net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25 #include "rdev-ops.h"
  26
  27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  28                                    struct genl_info *info,
  29                                    struct cfg80211_crypto_settings *settings,
  30                                    int cipher_limit);
  31
  32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  33                             struct genl_info *info);
  34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  35                               struct genl_info *info);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam = {
  39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  40         .name = "nl80211",      /* have users key off the name instead */
  41         .hdrsize = 0,           /* no private header */
  42         .version = 1,           /* no particular meaning now */
  43         .maxattr = NL80211_ATTR_MAX,
  44         .netnsok = true,
  45         .pre_doit = nl80211_pre_doit,
  46         .post_doit = nl80211_post_doit,
  47 };
  48
  49 /* returns ERR_PTR values */
  50 static struct wireless_dev *
  51 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  52 {
  53         struct cfg80211_registered_device *rdev;
  54         struct wireless_dev *result = NULL;
  55         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  56         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  57         u64 wdev_id;
  58         int wiphy_idx = -1;
  59         int ifidx = -1;
  60
  61         assert_cfg80211_lock();
  62
  63         if (!have_ifidx && !have_wdev_id)
  64                 return ERR_PTR(-EINVAL);
  65
  66         if (have_ifidx)
  67                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  68         if (have_wdev_id) {
  69                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  70                 wiphy_idx = wdev_id >> 32;
  71         }
  72
  73         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  74                 struct wireless_dev *wdev;
  75
  76                 if (wiphy_net(&rdev->wiphy) != netns)
  77                         continue;
  78
  79                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  80                         continue;
  81
  82                 mutex_lock(&rdev->devlist_mtx);
  83                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  84                         if (have_ifidx && wdev->netdev &&
  85                             wdev->netdev->ifindex == ifidx) {
  86                                 result = wdev;
  87                                 break;
  88                         }
  89                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  90                                 result = wdev;
  91                                 break;
  92                         }
  93                 }
  94                 mutex_unlock(&rdev->devlist_mtx);
  95
  96                 if (result)
  97                         break;
  98         }
  99
 100         if (result)
 101                 return result;
 102         return ERR_PTR(-ENODEV);
 103 }
 104
 105 static struct cfg80211_registered_device *
 106 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 107 {
 108         struct cfg80211_registered_device *rdev = NULL, *tmp;
 109         struct net_device *netdev;
 110
 111         assert_cfg80211_lock();
 112
 113         if (!attrs[NL80211_ATTR_WIPHY] &&
 114             !attrs[NL80211_ATTR_IFINDEX] &&
 115             !attrs[NL80211_ATTR_WDEV])
 116                 return ERR_PTR(-EINVAL);
 117
 118         if (attrs[NL80211_ATTR_WIPHY])
 119                 rdev = cfg80211_rdev_by_wiphy_idx(
 120                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 121
 122         if (attrs[NL80211_ATTR_WDEV]) {
 123                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 124                 struct wireless_dev *wdev;
 125                 bool found = false;
 126
 127                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 128                 if (tmp) {
 129                         /* make sure wdev exists */
 130                         mutex_lock(&tmp->devlist_mtx);
 131                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 132                                 if (wdev->identifier != (u32)wdev_id)
 133                                         continue;
 134                                 found = true;
 135                                 break;
 136                         }
 137                         mutex_unlock(&tmp->devlist_mtx);
 138
 139                         if (!found)
 140                                 tmp = NULL;
 141
 142                         if (rdev && tmp != rdev)
 143                                 return ERR_PTR(-EINVAL);
 144                         rdev = tmp;
 145                 }
 146         }
 147
 148         if (attrs[NL80211_ATTR_IFINDEX]) {
 149                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 150                 netdev = dev_get_by_index(netns, ifindex);
 151                 if (netdev) {
 152                         if (netdev->ieee80211_ptr)
 153                                 tmp = wiphy_to_dev(
 154                                                 netdev->ieee80211_ptr->wiphy);
 155                         else
 156                                 tmp = NULL;
 157
 158                         dev_put(netdev);
 159
 160                         /* not wireless device -- return error */
 161                         if (!tmp)
 162                                 return ERR_PTR(-EINVAL);
 163
 164                         /* mismatch -- return error */
 165                         if (rdev && tmp != rdev)
 166                                 return ERR_PTR(-EINVAL);
 167
 168                         rdev = tmp;
 169                 }
 170         }
 171
 172         if (!rdev)
 173                 return ERR_PTR(-ENODEV);
 174
 175         if (netns != wiphy_net(&rdev->wiphy))
 176                 return ERR_PTR(-ENODEV);
 177
 178         return rdev;
 179 }
 180
 181 /*
 182  * This function returns a pointer to the driver
 183  * that the genl_info item that is passed refers to.
 184  * If successful, it returns non-NULL and also locks
 185  * the driver's mutex!
 186  *
 187  * This means that you need to call cfg80211_unlock_rdev()
 188  * before being allowed to acquire &cfg80211_mutex!
 189  *
 190  * This is necessary because we need to lock the global
 191  * mutex to get an item off the list safely, and then
 192  * we lock the rdev mutex so it doesn't go away under us.
 193  *
 194  * We don't want to keep cfg80211_mutex locked
 195  * for all the time in order to allow requests on
 196  * other interfaces to go through at the same time.
 197  *
 198  * The result of this can be a PTR_ERR and hence must
 199  * be checked with IS_ERR() for errors.
