERM,
12513                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12514                                   NL80211_FLAG_NEED_RTNL,
12515         },
12516         {
12517                 .cmd = NL80211_CMD_GET_POWER_SAVE,
12518                 .doit = nl80211_get_power_save,
12519                 .policy = nl80211_policy,
12520                 /* can be retrieved by unprivileged users */
12521                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12522                                   NL80211_FLAG_NEED_RTNL,
12523         },
12524         {
12525                 .cmd = NL80211_CMD_SET_CQM,
12526                 .doit = nl80211_set_cqm,
12527                 .policy = nl80211_policy,
12528                 .flags = GENL_UNS_ADMIN_PERM,
12529                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12530                                   NL80211_FLAG_NEED_RTNL,
12531         },
12532         {
12533                 .cmd = NL80211_CMD_SET_CHANNEL,
12534                 .doit = nl80211_set_channel,
12535                 .policy = nl80211_policy,
12536                 .flags = GENL_UNS_ADMIN_PERM,
12537                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12538                                   NL80211_FLAG_NEED_RTNL,
12539         },
12540         {
12541                 .cmd = NL80211_CMD_SET_WDS_PEER,
12542                 .doit = nl80211_set_wds_peer,
12543                 .policy = nl80211_policy,
12544                 .flags = GENL_UNS_ADMIN_PERM,
12545                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12546                                   NL80211_FLAG_NEED_RTNL,
12547         },
12548         {
12549                 .cmd = NL80211_CMD_JOIN_MESH,
12550                 .doit = nl80211_join_mesh,
12551                 .policy = nl80211_policy,
12552                 .flags = GENL_UNS_ADMIN_PERM,
12553                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12554                                   NL80211_FLAG_NEED_RTNL,
12555         },
12556         {
12557                 .cmd = NL80211_CMD_LEAVE_MESH,
12558                 .doit = nl80211_leave_mesh,
12559                 .policy = nl80211_policy,
12560                 .flags = GENL_UNS_ADMIN_PERM,
12561                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12562                                   NL80211_FLAG_NEED_RTNL,
12563         },
12564         {
12565                 .cmd = NL80211_CMD_JOIN_OCB,
12566                 .doit = nl80211_join_ocb,
12567                 .policy = nl80211_policy,
12568                 .flags = GENL_UNS_ADMIN_PERM,
12569                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12570                                   NL80211_FLAG_NEED_RTNL,
12571         },
12572         {
12573                 .cmd = NL80211_CMD_LEAVE_OCB,
12574                 .doit = nl80211_leave_ocb,
12575                 .policy = nl80211_policy,
12576                 .flags = GENL_UNS_ADMIN_PERM,
12577                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12578                                   NL80211_FLAG_NEED_RTNL,
12579         },
12580 #ifdef CONFIG_PM
12581         {
12582                 .cmd = NL80211_CMD_GET_WOWLAN,
12583                 .doit = nl80211_get_wowlan,
12584                 .policy = nl80211_policy,
12585                 /* can be retrieved by unprivileged users */
12586                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12587                                   NL80211_FLAG_NEED_RTNL,
12588         },
12589         {
12590                 .cmd = NL80211_CMD_SET_WOWLAN,
12591                 .doit = nl80211_set_wowlan,
12592                 .policy = nl80211_policy,
12593                 .flags = GENL_UNS_ADMIN_PERM,
12594                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12595                                   NL80211_FLAG_NEED_RTNL,
12596         },
12597 #endif
12598         {
12599                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
12600                 .doit = nl80211_set_rekey_data,
12601                 .policy = nl80211_policy,
12602                 .flags = GENL_UNS_ADMIN_PERM,
12603                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12604                                   NL80211_FLAG_NEED_RTNL |
12605                                   NL80211_FLAG_CLEAR_SKB,
12606         },
12607         {
12608                 .cmd = NL80211_CMD_TDLS_MGMT,
12609                 .doit = nl80211_tdls_mgmt,
12610                 .policy = nl80211_policy,
12611                 .flags = GENL_UNS_ADMIN_PERM,
12612                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12613                                   NL80211_FLAG_NEED_RTNL,
12614         },
12615         {
12616                 .cmd = NL80211_CMD_TDLS_OPER,
12617                 .doit = nl80211_tdls_oper,
12618                 .policy = nl80211_policy,
12619                 .flags = GENL_UNS_ADMIN_PERM,
12620                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12621                                   NL80211_FLAG_NEED_RTNL,
12622         },
12623         {
12624                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
12625                 .doit = nl80211_register_unexpected_frame,
12626                 .policy = nl80211_policy,
12627                 .flags = GENL_UNS_ADMIN_PERM,
12628                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12629                                   NL80211_FLAG_NEED_RTNL,
12630         },
12631         {
12632                 .cmd = NL80211_CMD_PROBE_CLIENT,
12633                 .doit = nl80211_probe_client,
12634                 .policy = nl80211_policy,
12635                 .flags = GENL_UNS_ADMIN_PERM,
12636                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12637                                   NL80211_FLAG_NEED_RTNL,
12638         },
12639         {
12640                 .cmd = NL80211_CMD_REGISTER_BEACONS,
12641                 .doit = nl80211_register_beacons,
12642                 .policy = nl80211_policy,
12643                 .flags = GENL_UNS_ADMIN_PERM,
12644                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12645                                   NL80211_FLAG_NEED_RTNL,
12646         },
12647         {
12648                 .cmd = NL80211_CMD_SET_NOACK_MAP,
12649                 .doit = nl80211_set_noack_map,
12650                 .policy = nl80211_policy,
12651                 .flags = GENL_UNS_ADMIN_PERM,
12652                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12653                                   NL80211_FLAG_NEED_RTNL,
12654         },
12655         {
12656                 .cmd = NL80211_CMD_START_P2P_DEVICE,
12657                 .doit = nl80211_start_p2p_device,
12658                 .policy = nl80211_policy,
12659                 .flags = GENL_UNS_ADMIN_PERM,
12660                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12661                                   NL80211_FLAG_NEED_RTNL,
12662         },
12663         {
12664                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
12665                 .doit = nl80211_stop_p2p_device,
12666                 .policy = nl80211_policy,
12667                 .flags = GENL_UNS_ADMIN_PERM,
12668                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12669                                   NL80211_FLAG_NEED_RTNL,
12670         },
12671         {
12672                 .cmd = NL80211_CMD_START_NAN,
12673                 .doit = nl80211_start_nan,
12674                 .policy = nl80211_policy,
12675                 .flags = GENL_ADMIN_PERM,
12676                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12677                                   NL80211_FLAG_NEED_RTNL,
12678         },
12679         {
12680                 .cmd = NL80211_CMD_STOP_NAN,
12681                 .doit = nl80211_stop_nan,
12682                 .policy = nl80211_policy,
12683                 .flags = GENL_ADMIN_PERM,
12684                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12685                                   NL80211_FLAG_NEED_RTNL,
12686         },
12687         {
12688                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
12689                 .doit = nl80211_nan_add_func,
12690                 .policy = nl80211_policy,
12691                 .flags = GENL_ADMIN_PERM,
12692                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12693                                   NL80211_FLAG_NEED_RTNL,
12694         },
12695         {
12696                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
12697                 .doit = nl80211_nan_del_func,
12698                 .policy = nl80211_policy,
12699                 .flags = GENL_ADMIN_PERM,
12700                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12701                                   NL80211_FLAG_NEED_RTNL,
12702         },
12703         {
12704                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
12705                 .doit = nl80211_nan_change_config,
12706                 .policy = nl80211_policy,
12707                 .flags = GENL_ADMIN_PERM,
12708                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12709                                   NL80211_FLAG_NEED_RTNL,
12710         },
12711         {
12712                 .cmd = NL80211_CMD_SET_MCAST_RATE,
12713                 .doit = nl80211_set_mcast_rate,
12714                 .policy = nl80211_policy,
12715                 .flags = GENL_UNS_ADMIN_PERM,
12716                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12717                                   NL80211_FLAG_NEED_RTNL,
12718         },
12719         {
12720                 .cmd = NL80211_CMD_SET_MAC_ACL,
12721                 .doit = nl80211_set_mac_acl,
12722                 .policy = nl80211_policy,
12723                 .flags = GENL_UNS_ADMIN_PERM,
12724                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12725                                   NL80211_FLAG_NEED_RTNL,
12726         },
12727         {
12728                 .cmd = NL80211_CMD_RADAR_DETECT,
12729                 .doit = nl80211_start_radar_detection,
12730                 .policy = nl80211_policy,
12731                 .flags = GENL_UNS_ADMIN_PERM,
12732                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12733                                   NL80211_FLAG_NEED_RTNL,
12734         },
12735         {
12736                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
12737                 .doit = nl80211_get_protocol_features,
12738                 .policy = nl80211_policy,
12739         },
12740         {
12741                 .cmd = NL80211_CMD_UPDATE_FT_IES,
12742                 .doit = nl80211_update_ft_ies,
12743                 .policy = nl80211_policy,
12744                 .flags = GENL_UNS_ADMIN_PERM,
12745                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12746                                   NL80211_FLAG_NEED_RTNL,
12747         },
12748         {
12749                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
12750                 .doit = nl80211_crit_protocol_start,
12751                 .policy = nl80211_policy,
12752                 .flags = GENL_UNS_ADMIN_PERM,
12753                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12754                                   NL80211_FLAG_NEED_RTNL,
12755         },
12756         {
12757                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
12758                 .doit = nl80211_crit_protocol_stop,
12759                 .policy = nl80211_policy,
12760                 .flags = GENL_UNS_ADMIN_PERM,
12761                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12762                                   NL80211_FLAG_NEED_RTNL,
12763         },
12764         {
12765                 .cmd = NL80211_CMD_GET_COALESCE,
12766                 .doit = nl80211_get_coalesce,
12767                 .policy = nl80211_policy,
12768                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12769                                   NL80211_FLAG_NEED_RTNL,
12770         },
12771         {
12772                 .cmd = NL80211_CMD_SET_COALESCE,
12773                 .doit = nl80211_set_coalesce,
12774                 .policy = nl80211_policy,
12775                 .flags = GENL_UNS_ADMIN_PERM,
12776                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12777                                   NL80211_FLAG_NEED_RTNL,
12778         },
12779         {
12780                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
12781                 .doit = nl80211_channel_switch,
12782                 .policy = nl80211_policy,
12783                 .flags = GENL_UNS_ADMIN_PERM,
12784                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12785                                   NL80211_FLAG_NEED_RTNL,
12786         },
12787         {
12788                 .cmd = NL80211_CMD_VENDOR,
12789                 .doit = nl80211_vendor_cmd,
12790                 .dumpit = nl80211_vendor_cmd_dump,
12791                 .policy = nl80211_policy,
12792                 .flags = GENL_UNS_ADMIN_PERM,
12793                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12794                                   NL80211_FLAG_NEED_RTNL,
12795         },
12796         {
12797                 .cmd = NL80211_CMD_SET_QOS_MAP,
12798                 .doit = nl80211_set_qos_map,
12799                 .policy = nl80211_policy,
12800                 .flags = GENL_UNS_ADMIN_PERM,
12801                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12802                                   NL80211_FLAG_NEED_RTNL,
12803         },
12804         {
12805                 .cmd = NL80211_CMD_ADD_TX_TS,
12806                 .doit = nl80211_add_tx_ts,
12807                 .policy = nl80211_policy,
12808                 .flags = GENL_UNS_ADMIN_PERM,
12809                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12810                                   NL80211_FLAG_NEED_RTNL,
12811         },
12812         {
12813                 .cmd = NL80211_CMD_DEL_TX_TS,
12814                 .doit = nl80211_del_tx_ts,
12815                 .policy = nl80211_policy,
12816                 .flags = GENL_UNS_ADMIN_PERM,
12817                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12818                                   NL80211_FLAG_NEED_RTNL,
12819         },
12820         {
12821                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
12822                 .doit = nl80211_tdls_channel_switch,
12823                 .policy = nl80211_policy,
12824                 .flags = GENL_UNS_ADMIN_PERM,
12825                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12826                                   NL80211_FLAG_NEED_RTNL,
12827         },
12828         {
12829                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
12830                 .doit = nl80211_tdls_cancel_channel_switch,
12831                 .policy = nl80211_policy,
12832                 .flags = GENL_UNS_ADMIN_PERM,
12833                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12834                                   NL80211_FLAG_NEED_RTNL,
12835         },
12836         {
12837                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
12838                 .doit = nl80211_set_multicast_to_unicast,
12839                 .policy = nl80211_policy,
12840                 .flags = GENL_UNS_ADMIN_PERM,
12841                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12842                                   NL80211_FLAG_NEED_RTNL,
12843         },
12844 };
12845
12846 static struct genl_family nl80211_fam __ro_after_init = {
12847         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
12848         .hdrsize = 0,                   /* no private header */
12849         .version = 1,                   /* no particular meaning now */
12850         .maxattr = NL80211_ATTR_MAX,
12851         .netnsok = true,
12852         .pre_doit = nl80211_pre_doit,
12853         .post_doit = nl80211_post_doit,
12854         .module = THIS_MODULE,
12855         .ops = nl80211_ops,
12856         .n_ops = ARRAY_SIZE(nl80211_ops),
12857         .mcgrps = nl80211_mcgrps,
12858         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
12859 };
12860
12861 /* notification functions */
12862
12863 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
12864                           enum nl80211_commands cmd)
12865 {
12866         struct sk_buff *msg;
12867         struct nl80211_dump_wiphy_state state = {};
12868
12869         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
12870                 cmd != NL80211_CMD_DEL_WIPHY);
12871
12872         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12873         if (!msg)
12874                 return;
12875
12876         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
12877                 nlmsg_free(msg);
12878                 return;
12879         }
12880
12881         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12882                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
12883 }
12884
12885 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
12886                                 struct wireless_dev *wdev,
12887                                 enum nl80211_commands cmd)
12888 {
12889         struct sk_buff *msg;
12890
12891         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
12892                 cmd != NL80211_CMD_DEL_INTERFACE);
12893
12894         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12895         if (!msg)
12896                 return;
12897
12898         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
12899                                cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
12900                 nlmsg_free(msg);
12901                 return;
12902         }
12903
12904         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12905                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
12906 }
12907
12908 static int nl80211_add_scan_req(struct sk_buff *msg,
12909                                 struct cfg80211_registered_device *rdev)
12910 {
12911         struct cfg80211_scan_request *req = rdev->scan_req;
12912         struct nlattr *nest;
12913         int i;
12914
12915         if (WARN_ON(!req))
12916                 return 0;
12917
12918         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
12919         if (!nest)
12920                 goto nla_put_failure;
12921         for (i = 0; i < req->n_ssids; i++) {
12922                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
12923                         goto nla_put_failure;
12924         }
12925         nla_nest_end(msg, nest);
12926
12927         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
12928         if (!nest)
12929                 goto nla_put_failure;
12930         for (i = 0; i < req->n_channels; i++) {
12931                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
12932                         goto nla_put_failure;
12933         }
12934         nla_nest_end(msg, nest);
12935
12936         if (req->ie &&
12937             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
12938                 goto nla_put_failure;
12939
12940         if (req->flags &&
12941             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
12942                 goto nla_put_failure;
12943
12944         if (req->info.scan_start_tsf &&
12945             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
12946                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
12947              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
12948                      req->info.tsf_bssid)))
12949                 goto nla_put_failure;
12950
12951         return 0;
12952  nla_put_failure:
12953         return -ENOBUFS;
12954 }
12955
12956 static int nl80211_prep_scan_msg(struct sk_buff *msg,
12957                                  struct cfg80211_registered_device *rdev,
12958                                  struct wireless_dev *wdev,
12959                                  u32 portid, u32 seq, int flags,
12960                                  u32 cmd)
12961 {
12962         void *hdr;
12963
12964         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
12965         if (!hdr)
12966                 return -1;
12967
12968         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12969             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12970                                          wdev->netdev->ifindex)) ||
12971             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12972                               NL80211_ATTR_PAD))
12973                 goto nla_put_failure;
12974
12975         /* ignore errors and send incomplete event anyway */
12976         nl80211_add_scan_req(msg, rdev);
12977
12978         genlmsg_end(msg, hdr);
12979         return 0;
12980
12981  nla_put_failure:
12982         genlmsg_cancel(msg, hdr);
12983         return -EMSGSIZE;
12984 }
12985
12986 static int
12987 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
12988                             struct cfg80211_registered_device *rdev,
12989                             struct net_device *netdev,
12990                             u32 portid, u32 seq, int flags, u32 cmd)
12991 {
12992         void *hdr;
12993
12994         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
12995         if (!hdr)
12996                 return -1;
12997
12998         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12999             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
13000                 goto nla_put_failure;
13001
13002         genlmsg_end(msg, hdr);
13003         return 0;
13004
13005  nla_put_failure:
13006         genlmsg_cancel(msg, hdr);
13007         return -EMSGSIZE;
13008 }
13009
13010 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
13011                              struct wireless_dev *wdev)
13012 {
13013         struct sk_buff *msg;
13014
13015         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13016         if (!msg)
13017                 return;
13018
13019         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
13020                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
13021                 nlmsg_free(msg);
13022                 return;
13023         }
13024
13025         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13026                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
13027 }
13028
13029 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
13030                                        struct wireless_dev *wdev, bool aborted)
13031 {
13032         struct sk_buff *msg;
13033
13034         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13035         if (!msg)
13036                 return NULL;
13037
13038         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