 200  */
 201 static struct cfg80211_registered_device *
 202 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 203 {
 204         struct cfg80211_registered_device *rdev;
 205
 206         mutex_lock(&cfg80211_mutex);
 207         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 208
 209         /* if it is not an error we grab the lock on
 210          * it to assure it won't be going away while
 211          * we operate on it */
 212         if (!IS_ERR(rdev))
 213                 mutex_lock(&rdev->mtx);
 214
 215         mutex_unlock(&cfg80211_mutex);
 216
 217         return rdev;
 218 }
 219
 220 /* policy for the attributes */
 221 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 222         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 223         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 224                                       .len = 20-1 },
 225         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 226         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 229         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 230         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 231         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 232         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 233
 234         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 235         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 236         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 237
 238         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 239         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 240
 241         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 242         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 243                                     .len = WLAN_MAX_KEY_LEN },
 244         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 245         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 246         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 247         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 248         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 249
 250         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 251         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 252         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 253                                        .len = IEEE80211_MAX_DATA_LEN },
 254         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 255                                        .len = IEEE80211_MAX_DATA_LEN },
 256         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 257         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 258         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 259         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 260                                                .len = NL80211_MAX_SUPP_RATES },
 261         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 262         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 263         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 264         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 265                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 266         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 267
 268         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 269         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 270
 271         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 272         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 273         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 274         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 275                                            .len = NL80211_MAX_SUPP_RATES },
 276         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 277
 278         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 279         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 280
 281         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 282
 283         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 284         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 285                               .len = IEEE80211_MAX_DATA_LEN },
 286         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 287         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 288
 289         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 290                                 .len = IEEE80211_MAX_SSID_LEN },
 291         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 292         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 293         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 294         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 295         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 296         [NL80211_ATTR_STA_FLAGS2] = {
 297                 .len = sizeof(struct nl80211_sta_flag_update),
 298         },
 299         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 301         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 302         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 303         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 304         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 305         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 306         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 307         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 308                                  .len = WLAN_PMKID_LEN },
 309         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 310         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 311         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 312         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 313                                  .len = IEEE80211_MAX_DATA_LEN },
 314         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 315         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 316         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 317         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 318         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 319         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 320         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 321         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 322         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 323         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 324         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 325         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 326         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 327         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 329         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 330         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 331         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 332         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 333         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 334                                          .len = IEEE80211_MAX_DATA_LEN },
 335         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 336                                          .len = IEEE80211_MAX_DATA_LEN },
 337         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 338         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 339         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 341         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 342         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 343         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 347                                       .len = IEEE80211_MAX_DATA_LEN },
 348         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 351                 .len = NL80211_HT_CAPABILITY_LEN
 352         },
 353         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 354         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 355         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 356         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 357         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 358         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 359         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 360         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 361 };
 362
 363 /* policy for the key attributes */
 364 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 365         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 366         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 367         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 368         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 369         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 370         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 371         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 372         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 373 };
 374
 375 /* policy for the key default flags */
 376 static const struct nla_policy
 377 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 378         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 379         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 380 };
 381
 382 /* policy for WoWLAN attributes */
 383 static const struct nla_policy
 384 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 385         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 386         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 387         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 388         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 389         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 390         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 391         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 392         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 393 };
 394
 395 /* policy for GTK rekey offload attributes */
 396 static const struct nla_policy
 397 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 398         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 399         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 400         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 401 };
 402
 403 static const struct nla_policy
 404 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 405         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 406                                                  .len = IEEE80211_MAX_SSID_LEN },
 407         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 408 };
 409
 410 /* ifidx get helper */
 411 static int nl80211_get_ifidx(struct netlink_callback *cb)
 412 {
 413         int res;
 414
 415         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 416                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 417                           nl80211_policy);
 418         if (res)
 419                 return res;
 420
 421         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 422                 return -EINVAL;
 423
 424         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 425         if (!res)
 426                 return -EINVAL;
 427         return res;
 428 }
 429
 430 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 431                                        struct netlink_callback *cb,
 432                                        struct cfg80211_registered_device **rdev,
 433                                        struct net_device **dev)
 434 {
 435         int ifidx = cb->args[0];
 436         int err;
 437
 438         if (!ifidx)
 439                 ifidx = nl80211_get_ifidx(cb);
 440         if (ifidx < 0)
 441                 return ifidx;
 442
 443         cb->args[0] = ifidx;
 444
 445         rtnl_lock();
 446
 447         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 448         if (!*dev) {
 449                 err = -ENODEV;
 450                 goto out_rtnl;
 451         }
 452
 453         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 454         if (IS_ERR(*rdev)) {
 455                 err = PTR_ERR(*rdev);
 456                 goto out_rtnl;
 457         }
 458
 459         return 0;
 460  out_rtnl:
 461         rtnl_unlock();
 462         return err;
 463 }
 464
 465 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 466 {
 467         cfg80211_unlock_rdev(rdev);
 468         rtnl_unlock();
 469 }
 470
 471 /* IE validation */
 472 static bool is_valid_ie_attr(const struct nlattr *attr)
 473 {
 474         const u8 *pos;
 475         int len;
 476
 477         if (!attr)
 478                 return true;
 479
 480         pos = nla_data(attr);
 481         len = nla_len(attr);
 482
 483         while (len) {
 484                 u8 elemlen;
 485
 486                 if (len < 2)
 487                         return false;
 488                 len -= 2;
 489
 490                 elemlen = pos[1];
 491                 if (elemlen > len)
 492                         return false;
 493
 494                 len -= elemlen;
 495                 pos += 2 + elemlen;
 496         }
 497
 498         return true;
 499 }
 500
 501 /* message building helper */
 502 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 503                                    int flags, u8 cmd)
 504 {
 505         /* since there is no private header just add the generic one */
 506         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 507 }
 508
 509 static int nl80211_msg_put_channel(struct sk_buff *msg,
 510                                    struct ieee80211_channel *chan)
 511 {
 512         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 513                         chan->center_freq))
 514                 goto nla_put_failure;
 515
 516         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 517             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 518                 goto nla_put_failure;
 519         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 520             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 521                 goto nla_put_failure;
 522         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 523             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 524                 goto nla_put_failure;
 525         if ((chan->flags & IEEE80211_CHAN_RADAR) &&
 526             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 527                 goto nla_put_failure;
 528
 529         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 530                         DBM_TO_MBM(chan->max_power)))
 531                 goto nla_put_failure;
 532
 533         return 0;
 534
 535  nla_put_failure:
 536         return -ENOBUFS;
 537 }
 538
 539 /* netlink command implementations */
 540
 541 struct key_parse {
 542         struct key_params p;
 543         int idx;
 544         int type;
 545         bool def, defmgmt;
 546         bool def_uni, def_multi;
 547 };
 548
 549 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 550 {
 551         struct nlattr *tb[NL80211_KEY_MAX + 1];
 552         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 553                                    nl80211_key_policy);
 554         if (err)
 555                 return err;
 556
 557         k->def = !!tb[NL80211_KEY_DEFAULT];
 558         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 559
 560         if (k->def) {
 561                 k->def_uni = true;
 562                 k->def_multi = true;
 563         }
 564         if (k->defmgmt)
 565                 k->def_multi = true;
 566
 567         if (tb[NL80211_KEY_IDX])
 568                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 569
 570         if (tb[NL80211_KEY_DATA]) {
 571                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 572                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 573         }
 574
 575         if (tb[NL80211_KEY_SEQ]) {
 576                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 577                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 578         }
 579
 580         if (tb[NL80211_KEY_CIPHER])
 581                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 582
 583         if (tb[NL80211_KEY_TYPE]) {
 584                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 585                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 586                         return -EINVAL;
 587         }
 588
 589         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 590                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 591                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 592                                        tb[NL80211_KEY_DEFAULT_TYPES],
 593                                        nl80211_key_default_policy);
 594                 if (err)
 595                         return err;
 596
 597                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 598                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 599         }
 600
 601         return 0;
 602 }
 603
 604 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 605 {
 606         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 607                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 608                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 609         }
 610
 611         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 612                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 613                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 614         }
 615
 616         if (info->attrs[NL80211_ATTR_KEY_IDX])
 617                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 618
 619         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 620                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 621
 622         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 623         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 624
 625         if (k->def) {
 626                 k->def_uni = true;
 627                 k->def_multi = true;
 628         }
 629         if (k->defmgmt)
 630                 k->def_multi = true;
 631
 632         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 633                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 634                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 635                         return -EINVAL;
 636         }
 637
 638         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 639                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 640                 int err = nla_parse_nested(
 641                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 642                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 643                                 nl80211_key_default_policy);
 644                 if (err)
 645                         return err;
 646
 647                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 648                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 649         }
 650
 651         return 0;
 652 }
 653
 654 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 655 {
 656         int err;
 657
 658         memset(k, 0, sizeof(*k));
 659         k->idx = -1;
 660         k->type = -1;
 661
 662         if (info->attrs[NL80211_ATTR_KEY])
 663                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 664         else
 665                 err = nl80211_parse_key_old(info, k);
 666
 667         if (err)
 668                 return err;
 669
 670         if (k->def && k->defmgmt)
 671                 return -EINVAL;
 672
 673         if (k->defmgmt) {
 674                 if (k->def_uni || !k->def_multi)
 675                         return -EINVAL;
 676         }
 677
 678         if (k->idx != -1) {
 679                 if (k->defmgmt) {
 680                         if (k->idx < 4 || k->idx > 5)
 681                                 return -EINVAL;
 682                 } else if (k->def) {
 683                         if (k->idx < 0 || k->idx > 3)
 684                                 return -EINVAL;
 685                 } else {
 686                         if (k->idx < 0 || k->idx > 5)
 687                                 return -EINVAL;
 688                 }
 689         }
 690
 691         return 0;
 692 }
 693
 694 static struct cfg80211_cached_keys *
 695 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 696                        struct nlattr *keys, bool *no_ht)
 697 {
 698         struct key_parse parse;
 699         struct nlattr *key;
 700         struct cfg80211_cached_keys *result;
 701         int rem, err, def = 0;
 702
 703         result = kzalloc(sizeof(*result), GFP_KERNEL);
 704         if (!result)
 705                 return ERR_PTR(-ENOMEM);
 706
 707         result->def = -1;