13039                                   aborted ? NL80211_CMD_SCAN_ABORTED :
13040                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
13041                 nlmsg_free(msg);
13042                 return NULL;
13043         }
13044
13045         return msg;
13046 }
13047
13048 /* send message created by nl80211_build_scan_msg() */
13049 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
13050                            struct sk_buff *msg)
13051 {
13052         if (!msg)
13053                 return;
13054
13055         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13056                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
13057 }
13058
13059 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
13060                              struct net_device *netdev, u32 cmd)
13061 {
13062         struct sk_buff *msg;
13063
13064         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13065         if (!msg)
13066                 return;
13067
13068         if (nl80211_prep_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
13069                 nlmsg_free(msg);
13070                 return;
13071         }
13072
13073         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13074                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
13075 }
13076
13077 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
13078                                           struct regulatory_request *request)
13079 {
13080         /* Userspace can always count this one always being set */
13081         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
13082                 goto nla_put_failure;
13083
13084         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
13085                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13086                                NL80211_REGDOM_TYPE_WORLD))
13087                         goto nla_put_failure;
13088         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
13089                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13090                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
13091                         goto nla_put_failure;
13092         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
13093                    request->intersect) {
13094                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13095                                NL80211_REGDOM_TYPE_INTERSECTION))
13096                         goto nla_put_failure;
13097         } else {
13098                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13099                                NL80211_REGDOM_TYPE_COUNTRY) ||
13100                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
13101                                    request->alpha2))
13102                         goto nla_put_failure;
13103         }
13104
13105         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
13106                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
13107
13108                 if (wiphy &&
13109                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
13110                         goto nla_put_failure;
13111
13112                 if (wiphy &&
13113                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
13114                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
13115                         goto nla_put_failure;
13116         }
13117
13118         return true;
13119
13120 nla_put_failure:
13121         return false;
13122 }
13123
13124 /*
13125  * This can happen on global regulatory changes or device specific settings
13126  * based on custom regulatory domains.
13127  */
13128 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
13129                                      struct regulatory_request *request)
13130 {
13131         struct sk_buff *msg;
13132         void *hdr;
13133
13134         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13135         if (!msg)
13136                 return;
13137
13138         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
13139         if (!hdr) {
13140                 nlmsg_free(msg);
13141                 return;
13142         }
13143
13144         if (nl80211_reg_change_event_fill(msg, request) == false)
13145                 goto nla_put_failure;
13146
13147         genlmsg_end(msg, hdr);
13148
13149         rcu_read_lock();
13150         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
13151                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
13152         rcu_read_unlock();
13153
13154         return;
13155
13156 nla_put_failure:
13157         genlmsg_cancel(msg, hdr);
13158         nlmsg_free(msg);
13159 }
13160
13161 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
13162                                     struct net_device *netdev,
13163                                     const u8 *buf, size_t len,
13164                                     enum nl80211_commands cmd, gfp_t gfp,
13165                                     int uapsd_queues)
13166 {
13167         struct sk_buff *msg;
13168         void *hdr;
13169
13170         msg = nlmsg_new(100 + len, gfp);
13171         if (!msg)
13172                 return;
13173
13174         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13175         if (!hdr) {
13176                 nlmsg_free(msg);
13177                 return;
13178         }
13179
13180         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13181             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13182             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
13183                 goto nla_put_failure;
13184
13185         if (uapsd_queues >= 0) {
13186                 struct nlattr *nla_wmm =
13187                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
13188                 if (!nla_wmm)
13189                         goto nla_put_failure;
13190
13191                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
13192                                uapsd_queues))
13193                         goto nla_put_failure;
13194
13195                 nla_nest_end(msg, nla_wmm);
13196         }
13197
13198         genlmsg_end(msg, hdr);
13199
13200         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13201                                 NL80211_MCGRP_MLME, gfp);
13202         return;
13203
13204  nla_put_failure:
13205         genlmsg_cancel(msg, hdr);
13206         nlmsg_free(msg);
13207 }
13208
13209 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
13210                           struct net_device *netdev, const u8 *buf,
13211                           size_t len, gfp_t gfp)
13212 {
13213         nl80211_send_mlme_event(rdev, netdev, buf, len,
13214                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
13215 }
13216
13217 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
13218                            struct net_device *netdev, const u8 *buf,
13219                            size_t len, gfp_t gfp, int uapsd_queues)
13220 {
13221         nl80211_send_mlme_event(rdev, netdev, buf, len,
13222                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
13223 }
13224
13225 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
13226                          struct net_device *netdev, const u8 *buf,
13227                          size_t len, gfp_t gfp)
13228 {
13229         nl80211_send_mlme_event(rdev, netdev, buf, len,
13230                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
13231 }
13232
13233 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
13234                            struct net_device *netdev, const u8 *buf,
13235                            size_t len, gfp_t gfp)
13236 {
13237         nl80211_send_mlme_event(rdev, netdev, buf, len,
13238                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
13239 }
13240
13241 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
13242                                   size_t len)
13243 {
13244         struct wireless_dev *wdev = dev->ieee80211_ptr;
13245         struct wiphy *wiphy = wdev->wiphy;
13246         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13247         const struct ieee80211_mgmt *mgmt = (void *)buf;
13248         u32 cmd;
13249
13250         if (WARN_ON(len < 2))
13251                 return;
13252
13253         if (ieee80211_is_deauth(mgmt->frame_control))
13254                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
13255         else
13256                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
13257
13258         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
13259         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
13260 }
13261 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
13262
13263 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
13264                                       struct net_device *netdev, int cmd,
13265                                       const u8 *addr, gfp_t gfp)
13266 {
13267         struct sk_buff *msg;
13268         void *hdr;
13269
13270         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13271         if (!msg)
13272                 return;
13273
13274         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13275         if (!hdr) {
13276                 nlmsg_free(msg);
13277                 return;
13278         }
13279
13280         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13281             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13282             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13283             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13284                 goto nla_put_failure;
13285
13286         genlmsg_end(msg, hdr);
13287
13288         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13289                                 NL80211_MCGRP_MLME, gfp);
13290         return;
13291
13292  nla_put_failure:
13293         genlmsg_cancel(msg, hdr);
13294         nlmsg_free(msg);
13295 }
13296
13297 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
13298                                struct net_device *netdev, const u8 *addr,
13299                                gfp_t gfp)
13300 {
13301         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
13302                                   addr, gfp);
13303 }
13304
13305 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
13306                                 struct net_device *netdev, const u8 *addr,
13307                                 gfp_t gfp)
13308 {
13309         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
13310                                   addr, gfp);
13311 }
13312
13313 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
13314                                  struct net_device *netdev, const u8 *bssid,
13315                                  const u8 *req_ie, size_t req_ie_len,
13316                                  const u8 *resp_ie, size_t resp_ie_len,
13317                                  int status,
13318                                  enum nl80211_timeout_reason timeout_reason,
13319                                  gfp_t gfp)
13320 {
13321         struct sk_buff *msg;
13322         void *hdr;
13323
13324         msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp);
13325         if (!msg)
13326                 return;
13327
13328         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
13329         if (!hdr) {
13330                 nlmsg_free(msg);
13331                 return;
13332         }
13333
13334         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13335             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13336             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
13337             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
13338                         status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
13339                         status) ||
13340             (status < 0 &&
13341              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13342               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON, timeout_reason))) ||
13343             (req_ie &&
13344              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
13345             (resp_ie &&
13346              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
13347                 goto nla_put_failure;
13348
13349         genlmsg_end(msg, hdr);
13350
13351         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13352                                 NL80211_MCGRP_MLME, gfp);
13353         return;
13354
13355  nla_put_failure:
13356         genlmsg_cancel(msg, hdr);
13357         nlmsg_free(msg);
13358 }
13359
13360 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
13361                          struct net_device *netdev, const u8 *bssid,
13362                          const u8 *req_ie, size_t req_ie_len,
13363                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
13364 {
13365         struct sk_buff *msg;
13366         void *hdr;
13367
13368         msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp);
13369         if (!msg)
13370                 return;
13371
13372         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
13373         if (!hdr) {
13374                 nlmsg_free(msg);
13375                 return;
13376         }
13377
13378         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13379             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13380             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
13381             (req_ie &&
13382              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
13383             (resp_ie &&
13384              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
13385                 goto nla_put_failure;
13386
13387         genlmsg_end(msg, hdr);
13388
13389         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13390                                 NL80211_MCGRP_MLME, gfp);
13391         return;
13392
13393  nla_put_failure:
13394         genlmsg_cancel(msg, hdr);
13395         nlmsg_free(msg);
13396 }
13397
13398 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
13399                                struct net_device *netdev, u16 reason,
13400                                const u8 *ie, size_t ie_len, bool from_ap)
13401 {
13402         struct sk_buff *msg;
13403         void *hdr;
13404
13405         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
13406         if (!msg)
13407                 return;
13408
13409         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
13410         if (!hdr) {
13411                 nlmsg_free(msg);
13412                 return;
13413         }
13414
13415         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13416             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13417             (from_ap && reason &&
13418              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
13419             (from_ap &&
13420              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
13421             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
13422                 goto nla_put_failure;
13423
13424         genlmsg_end(msg, hdr);
13425
13426         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13427                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13428         return;
13429
13430  nla_put_failure:
13431         genlmsg_cancel(msg, hdr);
13432         nlmsg_free(msg);
13433 }
13434
13435 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
13436                              struct net_device *netdev, const u8 *bssid,
13437                              gfp_t gfp)
13438 {
13439         struct sk_buff *msg;
13440         void *hdr;
13441
13442         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13443         if (!msg)
13444                 return;
13445
13446         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
13447         if (!hdr) {
13448                 nlmsg_free(msg);
13449                 return;
13450         }
13451
13452         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13453             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13454             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13455                 goto nla_put_failure;
13456
13457         genlmsg_end(msg, hdr);
13458
13459         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13460                                 NL80211_MCGRP_MLME, gfp);
13461         return;
13462
13463  nla_put_failure:
13464         genlmsg_cancel(msg, hdr);
13465         nlmsg_free(msg);
13466 }
13467
13468 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
13469                                         const u8* ie, u8 ie_len, gfp_t gfp)
13470 {
13471         struct wireless_dev *wdev = dev->ieee80211_ptr;
13472         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13473         struct sk_buff *msg;
13474         void *hdr;
13475
13476         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
13477                 return;
13478
13479         trace_cfg80211_notify_new_peer_candidate(dev, addr);
13480
13481         msg = nlmsg_new(100 + ie_len, gfp);
13482         if (!msg)
13483                 return;
13484
13485         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
13486         if (!hdr) {
13487                 nlmsg_free(msg);
13488                 return;
13489         }
13490
13491         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13492             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13493             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
13494             (ie_len && ie &&
13495              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
13496                 goto nla_put_failure;
13497
13498         genlmsg_end(msg, hdr);
13499
13500         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13501                                 NL80211_MCGRP_MLME, gfp);
13502         return;
13503
13504  nla_put_failure:
13505         genlmsg_cancel(msg, hdr);
13506         nlmsg_free(msg);
13507 }
13508 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
13509
13510 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
13511                                  struct net_device *netdev, const u8 *addr,
13512                                  enum nl80211_key_type key_type, int key_id,
13513                                  const u8 *tsc, gfp_t gfp)
13514 {
13515         struct sk_buff *msg;
13516         void *hdr;
13517
13518         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13519         if (!msg)
13520                 return;
13521
13522         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
13523         if (!hdr) {
13524                 nlmsg_free(msg);
13525                 return;
13526         }
13527
13528         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13529             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13530             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
13531             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
13532             (key_id != -1 &&
13533              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
13534             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
13535                 goto nla_put_failure;
13536
13537         genlmsg_end(msg, hdr);
13538
13539         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13540                                 NL80211_MCGRP_MLME, gfp);
13541         return;
13542
13543  nla_put_failure:
13544         genlmsg_cancel(msg, hdr);
13545         nlmsg_free(msg);
13546 }
13547
13548 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
13549                                     struct ieee80211_channel *channel_before,
13550                                     struct ieee80211_channel *channel_after)
13551 {
13552         struct sk_buff *msg;
13553         void *hdr;
13554         struct nlattr *nl_freq;
13555
13556         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
13557         if (!msg)
13558                 return;
13559
13560         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
13561         if (!hdr) {
13562                 nlmsg_free(msg);
13563                 return;
13564         }
13565
13566         /*
13567          * Since we are applying the beacon hint to a wiphy we know its
13568          * wiphy_idx is valid
13569          */
13570         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
13571                 goto nla_put_failure;
13572
13573         /* Before */
13574         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
13575         if (!nl_freq)
13576                 goto nla_put_failure;
13577         if (nl80211_msg_put_channel(msg, channel_before, false))
13578                 goto nla_put_failure;
13579         nla_nest_end(msg, nl_freq);
13580
13581         /* After */
13582         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
13583         if (!nl_freq)
13584                 goto nla_put_failure;
13585         if (nl80211_msg_put_channel(msg, channel_after, false))
13586                 goto nla_put_failure;
13587         nla_nest_end(msg, nl_freq);
13588
13589         genlmsg_end(msg, hdr);
13590
13591         rcu_read_lock();
13592         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
13593                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
13594         rcu_read_unlock();
13595
13596         return;
13597
13598 nla_put_failure:
13599         genlmsg_cancel(msg, hdr);
13600         nlmsg_free(msg);
13601 }
13602
13603 static void nl80211_send_remain_on_chan_event(
13604         int cmd, struct cfg80211_registered_device *rdev,
13605         struct wireless_dev *wdev, u64 cookie,
13606         struct ieee80211_channel *chan,
13607         unsigned int duration, gfp_t gfp)
13608 {
13609         struct sk_buff *msg;
13610         void *hdr;
13611
13612         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13613         if (!msg)
13614                 return;
13615
13616         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13617         if (!hdr) {
13618                 nlmsg_free(msg);
13619                 return;
13620         }
13621
13622         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13623             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13624                                          wdev->netdev->ifindex)) ||
13625             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13626                               NL80211_ATTR_PAD) ||
13627             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
13628             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
13629                         NL80211_CHAN_NO_HT) ||
13630             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13631                               NL80211_ATTR_PAD))
13632                 goto nla_put_failure;
13633
13634         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