 708         result->defmgmt = -1;
 709
 710         nla_for_each_nested(key, keys, rem) {
 711                 memset(&parse, 0, sizeof(parse));
 712                 parse.idx = -1;
 713
 714                 err = nl80211_parse_key_new(key, &parse);
 715                 if (err)
 716                         goto error;
 717                 err = -EINVAL;
 718                 if (!parse.p.key)
 719                         goto error;
 720                 if (parse.idx < 0 || parse.idx > 4)
 721                         goto error;
 722                 if (parse.def) {
 723                         if (def)
 724                                 goto error;
 725                         def = 1;
 726                         result->def = parse.idx;
 727                         if (!parse.def_uni || !parse.def_multi)
 728                                 goto error;
 729                 } else if (parse.defmgmt)
 730                         goto error;
 731                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 732                                                      parse.idx, false, NULL);
 733                 if (err)
 734                         goto error;
 735                 result->params[parse.idx].cipher = parse.p.cipher;
 736                 result->params[parse.idx].key_len = parse.p.key_len;
 737                 result->params[parse.idx].key = result->data[parse.idx];
 738                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 739
 740                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 741                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 742                         if (no_ht)
 743                                 *no_ht = true;
 744                 }
 745         }
 746
 747         return result;
 748  error:
 749         kfree(result);
 750         return ERR_PTR(err);
 751 }
 752
 753 static int nl80211_key_allowed(struct wireless_dev *wdev)
 754 {
 755         ASSERT_WDEV_LOCK(wdev);
 756
 757         switch (wdev->iftype) {
 758         case NL80211_IFTYPE_AP:
 759         case NL80211_IFTYPE_AP_VLAN:
 760         case NL80211_IFTYPE_P2P_GO:
 761         case NL80211_IFTYPE_MESH_POINT:
 762                 break;
 763         case NL80211_IFTYPE_ADHOC:
 764                 if (!wdev->current_bss)
 765                         return -ENOLINK;
 766                 break;
 767         case NL80211_IFTYPE_STATION:
 768         case NL80211_IFTYPE_P2P_CLIENT:
 769                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 770                         return -ENOLINK;
 771                 break;
 772         default:
 773                 return -EINVAL;
 774         }
 775
 776         return 0;
 777 }
 778
 779 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 780 {
 781         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 782         int i;
 783
 784         if (!nl_modes)
 785                 goto nla_put_failure;
 786
 787         i = 0;
 788         while (ifmodes) {
 789                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 790                         goto nla_put_failure;
 791                 ifmodes >>= 1;
 792                 i++;
 793         }
 794
 795         nla_nest_end(msg, nl_modes);
 796         return 0;
 797
 798 nla_put_failure:
 799         return -ENOBUFS;
 800 }
 801
 802 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 803                                           struct sk_buff *msg)
 804 {
 805         struct nlattr *nl_combis;
 806         int i, j;
 807
 808         nl_combis = nla_nest_start(msg,
 809                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 810         if (!nl_combis)
 811                 goto nla_put_failure;
 812
 813         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 814                 const struct ieee80211_iface_combination *c;
 815                 struct nlattr *nl_combi, *nl_limits;
 816
 817                 c = &wiphy->iface_combinations[i];
 818
 819                 nl_combi = nla_nest_start(msg, i + 1);
 820                 if (!nl_combi)
 821                         goto nla_put_failure;
 822
 823                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 824                 if (!nl_limits)
 825                         goto nla_put_failure;
 826
 827                 for (j = 0; j < c->n_limits; j++) {
 828                         struct nlattr *nl_limit;
 829
 830                         nl_limit = nla_nest_start(msg, j + 1);
 831                         if (!nl_limit)
 832                                 goto nla_put_failure;
 833                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 834                                         c->limits[j].max))
 835                                 goto nla_put_failure;
 836                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 837                                                 c->limits[j].types))
 838                                 goto nla_put_failure;
 839                         nla_nest_end(msg, nl_limit);
 840                 }
 841
 842                 nla_nest_end(msg, nl_limits);
 843
 844                 if (c->beacon_int_infra_match &&
 845                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 846                         goto nla_put_failure;
 847                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 848                                 c->num_different_channels) ||
 849                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 850                                 c->max_interfaces))
 851                         goto nla_put_failure;
 852
 853                 nla_nest_end(msg, nl_combi);
 854         }
 855
 856         nla_nest_end(msg, nl_combis);
 857
 858         return 0;
 859 nla_put_failure:
 860         return -ENOBUFS;
 861 }
 862
 863 static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
 864                               struct cfg80211_registered_device *dev)
 865 {
 866         void *hdr;
 867         struct nlattr *nl_bands, *nl_band;
 868         struct nlattr *nl_freqs, *nl_freq;
 869         struct nlattr *nl_rates, *nl_rate;
 870         struct nlattr *nl_cmds;
 871         enum ieee80211_band band;
 872         struct ieee80211_channel *chan;
 873         struct ieee80211_rate *rate;
 874         int i;
 875         const struct ieee80211_txrx_stypes *mgmt_stypes =
 876                                 dev->wiphy.mgmt_stypes;
 877
 878         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
 879         if (!hdr)
 880                 return -1;
 881
 882         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
 883             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
 884             nla_put_u32(msg, NL80211_ATTR_GENERATION,
 885                         cfg80211_rdev_list_generation) ||
 886             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 887                        dev->wiphy.retry_short) ||
 888             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 889                        dev->wiphy.retry_long) ||
 890             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 891                         dev->wiphy.frag_threshold) ||
 892             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 893                         dev->wiphy.rts_threshold) ||
 894             nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 895                        dev->wiphy.coverage_class) ||
 896             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 897                        dev->wiphy.max_scan_ssids) ||
 898             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 899                        dev->wiphy.max_sched_scan_ssids) ||
 900             nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 901                         dev->wiphy.max_scan_ie_len) ||
 902             nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 903                         dev->wiphy.max_sched_scan_ie_len) ||
 904             nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 905                        dev->wiphy.max_match_sets))
 906                 goto nla_put_failure;
 907
 908         if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
 909             nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
 910                 goto nla_put_failure;
 911         if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
 912             nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
 913                 goto nla_put_failure;
 914         if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
 915             nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
 916                 goto nla_put_failure;
 917         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
 918             nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
 919                 goto nla_put_failure;
 920         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
 921             nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
 922                 goto nla_put_failure;
 923         if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
 924             nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
 925                 goto nla_put_failure;
 926
 927         if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
 928                     sizeof(u32) * dev->wiphy.n_cipher_suites,
 929                     dev->wiphy.cipher_suites))
 930                 goto nla_put_failure;
 931
 932         if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 933                        dev->wiphy.max_num_pmkids))
 934                 goto nla_put_failure;
 935
 936         if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
 937             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
 938                 goto nla_put_failure;
 939
 940         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 941                         dev->wiphy.available_antennas_tx) ||
 942             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 943                         dev->wiphy.available_antennas_rx))
 944                 goto nla_put_failure;
 945
 946         if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
 947             nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
 948                         dev->wiphy.probe_resp_offload))
 949                 goto nla_put_failure;
 950
 951         if ((dev->wiphy.available_antennas_tx ||
 952              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 953                 u32 tx_ant = 0, rx_ant = 0;