13635             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
13636                 goto nla_put_failure;
13637
13638         genlmsg_end(msg, hdr);
13639
13640         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13641                                 NL80211_MCGRP_MLME, gfp);
13642         return;
13643
13644  nla_put_failure:
13645         genlmsg_cancel(msg, hdr);
13646         nlmsg_free(msg);
13647 }
13648
13649 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
13650                                struct ieee80211_channel *chan,
13651                                unsigned int duration, gfp_t gfp)
13652 {
13653         struct wiphy *wiphy = wdev->wiphy;
13654         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13655
13656         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
13657         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
13658                                           rdev, wdev, cookie, chan,
13659                                           duration, gfp);
13660 }
13661 EXPORT_SYMBOL(cfg80211_ready_on_channel);
13662
13663 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
13664                                         struct ieee80211_channel *chan,
13665                                         gfp_t gfp)
13666 {
13667         struct wiphy *wiphy = wdev->wiphy;
13668         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13669
13670         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
13671         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13672                                           rdev, wdev, cookie, chan, 0, gfp);
13673 }
13674 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
13675
13676 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
13677                       struct station_info *sinfo, gfp_t gfp)
13678 {
13679         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
13680         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13681         struct sk_buff *msg;
13682
13683         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
13684
13685         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13686         if (!msg)
13687                 return;
13688
13689         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
13690                                  rdev, dev, mac_addr, sinfo) < 0) {
13691                 nlmsg_free(msg);
13692                 return;
13693         }
13694
13695         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13696                                 NL80211_MCGRP_MLME, gfp);
13697 }
13698 EXPORT_SYMBOL(cfg80211_new_sta);
13699
13700 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
13701                             struct station_info *sinfo, gfp_t gfp)
13702 {
13703         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
13704         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13705         struct sk_buff *msg;
13706         struct station_info empty_sinfo = {};
13707
13708         if (!sinfo)
13709                 sinfo = &empty_sinfo;
13710
13711         trace_cfg80211_del_sta(dev, mac_addr);
13712
13713         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13714         if (!msg)
13715                 return;
13716
13717         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
13718                                  rdev, dev, mac_addr, sinfo) < 0) {
13719                 nlmsg_free(msg);
13720                 return;
13721         }
13722
13723         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13724                                 NL80211_MCGRP_MLME, gfp);
13725 }
13726 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
13727
13728 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
13729                           enum nl80211_connect_failed_reason reason,
13730                           gfp_t gfp)
13731 {
13732         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
13733         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13734         struct sk_buff *msg;
13735         void *hdr;
13736
13737         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
13738         if (!msg)
13739                 return;
13740
13741         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
13742         if (!hdr) {
13743                 nlmsg_free(msg);
13744                 return;
13745         }
13746
13747         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13748             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
13749             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
13750                 goto nla_put_failure;
13751
13752         genlmsg_end(msg, hdr);
13753
13754         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13755                                 NL80211_MCGRP_MLME, gfp);
13756         return;
13757
13758  nla_put_failure:
13759         genlmsg_cancel(msg, hdr);
13760         nlmsg_free(msg);
13761 }
13762 EXPORT_SYMBOL(cfg80211_conn_failed);
13763
13764 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
13765                                        const u8 *addr, gfp_t gfp)
13766 {
13767         struct wireless_dev *wdev = dev->ieee80211_ptr;
13768         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13769         struct sk_buff *msg;
13770         void *hdr;
13771         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
13772
13773         if (!nlportid)
13774                 return false;
13775
13776         msg = nlmsg_new(100, gfp);
13777         if (!msg)
13778                 return true;
13779
13780         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13781         if (!hdr) {
13782                 nlmsg_free(msg);
13783                 return true;
13784         }
13785
13786         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13787             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13788             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13789                 goto nla_put_failure;
13790
13791         genlmsg_end(msg, hdr);
13792         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13793         return true;
13794
13795  nla_put_failure:
13796         genlmsg_cancel(msg, hdr);
13797         nlmsg_free(msg);
13798         return true;
13799 }
13800
13801 bool cfg80211_rx_spurious_frame(struct net_device *dev,
13802                                 const u8 *addr, gfp_t gfp)
13803 {
13804         struct wireless_dev *wdev = dev->ieee80211_ptr;
13805         bool ret;
13806
13807         trace_cfg80211_rx_spurious_frame(dev, addr);
13808
13809         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
13810                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
13811                 trace_cfg80211_return_bool(false);
13812                 return false;
13813         }
13814         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
13815                                          addr, gfp);
13816         trace_cfg80211_return_bool(ret);
13817         return ret;
13818 }
13819 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
13820
13821 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
13822                                         const u8 *addr, gfp_t gfp)
13823 {
13824         struct wireless_dev *wdev = dev->ieee80211_ptr;
13825         bool ret;
13826
13827         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
13828
13829         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
13830                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
13831                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
13832                 trace_cfg80211_return_bool(false);
13833                 return false;
13834         }
13835         ret = __nl80211_unexpected_frame(dev,
13836                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
13837                                          addr, gfp);
13838         trace_cfg80211_return_bool(ret);
13839         return ret;
13840 }
13841 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
13842
13843 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
13844                       struct wireless_dev *wdev, u32 nlportid,
13845                       int freq, int sig_dbm,
13846                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
13847 {
13848         struct net_device *netdev = wdev->netdev;
13849         struct sk_buff *msg;
13850         void *hdr;
13851
13852         msg = nlmsg_new(100 + len, gfp);
13853         if (!msg)
13854                 return -ENOMEM;
13855
13856         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
13857         if (!hdr) {
13858                 nlmsg_free(msg);
13859                 return -ENOMEM;
13860         }
13861
13862         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13863             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13864                                         netdev->ifindex)) ||
13865             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13866                               NL80211_ATTR_PAD) ||
13867             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
13868             (sig_dbm &&
13869              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
13870             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
13871             (flags &&
13872              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
13873                 goto nla_put_failure;
13874
13875         genlmsg_end(msg, hdr);
13876
13877         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13878
13879  nla_put_failure:
13880         genlmsg_cancel(msg, hdr);
13881         nlmsg_free(msg);
13882         return -ENOBUFS;
13883 }
13884
13885 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
13886                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
13887 {
13888         struct wiphy *wiphy = wdev->wiphy;
13889         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13890         struct net_device *netdev = wdev->netdev;
13891         struct sk_buff *msg;
13892         void *hdr;
13893
13894         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
13895
13896         msg = nlmsg_new(100 + len, gfp);
13897         if (!msg)
13898                 return;
13899
13900         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
13901         if (!hdr) {
13902                 nlmsg_free(msg);
13903                 return;
13904         }
13905
13906         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13907             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13908                                    netdev->ifindex)) ||
13909             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13910                               NL80211_ATTR_PAD) ||
13911             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
13912             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13913                               NL80211_ATTR_PAD) ||
13914             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
13915                 goto nla_put_failure;
13916
13917         genlmsg_end(msg, hdr);
13918
13919         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13920                                 NL80211_MCGRP_MLME, gfp);
13921         return;
13922
13923  nla_put_failure:
13924         genlmsg_cancel(msg, hdr);
13925         nlmsg_free(msg);
13926 }
13927 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
13928