 954                 int res;
 955                 res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
 956                 if (!res) {
 957                         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
 958                                         tx_ant) ||
 959                             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
 960                                         rx_ant))
 961                                 goto nla_put_failure;
 962                 }
 963         }
 964
 965         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 966                                 dev->wiphy.interface_modes))
 967                 goto nla_put_failure;
 968
 969         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 970         if (!nl_bands)
 971                 goto nla_put_failure;
 972
 973         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 974                 if (!dev->wiphy.bands[band])
 975                         continue;
 976
 977                 nl_band = nla_nest_start(msg, band);
 978                 if (!nl_band)
 979                         goto nla_put_failure;
 980
 981                 /* add HT info */
 982                 if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
 983                     (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 984                              sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 985                              &dev->wiphy.bands[band]->ht_cap.mcs) ||
 986                      nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
 987                                  dev->wiphy.bands[band]->ht_cap.cap) ||
 988                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 989                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
 990                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 991                                 dev->wiphy.bands[band]->ht_cap.ampdu_density)))
 992                         goto nla_put_failure;
 993
 994                 /* add VHT info */
 995                 if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
 996                     (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
 997                              sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
 998                              &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
 999                      nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1000                                  dev->wiphy.bands[band]->vht_cap.cap)))
1001                         goto nla_put_failure;
1002
1003                 /* add frequencies */
1004                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
1005                 if (!nl_freqs)
1006                         goto nla_put_failure;
1007
1008                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
1009                         nl_freq = nla_nest_start(msg, i);
1010                         if (!nl_freq)
1011                                 goto nla_put_failure;
1012
1013                         chan = &dev->wiphy.bands[band]->channels[i];
1014
1015                         if (nl80211_msg_put_channel(msg, chan))
1016                                 goto nla_put_failure;
1017
1018                         nla_nest_end(msg, nl_freq);
1019                 }
1020
1021                 nla_nest_end(msg, nl_freqs);
1022
1023                 /* add bitrates */
1024                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1025                 if (!nl_rates)
1026                         goto nla_put_failure;
1027
1028                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
1029                         nl_rate = nla_nest_start(msg, i);
1030                         if (!nl_rate)
1031                                 goto nla_put_failure;
1032
1033                         rate = &dev->wiphy.bands[band]->bitrates[i];
1034                         if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1035                                         rate->bitrate))
1036                                 goto nla_put_failure;
1037                         if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1038                             nla_put_flag(msg,
1039                                          NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1040                                 goto nla_put_failure;
1041
1042                         nla_nest_end(msg, nl_rate);
1043                 }
1044
1045                 nla_nest_end(msg, nl_rates);
1046
1047                 nla_nest_end(msg, nl_band);
1048         }
1049         nla_nest_end(msg, nl_bands);
1050
1051         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1052         if (!nl_cmds)
1053                 goto nla_put_failure;
1054
1055         i = 0;
1056 #define CMD(op, n)                                              \
1057          do {                                                   \
1058                 if (dev->ops->op) {                             \
1059                         i++;                                    \
1060                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1061                                 goto nla_put_failure;           \
1062                 }                                               \
1063         } while (0)
1064
1065         CMD(add_virtual_intf, NEW_INTERFACE);
1066         CMD(change_virtual_intf, SET_INTERFACE);
1067         CMD(add_key, NEW_KEY);
1068         CMD(start_ap, START_AP);
1069         CMD(add_station, NEW_STATION);
1070         CMD(add_mpath, NEW_MPATH);
1071         CMD(update_mesh_config, SET_MESH_CONFIG);
1072         CMD(change_bss, SET_BSS);
1073         CMD(auth, AUTHENTICATE);
1074         CMD(assoc, ASSOCIATE);
1075         CMD(deauth, DEAUTHENTICATE);
1076         CMD(disassoc, DISASSOCIATE);
1077         CMD(join_ibss, JOIN_IBSS);
1078         CMD(join_mesh, JOIN_MESH);
1079         CMD(set_pmksa, SET_PMKSA);
1080         CMD(del_pmksa, DEL_PMKSA);
1081         CMD(flush_pmksa, FLUSH_PMKSA);
1082         if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1083                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1084         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1085         CMD(mgmt_tx, FRAME);
1086         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1087         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1088                 i++;
1089                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1090                         goto nla_put_failure;
1091         }
1092         if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1093             dev->ops->join_mesh) {
1094                 i++;
1095                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1096                         goto nla_put_failure;
1097         }
1098         CMD(set_wds_peer, SET_WDS_PEER);
1099         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1100                 CMD(tdls_mgmt, TDLS_MGMT);
1101                 CMD(tdls_oper, TDLS_OPER);
1102         }
1103         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1104                 CMD(sched_scan_start, START_SCHED_SCAN);
1105         CMD(probe_client, PROBE_CLIENT);
1106         CMD(set_noack_map, SET_NOACK_MAP);
1107         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1108                 i++;
1109                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1110                         goto nla_put_failure;
1111         }
1112         CMD(start_p2p_device, START_P2P_DEVICE);
1113         CMD(set_mcast_rate, SET_MCAST_RATE);
1114
1115 #ifdef CONFIG_NL80211_TESTMODE
1116         CMD(testmode_cmd, TESTMODE);
1117 #endif
1118
1119 #undef CMD
1120
1121         if (dev->ops->connect || dev->ops->auth) {
1122                 i++;
1123                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1124                         goto nla_put_failure;
1125         }
1126
1127         if (dev->ops->disconnect || dev->ops->deauth) {
1128                 i++;
1129                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1130                         goto nla_put_failure;
1131         }
1132
1133         nla_nest_end(msg, nl_cmds);
1134
1135         if (dev->ops->remain_on_channel &&
1136             (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1137             nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1138                         dev->wiphy.max_remain_on_channel_duration))
1139                 goto nla_put_failure;
1140
1141         if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1142             nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1143                 goto nla_put_failure;
1144
1145         if (mgmt_stypes) {
1146                 u16 stypes;
1147                 struct nlattr *nl_ftypes, *nl_ifs;
1148                 enum nl80211_iftype ift;
1149
1150                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1151                 if (!nl_ifs)
1152                         goto nla_put_failure;
1153
1154                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1155                         nl_ftypes = nla_nest_start(msg, ift);
1156                         if (!nl_ftypes)
1157                                 goto nla_put_failure;
1158                         i = 0;
1159                         stypes = mgmt_stypes[ift].tx;
1160                         while (stypes) {
1161                                 if ((stypes & 1) &&
1162                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1163                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1164                                         goto nla_put_failure;
1165                                 stypes >>= 1;
1166                                 i++;
1167                         }
1168                         nla_nest_end(msg, nl_ftypes);
1169                 }
1170
1171                 nla_nest_end(msg, nl_ifs);
1172
1173                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1174                 if (!nl_ifs)
1175                         goto nla_put_failure;
1176
1177                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1178                         nl_ftypes = nla_nest_start(msg, ift);
1179                         if (!nl_ftypes)
1180                                 goto nla_put_failure;
1181                         i = 0;
1182                         stypes = mgmt_stypes[ift].rx;
1183                         while (stypes) {
1184                                 if ((stypes & 1) &&
1185                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1186                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1187                                         goto nla_put_failure;
1188                                 stypes >>= 1;
1189                                 i++;
1190                         }
1191                         nla_nest_end(msg, nl_ftypes);
1192                 }
1193                 nla_nest_end(msg, nl_ifs);
1194         }
1195
1196 #ifdef CONFIG_PM
1197         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
1198                 struct nlattr *nl_wowlan;
1199
1200                 nl_wowlan = nla_nest_start(msg,
1201                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1202                 if (!nl_wowlan)
1203                         goto nla_put_failure;
1204
1205                 if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1206                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1207                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1208                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1209                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1210                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1211                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1212                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1213                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1214                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1215                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1216                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1217                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1218                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1219                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1220                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1221                     goto nla_put_failure;
1222                 if (dev->wiphy.wowlan.n_patterns) {
1223                         struct nl80211_wowlan_pattern_support pat = {
1224                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
1225                                 .min_pattern_len =
1226                                         dev->wiphy.wowlan.pattern_min_len,
1227                                 .max_pattern_len =
1228                                         dev->wiphy.wowlan.pattern_max_len,
1229                         };
1230                         if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1231                                     sizeof(pat), &pat))
1232                                 goto nla_put_failure;
1233                 }
1234
1235                 nla_nest_end(msg, nl_wowlan);
1236         }
1237 #endif
1238
1239         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1240                                 dev->wiphy.software_iftypes))
1241                 goto nla_put_failure;
1242
1243         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1244                 goto nla_put_failure;
1245
1246         if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1247             nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1248                         dev->wiphy.ap_sme_capa))
1249                 goto nla_put_failure;
1250
1251         if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
1252                         dev->wiphy.features))
1253                 goto nla_put_failure;
1254
1255         if (dev->wiphy.ht_capa_mod_mask &&
1256             nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1257                     sizeof(*dev->wiphy.ht_capa_mod_mask),
1258                     dev->wiphy.ht_capa_mod_mask))
1259                 goto nla_put_failure;
1260
1261         return genlmsg_end(msg, hdr);
1262
1263  nla_put_failure:
1264         genlmsg_cancel(msg, hdr);
1265         return -EMSGSIZE;
1266 }
1267
1268 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1269 {
1270         int idx = 0;
1271         int start = cb->args[0];
1272         struct cfg80211_registered_device *dev;
1273
1274         mutex_lock(&cfg80211_mutex);
1275         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1276                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1277                         continue;
1278                 if (++idx <= start)
1279                         continue;
1280                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).portid,
1281                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1282                                        dev) < 0) {
1283                         idx--;
1284                         break;
1285                 }
1286         }
1287         mutex_unlock(&cfg80211_mutex);
1288
1289         cb->args[0] = idx;
1290
1291         return skb->len;
1292 }
1293
1294 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1295 {
1296         struct sk_buff *msg;
1297         struct cfg80211_registered_device *dev = info->user_ptr[0];
1298
1299         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1300         if (!msg)
1301                 return -ENOMEM;
1302
1303         if (nl80211_send_wiphy(msg, info->snd_portid, info->snd_seq, 0, dev) < 0) {
1304                 nlmsg_free(msg);
1305                 return -ENOBUFS;
1306         }
1307
1308         return genlmsg_reply(msg, info);
1309 }
1310
1311 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1312         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1313         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1314         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1315         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1316         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1317 };
1318
1319 static int parse_txq_params(struct nlattr *tb[],
1320                             struct ieee80211_txq_params *txq_params)
1321 {
1322         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1323             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1324             !tb[NL80211_TXQ_ATTR_AIFS])
1325                 return -EINVAL;
1326
1327         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1328         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1329         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1330         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1331         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1332
1333         if (txq_params->ac >= NL80211_NUM_ACS)
1334                 return -EINVAL;
1335
1336         return 0;
1337 }
1338
1339 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1340 {
1341         /*
1342          * You can only set the channel explicitly for WDS interfaces,
1343          * all others have their channel managed via their respective
1344          * "establish a connection" command (connect, join, ...)
1345          *
1346          * For AP/GO and mesh mode, the channel can be set with the
1347          * channel userspace API, but is only stored and passed to the
1348          * low-level driver when the AP starts or the mesh is joined.
1349          * This is for backward compatibility, userspace can also give
1350          * the channel in the start-ap or join-mesh commands instead.
1351          *
1352          * Monitors are special as they are normally slaved to
1353          * whatever else is going on, so they have their own special
1354          * operation to set the monitor channel if possible.
1355          */
1356         return !wdev ||
1357                 wdev->iftype == NL80211_IFTYPE_AP ||
1358                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1359                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1360                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1361 }
1362
1363 static bool nl80211_valid_channel_type(struct genl_info *info,
1364                                        enum nl80211_channel_type *channel_type)
1365 {
1366         enum nl80211_channel_type tmp;
1367
1368         if (!info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1369                 return false;
1370
1371         tmp = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1372         if (tmp != NL80211_CHAN_NO_HT &&
1373             tmp != NL80211_CHAN_HT20 &&
1374             tmp != NL80211_CHAN_HT40PLUS &&
1375             tmp != NL80211_CHAN_HT40MINUS)
1376                 return false;
1377
1378         if (channel_type)
1379                 *channel_type = tmp;
1380
1381         return true;
1382 }
1383
1384 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1385                                  struct wireless_dev *wdev,
1386                                  struct genl_info *info)
1387 {
1388         struct ieee80211_channel *channel;
1389         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1390         u32 freq;
1391         int result;
1392         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1393
1394         if (wdev)
1395                 iftype = wdev->iftype;
1396
1397         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1398                 return -EINVAL;
1399
1400         if (!nl80211_can_set_dev_channel(wdev))
1401                 return -EOPNOTSUPP;
1402
1403         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
1404             !nl80211_valid_channel_type(info, &channel_type))
1405                 return -EINVAL;
1406
1407         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1408
1409         mutex_lock(&rdev->devlist_mtx);
1410         switch (iftype) {
1411         case NL80211_IFTYPE_AP:
1412         case NL80211_IFTYPE_P2P_GO:
1413                 if (wdev->beacon_interval) {
1414                         result = -EBUSY;
1415                         break;
1416                 }
1417                 channel = rdev_freq_to_chan(rdev, freq, channel_type);
1418                 if (!channel || !cfg80211_can_beacon_sec_chan(&rdev->wiphy,
1419                                                               channel,
1420                                                               channel_type)) {
1421                         result = -EINVAL;
1422                         break;
1423                 }
1424                 wdev->preset_chan = channel;
1425                 wdev->preset_chantype = channel_type;
1426                 result = 0;