13929 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
13930                                             const char *mac, gfp_t gfp)
13931 {
13932         struct wireless_dev *wdev = dev->ieee80211_ptr;
13933         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13934         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13935         void **cb;
13936
13937         if (!msg)
13938                 return NULL;
13939
13940         cb = (void **)msg->cb;
13941
13942         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
13943         if (!cb[0]) {
13944                 nlmsg_free(msg);
13945                 return NULL;
13946         }
13947
13948         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13949             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
13950                 goto nla_put_failure;
13951
13952         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
13953                 goto nla_put_failure;
13954
13955         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
13956         if (!cb[1])
13957                 goto nla_put_failure;
13958
13959         cb[2] = rdev;
13960
13961         return msg;
13962  nla_put_failure:
13963         nlmsg_free(msg);
13964         return NULL;
13965 }
13966
13967 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
13968 {
13969         void **cb = (void **)msg->cb;
13970         struct cfg80211_registered_device *rdev = cb[2];
13971
13972         nla_nest_end(msg, cb[1]);
13973         genlmsg_end(msg, cb[0]);
13974
13975         memset(msg->cb, 0, sizeof(msg->cb));
13976
13977         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13978                                 NL80211_MCGRP_MLME, gfp);
13979 }
13980
13981 void cfg80211_cqm_rssi_notify(struct net_device *dev,
13982                               enum nl80211_cqm_rssi_threshold_event rssi_event,
13983                               s32 rssi_level, gfp_t gfp)
13984 {
13985         struct sk_buff *msg;
13986
13987         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
13988
13989         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
13990                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
13991                 return;
13992
13993         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
13994         if (!msg)
13995                 return;
13996
13997         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
13998                         rssi_event))
13999                 goto nla_put_failure;
14000
14001         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
14002                                       rssi_level))
14003                 goto nla_put_failure;
14004
14005         cfg80211_send_cqm(msg, gfp);
14006
14007         return;
14008
14009  nla_put_failure:
14010         nlmsg_free(msg);
14011 }
14012 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
14013
14014 void cfg80211_cqm_txe_notify(struct net_device *dev,
14015                              const u8 *peer, u32 num_packets,
14016                              u32 rate, u32 intvl, gfp_t gfp)
14017 {
14018         struct sk_buff *msg;
14019
14020         msg = cfg80211_prepare_cqm(dev, peer, gfp);
14021         if (!msg)
14022                 return;
14023
14024         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
14025                 goto nla_put_failure;
14026
14027         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
14028                 goto nla_put_failure;
14029
14030         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
14031                 goto nla_put_failure;
14032
14033         cfg80211_send_cqm(msg, gfp);
14034         return;
14035
14036  nla_put_failure:
14037         nlmsg_free(msg);
14038 }
14039 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
14040
14041 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
14042                                  const u8 *peer, u32 num_packets, gfp_t gfp)
14043 {
14044         struct sk_buff *msg;
14045
14046         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
14047
14048         msg = cfg80211_prepare_cqm(dev, peer, gfp);
14049         if (!msg)
14050                 return;
14051
14052         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
14053                 goto nla_put_failure;
14054
14055         cfg80211_send_cqm(msg, gfp);
14056         return;
14057
14058  nla_put_failure:
14059         nlmsg_free(msg);
14060 }
14061 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
14062
14063 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
14064 {
14065         struct sk_buff *msg;
14066
14067         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
14068         if (!msg)
14069                 return;
14070
14071         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
14072                 goto nla_put_failure;
14073
14074         cfg80211_send_cqm(msg, gfp);
14075         return;
14076
14077  nla_put_failure:
14078         nlmsg_free(msg);
14079 }
14080 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
14081
14082 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
14083                                      struct net_device *netdev, const u8 *bssid,
14084                                      const u8 *replay_ctr, gfp_t gfp)
14085 {
14086         struct sk_buff *msg;
14087         struct nlattr *rekey_attr;
14088         void *hdr;
14089
14090         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14091         if (!msg)
14092                 return;
14093
14094         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
14095         if (!hdr) {
14096                 nlmsg_free(msg);
14097                 return;
14098         }
14099
14100         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14101             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14102             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14103                 goto nla_put_failure;
14104
14105         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
14106         if (!rekey_attr)
14107                 goto nla_put_failure;
14108
14109         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
14110                     NL80211_REPLAY_CTR_LEN, replay_ctr))
14111                 goto nla_put_failure;
14112
14113         nla_nest_end(msg, rekey_attr);
14114
14115         genlmsg_end(msg, hdr);
14116
14117         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14118                                 NL80211_MCGRP_MLME, gfp);
14119         return;
14120
14121  nla_put_failure:
14122         genlmsg_cancel(msg, hdr);
14123         nlmsg_free(msg);
14124 }
14125
14126 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
14127                                const u8 *replay_ctr, gfp_t gfp)
14128 {
14129         struct wireless_dev *wdev = dev->ieee80211_ptr;
14130         struct wiphy *wiphy = wdev->wiphy;
14131         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14132
14133         trace_cfg80211_gtk_rekey_notify(dev, bssid);
14134         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
14135 }
14136 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
14137
14138 static void
14139 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
14140                                struct net_device *netdev, int index,
14141                                const u8 *bssid, bool preauth, gfp_t gfp)
14142 {
14143         struct sk_buff *msg;
14144         struct nlattr *attr;
14145         void *hdr;
14146
14147         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14148         if (!msg)
14149                 return;
14150
14151         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
14152         if (!hdr) {
14153                 nlmsg_free(msg);
14154                 return;
14155         }
14156
14157         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14158             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
14159                 goto nla_put_failure;
14160
14161         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
14162         if (!attr)
14163                 goto nla_put_failure;
14164
14165         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
14166             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
14167             (preauth &&
14168              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
14169                 goto nla_put_failure;
14170
14171         nla_nest_end(msg, attr);
14172
14173         genlmsg_end(msg, hdr);
14174
14175         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14176                                 NL80211_MCGRP_MLME, gfp);
14177         return;
14178
14179  nla_put_failure:
14180         genlmsg_cancel(msg, hdr);
14181         nlmsg_free(msg);
14182 }
14183
14184 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
14185                                      const u8 *bssid, bool preauth, gfp_t gfp)
14186 {
14187         struct wireless_dev *wdev = dev->ieee80211_ptr;
14188         struct wiphy *wiphy = wdev->wiphy;
14189         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14190
14191         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
14192         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
14193 }
14194 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
14195
14196 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
14197                                      struct net_device *netdev,
14198                                      struct cfg80211_chan_def *chandef,
14199                                      gfp_t gfp,
14200                                      enum nl80211_commands notif,
14201                                      u8 count)
14202 {
14203         struct sk_buff *msg;
14204         void *hdr;
14205
14206         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14207         if (!msg)
14208                 return;
14209
14210         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
14211         if (!hdr) {
14212                 nlmsg_free(msg);
14213                 return;
14214         }
14215
14216         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
14217                 goto nla_put_failure;
14218
14219         if (nl80211_send_chandef(msg, chandef))
14220                 goto nla_put_failure;
14221
14222         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
14223             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
14224                         goto nla_put_failure;
14225
14226         genlmsg_end(msg, hdr);
14227
14228         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14229                                 NL80211_MCGRP_MLME, gfp);
14230         return;
14231
14232  nla_put_failure:
14233         genlmsg_cancel(msg, hdr);
14234         nlmsg_free(msg);
14235 }
14236
14237 void cfg80211_ch_switch_notify(struct net_device *dev,
14238                                struct cfg80211_chan_def *chandef)
14239 {
14240         struct wireless_dev *wdev = dev->ieee80211_ptr;
14241         struct wiphy *wiphy = wdev->wiphy;
14242         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14243
14244         ASSERT_WDEV_LOCK(wdev);
14245
14246         trace_cfg80211_ch_switch_notify(dev, chandef);
14247
14248         wdev->chandef = *chandef;
14249         wdev->preset_chandef = *chandef;
14250         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14251                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
14252 }
14253 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
14254