1427                 break;
1428         case NL80211_IFTYPE_MESH_POINT:
1429                 result = cfg80211_set_mesh_freq(rdev, wdev, freq, channel_type);
1430                 break;
1431         case NL80211_IFTYPE_MONITOR:
1432                 result = cfg80211_set_monitor_channel(rdev, freq, channel_type);
1433                 break;
1434         default:
1435                 result = -EINVAL;
1436         }
1437         mutex_unlock(&rdev->devlist_mtx);
1438
1439         return result;
1440 }
1441
1442 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1443 {
1444         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1445         struct net_device *netdev = info->user_ptr[1];
1446
1447         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1448 }
1449
1450 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1451 {
1452         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1453         struct net_device *dev = info->user_ptr[1];
1454         struct wireless_dev *wdev = dev->ieee80211_ptr;
1455         const u8 *bssid;
1456
1457         if (!info->attrs[NL80211_ATTR_MAC])
1458                 return -EINVAL;
1459
1460         if (netif_running(dev))
1461                 return -EBUSY;
1462
1463         if (!rdev->ops->set_wds_peer)
1464                 return -EOPNOTSUPP;
1465
1466         if (wdev->iftype != NL80211_IFTYPE_WDS)
1467                 return -EOPNOTSUPP;
1468
1469         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1470         return rdev_set_wds_peer(rdev, dev, bssid);
1471 }
1472
1473
1474 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1475 {
1476         struct cfg80211_registered_device *rdev;
1477         struct net_device *netdev = NULL;
1478         struct wireless_dev *wdev;
1479         int result = 0, rem_txq_params = 0;
1480         struct nlattr *nl_txq_params;
1481         u32 changed;
1482         u8 retry_short = 0, retry_long = 0;
1483         u32 frag_threshold = 0, rts_threshold = 0;
1484         u8 coverage_class = 0;
1485
1486         /*
1487          * Try to find the wiphy and netdev. Normally this
1488          * function shouldn't need the netdev, but this is
1489          * done for backward compatibility -- previously
1490          * setting the channel was done per wiphy, but now
1491          * it is per netdev. Previous userland like hostapd
1492          * also passed a netdev to set_wiphy, so that it is
1493          * possible to let that go to the right netdev!
1494          */
1495         mutex_lock(&cfg80211_mutex);
1496
1497         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1498                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1499
1500                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1501                 if (netdev && netdev->ieee80211_ptr) {
1502                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1503                         mutex_lock(&rdev->mtx);
1504                 } else
1505                         netdev = NULL;
1506         }
1507
1508         if (!netdev) {
1509                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1510                                                   info->attrs);
1511                 if (IS_ERR(rdev)) {
1512                         mutex_unlock(&cfg80211_mutex);
1513                         return PTR_ERR(rdev);
1514                 }
1515                 wdev = NULL;
1516                 netdev = NULL;
1517                 result = 0;
1518
1519                 mutex_lock(&rdev->mtx);
1520         } else
1521                 wdev = netdev->ieee80211_ptr;
1522
1523         /*
1524          * end workaround code, by now the rdev is available
1525          * and locked, and wdev may or may not be NULL.
1526          */
1527
1528         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1529                 result = cfg80211_dev_rename(
1530                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1531
1532         mutex_unlock(&cfg80211_mutex);
1533
1534         if (result)
1535                 goto bad_res;
1536
1537         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1538                 struct ieee80211_txq_params txq_params;
1539                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1540
1541                 if (!rdev->ops->set_txq_params) {
1542                         result = -EOPNOTSUPP;
1543                         goto bad_res;
1544                 }
1545
1546                 if (!netdev) {
1547                         result = -EINVAL;
1548                         goto bad_res;
1549                 }
1550
1551                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1552                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1553                         result = -EINVAL;
1554                         goto bad_res;
1555                 }
1556
1557                 if (!netif_running(netdev)) {
1558                         result = -ENETDOWN;
1559                         goto bad_res;
1560                 }
1561
1562                 nla_for_each_nested(nl_txq_params,
1563                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1564                                     rem_txq_params) {
1565                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1566                                   nla_data(nl_txq_params),
1567                                   nla_len(nl_txq_params),
1568                                   txq_params_policy);
1569                         result = parse_txq_params(tb, &txq_params);
1570                         if (result)
1571                                 goto bad_res;
1572
1573                         result = rdev_set_txq_params(rdev, netdev,
1574                                                      &txq_params);
1575                         if (result)
1576                                 goto bad_res;
1577                 }
1578         }
1579
1580         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1581                 result = __nl80211_set_channel(rdev,
1582                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1583                                 info);
1584                 if (result)
1585                         goto bad_res;
1586         }
1587
1588         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1589                 struct wireless_dev *txp_wdev = wdev;
1590                 enum nl80211_tx_power_setting type;
1591                 int idx, mbm = 0;
1592
1593                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1594                         txp_wdev = NULL;
1595
1596                 if (!rdev->ops->set_tx_power) {
1597                         result = -EOPNOTSUPP;
1598                         goto bad_res;
1599                 }
1600
1601                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1602                 type = nla_get_u32(info->attrs[idx]);
1603
1604                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1605                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1606                         result = -EINVAL;
1607                         goto bad_res;
1608                 }
1609
1610                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1611                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1612                         mbm = nla_get_u32(info->attrs[idx]);
1613                 }
1614
1615                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1616                 if (result)
1617                         goto bad_res;
1618         }
1619
1620         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1621             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1622                 u32 tx_ant, rx_ant;
1623                 if ((!rdev->wiphy.available_antennas_tx &&
1624                      !rdev->wiphy.available_antennas_rx) ||
1625                     !rdev->ops->set_antenna) {
1626                         result = -EOPNOTSUPP;
1627                         goto bad_res;
1628                 }
1629
1630                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1631                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1632
1633                 /* reject antenna configurations which don't match the
1634                  * available antenna masks, except for the "all" mask */
1635                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1636                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1637                         result = -EINVAL;
1638                         goto bad_res;
1639                 }
1640
1641                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1642                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1643
1644                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
1645                 if (result)
1646                         goto bad_res;
1647         }
1648
1649         changed = 0;
1650
1651         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1652                 retry_short = nla_get_u8(
1653                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1654                 if (retry_short == 0) {
1655                         result = -EINVAL;
1656                         goto bad_res;
1657                 }
1658                 changed |= WIPHY_PARAM_RETRY_SHORT;
1659         }
1660
1661         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1662                 retry_long = nla_get_u8(
1663                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1664                 if (retry_long == 0) {
1665                         result = -EINVAL;
1666                         goto bad_res;
1667                 }
1668                 changed |= WIPHY_PARAM_RETRY_LONG;
1669         }
1670
1671         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1672                 frag_threshold = nla_get_u32(
1673                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1674                 if (frag_threshold < 256) {
1675                         result = -EINVAL;
1676                         goto bad_res;
1677                 }
1678                 if (frag_threshold != (u32) -1) {
1679                         /*
1680                          * Fragments (apart from the last one) are required to
1681                          * have even length. Make the fragmentation code
1682                          * simpler by stripping LSB should someone try to use
1683                          * odd threshold value.