14255 void cfg80211_ch_switch_started_notify(struct net_device *dev,
14256                                        struct cfg80211_chan_def *chandef,
14257                                        u8 count)
14258 {
14259         struct wireless_dev *wdev = dev->ieee80211_ptr;
14260         struct wiphy *wiphy = wdev->wiphy;
14261         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14262
14263         trace_cfg80211_ch_switch_started_notify(dev, chandef);
14264
14265         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14266                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
14267 }
14268 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
14269
14270 void
14271 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
14272                      const struct cfg80211_chan_def *chandef,
14273                      enum nl80211_radar_event event,
14274                      struct net_device *netdev, gfp_t gfp)
14275 {
14276         struct sk_buff *msg;
14277         void *hdr;
14278
14279         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14280         if (!msg)
14281                 return;
14282
14283         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
14284         if (!hdr) {
14285                 nlmsg_free(msg);
14286                 return;
14287         }
14288
14289         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
14290                 goto nla_put_failure;
14291
14292         /* NOP and radar events don't need a netdev parameter */
14293         if (netdev) {
14294                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
14295
14296                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14297                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14298                                       NL80211_ATTR_PAD))
14299                         goto nla_put_failure;
14300         }
14301
14302         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
14303                 goto nla_put_failure;
14304
14305         if (nl80211_send_chandef(msg, chandef))
14306                 goto nla_put_failure;
14307
14308         genlmsg_end(msg, hdr);
14309
14310         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14311                                 NL80211_MCGRP_MLME, gfp);
14312         return;
14313
14314  nla_put_failure:
14315         genlmsg_cancel(msg, hdr);
14316         nlmsg_free(msg);
14317 }
14318
14319 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
14320                            u64 cookie, bool acked, gfp_t gfp)
14321 {
14322         struct wireless_dev *wdev = dev->ieee80211_ptr;
14323         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14324         struct sk_buff *msg;
14325         void *hdr;
14326
14327         trace_cfg80211_probe_status(dev, addr, cookie, acked);
14328
14329         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14330
14331         if (!msg)
14332                 return;
14333
14334         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
14335         if (!hdr) {
14336                 nlmsg_free(msg);
14337                 return;
14338         }
14339
14340         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14341             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14342             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14343             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14344                               NL80211_ATTR_PAD) ||
14345             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
14346                 goto nla_put_failure;
14347
14348         genlmsg_end(msg, hdr);
14349
14350         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14351                                 NL80211_MCGRP_MLME, gfp);
14352         return;
14353
14354  nla_put_failure:
14355         genlmsg_cancel(msg, hdr);
14356         nlmsg_free(msg);
14357 }
14358 EXPORT_SYMBOL(cfg80211_probe_status);
14359
14360 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
14361                                  const u8 *frame, size_t len,
14362                                  int freq, int sig_dbm)
14363 {
14364         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14365         struct sk_buff *msg;
14366         void *hdr;
14367         struct cfg80211_beacon_registration *reg;
14368
14369         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
14370
14371         spin_lock_bh(&rdev->beacon_registrations_lock);
14372         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14373                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
14374                 if (!msg) {
14375                         spin_unlock_bh(&rdev->beacon_registrations_lock);
14376                         return;
14377                 }
14378
14379                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14380                 if (!hdr)
14381                         goto nla_put_failure;
14382
14383                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14384                     (freq &&
14385                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
14386                     (sig_dbm &&
14387                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14388                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
14389                         goto nla_put_failure;
14390
14391                 genlmsg_end(msg, hdr);
14392
14393                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
14394         }
14395         spin_unlock_bh(&rdev->beacon_registrations_lock);
14396         return;
14397
14398  nla_put_failure:
14399         spin_unlock_bh(&rdev->beacon_registrations_lock);
14400         if (hdr)
14401                 genlmsg_cancel(msg, hdr);
14402         nlmsg_free(msg);
14403 }
14404 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
14405
14406 #ifdef CONFIG_PM
14407 static int cfg80211_net_detect_results(struct sk_buff *msg,
14408                                        struct cfg80211_wowlan_wakeup *wakeup)
14409 {
14410         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
14411         struct nlattr *nl_results, *nl_match, *nl_freqs;
14412         int i, j;
14413
14414         nl_results = nla_nest_start(
14415                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
14416         if (!nl_results)
14417                 return -EMSGSIZE;
14418
14419         for (i = 0; i < nd->n_matches; i++) {
14420                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
14421
14422                 nl_match = nla_nest_start(msg, i);
14423                 if (!nl_match)
14424                         break;
14425
14426                 /* The SSID attribute is optional in nl80211, but for
14427                  * simplicity reasons it's always present in the
14428                  * cfg80211 structure.  If a driver can't pass the
14429                  * SSID, that needs to be changed.  A zero length SSID
14430                  * is still a valid SSID (wildcard), so it cannot be
14431                  * used for this purpose.
14432                  */
14433                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
14434                             match->ssid.ssid)) {
14435                         nla_nest_cancel(msg, nl_match);
14436                         goto out;
14437                 }
14438
14439                 if (match->n_channels) {
14440                         nl_freqs = nla_nest_start(
14441                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
14442                         if (!nl_freqs) {
14443                                 nla_nest_cancel(msg, nl_match);
14444                                 goto out;
14445                         }
14446
14447                         for (j = 0; j < match->n_channels; j++) {
14448                                 if (nla_put_u32(msg, j, match->channels[j])) {
14449                                         nla_nest_cancel(msg, nl_freqs);
14450                                         nla_nest_cancel(msg, nl_match);
14451                                         goto out;
14452                                 }
14453                         }
14454
14455                         nla_nest_end(msg, nl_freqs);
14456                 }
14457
14458                 nla_nest_end(msg, nl_match);
14459         }
14460
14461 out:
14462         nla_nest_end(msg, nl_results);
14463         return 0;
14464 }
14465
14466 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
14467                                    struct cfg80211_wowlan_wakeup *wakeup,
14468                                    gfp_t gfp)
14469 {
14470         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14471         struct sk_buff *msg;
14472         void *hdr;
14473         int size = 200;
14474
14475         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
14476
14477         if (wakeup)
14478                 size += wakeup->packet_present_len;
14479
14480         msg = nlmsg_new(size, gfp);
14481         if (!msg)
14482                 return;
14483
14484         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
14485         if (!hdr)
14486                 goto free_msg;
14487
14488         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14489             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14490                               NL80211_ATTR_PAD))
14491                 goto free_msg;
14492
14493         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14494                                         wdev->netdev->ifindex))
14495                 goto free_msg;
14496
14497         if (wakeup) {
14498                 struct nlattr *reasons;
14499
14500                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
14501                 if (!reasons)
14502                         goto free_msg;
14503
14504                 if (wakeup->disconnect &&
14505                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
14506                         goto free_msg;
14507                 if (wakeup->magic_pkt &&
14508                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
14509                         goto free_msg;
14510                 if (wakeup->gtk_rekey_failure &&
14511                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
14512                         goto free_msg;
14513                 if (wakeup->eap_identity_req &&
14514                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
14515                         goto free_msg;
14516                 if (wakeup->four_way_handshake &&
14517                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
14518                         goto free_msg;
14519                 if (wakeup->rfkill_release &&
14520                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
14521                         goto free_msg;
14522
14523                 if (wakeup->pattern_idx >= 0 &&
14524                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
14525                                 wakeup->pattern_idx))
14526                         goto free_msg;
14527
14528                 if (wakeup->tcp_match &&
14529                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
14530                         goto free_msg;
14531
14532                 if (wakeup->tcp_connlost &&
14533                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
14534                         goto free_msg;
14535
14536                 if (wakeup->tcp_nomoretokens &&
14537                     nla_put_flag(msg,
14538                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
14539                         goto free_msg;
14540
14541                 if (wakeup->packet) {
14542                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
14543                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
14544
14545                         if (!wakeup->packet_80211) {
14546                                 pkt_attr =
14547                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
14548                                 len_attr =
14549                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
14550                         }
14551
14552                         if (wakeup->packet_len &&
14553                             nla_put_u32(msg, len_attr, wakeup->packet_len))
14554                                 goto free_msg;
14555
14556                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
14557                                     wakeup->packet))
14558                                 goto free_msg;
14559                 }
14560
14561                 if (wakeup->net_detect &&
14562                     cfg80211_net_detect_results(msg, wakeup))
14563                                 goto free_msg;
14564
14565                 nla_nest_end(msg, reasons);
14566         }
14567
14568         genlmsg_end(msg, hdr);
14569
14570         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14571                                 NL80211_MCGRP_MLME, gfp);
14572         return;
14573
14574  free_msg:
14575         nlmsg_free(msg);
14576 }
14577 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
14578 #endif
14579
14580 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
14581                                 enum nl80211_tdls_operation oper,
14582                                 u16 reason_code, gfp_t gfp)
14583 {
14584         struct wireless_dev *wdev = dev->ieee80211_ptr;
14585         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14586         struct sk_buff *msg;
14587         void *hdr;
14588
14589         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
14590                                          reason_code);
14591
14592         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14593         if (!msg)
14594                 return;
14595
14596         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
14597         if (!hdr) {
14598                 nlmsg_free(msg);
14599                 return;
14600         }
14601
14602         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14603             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14604             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
14605             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
14606             (reason_code > 0 &&
14607              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
14608                 goto nla_put_failure;
14609
14610         genlmsg_end(msg, hdr);
14611
14612         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14613                                 NL80211_MCGRP_MLME, gfp);
14614         return;
14615
14616  nla_put_failure:
14617         genlmsg_cancel(msg, hdr);
14618         nlmsg_free(msg);
14619 }
14620 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
14621
14622 static int nl80211_netlink_notify(struct notifier_block * nb,
14623                                   unsigned long state,
14624                                   void *_notify)
14625 {
14626         struct netlink_notify *notify = _notify;
14627         struct cfg80211_registered_device *rdev;
14628         struct wireless_dev *wdev;
14629         struct cfg80211_beacon_registration *reg, *tmp;
14630
14631         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
14632                 return NOTIFY_DONE;
14633
14634         rcu_read_lock();
14635
14636         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
14637                 bool schedule_destroy_work = false;
14638                 struct cfg80211_sched_scan_request *sched_scan_req =
14639                         rcu_dereference(rdev->sched_scan_req);
14640
14641                 if (sched_scan_req && notify->portid &&
14642                     sched_scan_req->owner_nlportid == notify->portid) {
14643                         sched_scan_req->owner_nlportid = 0;
14644
14645                         if (rdev->ops->sched_scan_stop &&
14646                             rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
14647                                 schedule_work(&rdev->sched_scan_stop_wk);
14648                 }
14649
14650                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
14651                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
14652
14653                         if (wdev->owner_nlportid == notify->portid)
14654                                 schedule_destroy_work = true;
14655                         else if (wdev->conn_owner_nlportid == notify->portid)
14656                                 schedule_work(&wdev->disconnect_wk);
14657                 }
14658
14659                 spin_lock_bh(&rdev->beacon_registrations_lock);
14660                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
14661                                          list) {
14662                         if (reg->nlportid == notify->portid) {
14663                                 list_del(&reg->list);
14664                                 kfree(reg);
14665                                 break;
14666                         }
14667                 }
14668                 spin_unlock_bh(&rdev->beacon_registrations_lock);
14669
14670                 if (schedule_destroy_work) {
14671                         struct cfg80211_iface_destroy *destroy;
14672
14673                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
14674                         if (destroy) {
14675                                 destroy->nlportid = notify->portid;
14676                                 spin_lock(&rdev->destroy_list_lock);
14677                                 list_add(&destroy->list, &rdev->destroy_list);
14678                                 spin_unlock(&rdev->destroy_list_lock);
14679                                 schedule_work(&rdev->destroy_work);
14680                         }
14681                 }
14682         }
14683
14684         rcu_read_unlock();
14685
14686         /*
14687          * It is possible that the user space process that is controlling the
14688          * indoor setting disappeared, so notify the regulatory core.
14689          */
14690         regulatory_netlink_notify(notify->portid);
14691         return NOTIFY_OK;
14692 }
14693
14694 static struct notifier_block nl80211_netlink_notifier = {
14695         .notifier_call = nl80211_netlink_notify,
14696 };
14697
14698 void cfg80211_ft_event(struct net_device *netdev,
14699                        struct cfg80211_ft_event_params *ft_event)
14700 {
14701         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
14702         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14703         struct sk_buff *msg;
14704         void *hdr;
14705
14706         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
14707
14708         if (!ft_event->target_ap)
14709                 return;
14710
14711         msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL);
14712         if (!msg)
14713                 return;
14714
14715         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
14716         if (!hdr)
14717                 goto out;
14718
14719         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14720             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14721             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
14722                 goto out;
14723
14724         if (ft_event->ies &&
14725             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
14726                 goto out;
14727         if (ft_event->ric_ies &&
14728             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
14729                     ft_event->ric_ies))
14730                 goto out;
14731
14732         genlmsg_end(msg, hdr);
14733
14734         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14735                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14736         return;
14737  out:
14738         nlmsg_free(msg);
14739 }
14740 EXPORT_SYMBOL(cfg80211_ft_event);
14741
14742 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
14743 {
14744         struct cfg80211_registered_device *rdev;
14745         struct sk_buff *msg;
14746         void *hdr;
14747         u32 nlportid;
14748
14749         rdev = wiphy_to_rdev(wdev->wiphy);
14750         if (!rdev->crit_proto_nlportid)
14751                 return;
14752
14753         nlportid = rdev->crit_proto_nlportid;
14754         rdev->crit_proto_nlportid = 0;
14755
14756         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14757         if (!msg)
14758                 return;
14759
14760         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
14761         if (!hdr)
14762                 goto nla_put_failure;
14763
14764         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14765             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14766                               NL80211_ATTR_PAD))
14767                 goto nla_put_failure;
14768
14769         genlmsg_end(msg, hdr);
14770
14771         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14772         return;
14773
14774  nla_put_failure:
14775         if (hdr)
14776                 genlmsg_cancel(msg, hdr);
14777         nlmsg_free(msg);
14778 }
14779 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
14780
14781 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
14782 {
14783         struct wiphy *wiphy = wdev->wiphy;
14784         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14785         struct sk_buff *msg;
14786         void *hdr;
14787
14788         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14789         if (!msg)
14790                 return;
14791
14792         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
14793         if (!hdr)
14794                 goto out;
14795
14796         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14797             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
14798             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14799                               NL80211_ATTR_PAD))
14800                 goto out;
14801
14802         genlmsg_end(msg, hdr);
14803
14804         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
14805                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14806         return;
14807  out:
14808         nlmsg_free(msg);
14809 }
14810
14811 /* initialisation/exit functions */
14812
14813 int __init nl80211_init(void)
14814 {
14815         int err;
14816
14817         err = genl_register_family(&nl80211_fam);
14818         if (err)
14819                 return err;
14820
14821         err = netlink_register_notifier(&nl80211_netlink_notifier);
14822         if (err)
14823                 goto err_out;
14824
14825         return 0;
14826  err_out:
14827         genl_unregister_family(&nl80211_fam);
14828         return err;
14829 }
14830
14831 void nl80211_exit(void)
14832 {
14833         netlink_unregister_notifier(&nl80211_netlink_notifier);
14834         genl_unregister_family(&nl80211_fam);
14835 }