1684                          */
1685                         frag_threshold &= ~0x1;
1686                 }
1687                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1688         }
1689
1690         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1691                 rts_threshold = nla_get_u32(
1692                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1693                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1694         }
1695
1696         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1697                 coverage_class = nla_get_u8(
1698                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1699                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1700         }
1701
1702         if (changed) {
1703                 u8 old_retry_short, old_retry_long;
1704                 u32 old_frag_threshold, old_rts_threshold;
1705                 u8 old_coverage_class;
1706
1707                 if (!rdev->ops->set_wiphy_params) {
1708                         result = -EOPNOTSUPP;
1709                         goto bad_res;
1710                 }
1711
1712                 old_retry_short = rdev->wiphy.retry_short;
1713                 old_retry_long = rdev->wiphy.retry_long;
1714                 old_frag_threshold = rdev->wiphy.frag_threshold;
1715                 old_rts_threshold = rdev->wiphy.rts_threshold;
1716                 old_coverage_class = rdev->wiphy.coverage_class;
1717
1718                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1719                         rdev->wiphy.retry_short = retry_short;
1720                 if (changed & WIPHY_PARAM_RETRY_LONG)
1721                         rdev->wiphy.retry_long = retry_long;
1722                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1723                         rdev->wiphy.frag_threshold = frag_threshold;
1724                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1725                         rdev->wiphy.rts_threshold = rts_threshold;
1726                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1727                         rdev->wiphy.coverage_class = coverage_class;
1728
1729                 result = rdev_set_wiphy_params(rdev, changed);
1730                 if (result) {
1731                         rdev->wiphy.retry_short = old_retry_short;
1732                         rdev->wiphy.retry_long = old_retry_long;
1733                         rdev->wiphy.frag_threshold = old_frag_threshold;
1734                         rdev->wiphy.rts_threshold = old_rts_threshold;
1735                         rdev->wiphy.coverage_class = old_coverage_class;
1736                 }
1737         }
1738
1739  bad_res:
1740         mutex_unlock(&rdev->mtx);
1741         if (netdev)
1742                 dev_put(netdev);
1743         return result;
1744 }
1745
1746 static inline u64 wdev_id(struct wireless_dev *wdev)
1747 {
1748         return (u64)wdev->identifier |
1749                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
1750 }
1751
1752 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
1753                               struct cfg80211_registered_device *rdev,
1754                               struct wireless_dev *wdev)
1755 {
1756         struct net_device *dev = wdev->netdev;
1757         void *hdr;
1758
1759         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1760         if (!hdr)
1761                 return -1;
1762
1763         if (dev &&
1764             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
1765              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
1766                 goto nla_put_failure;
1767
1768         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1769             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
1770             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
1771             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
1772             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1773                         rdev->devlist_generation ^
1774                         (cfg80211_rdev_list_generation << 2)))
1775                 goto nla_put_failure;
1776
1777         if (rdev->ops->get_channel) {
1778                 struct ieee80211_channel *chan;
1779                 enum nl80211_channel_type channel_type;
1780
1781                 chan = rdev_get_channel(rdev, wdev, &channel_type);
1782                 if (chan &&
1783                     (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
1784                                  chan->center_freq) ||
1785                      nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
1786                                  channel_type)))
1787                         goto nla_put_failure;
1788         }
1789
1790         if (wdev->ssid_len) {
1791                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
1792                         goto nla_put_failure;
1793         }
1794
1795         return genlmsg_end(msg, hdr);
1796
1797  nla_put_failure:
1798         genlmsg_cancel(msg, hdr);
1799         return -EMSGSIZE;
1800 }
1801
1802 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1803 {
1804         int wp_idx = 0;
1805         int if_idx = 0;
1806         int wp_start = cb->args[0];
1807         int if_start = cb->args[1];
1808         struct cfg80211_registered_device *rdev;
1809         struct wireless_dev *wdev;
1810
1811         mutex_lock(&cfg80211_mutex);
1812         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1813                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1814                         continue;
1815                 if (wp_idx < wp_start) {
1816                         wp_idx++;
1817                         continue;
1818                 }
1819                 if_idx = 0;
1820
1821                 mutex_lock(&rdev->devlist_mtx);
1822                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
1823                         if (if_idx < if_start) {
1824                                 if_idx++;
1825                                 continue;
1826                         }
1827                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
1828                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1829                                                rdev, wdev) < 0) {
1830                                 mutex_unlock(&rdev->devlist_mtx);
1831                                 goto out;
1832                         }
1833                         if_idx++;
1834                 }
1835                 mutex_unlock(&rdev->devlist_mtx);
1836
1837                 wp_idx++;
1838         }
1839  out:
1840         mutex_unlock(&cfg80211_mutex);
1841
1842         cb->args[0] = wp_idx;
1843         cb->args[1] = if_idx;
1844
1845         return skb->len;
1846 }
1847
1848 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1849 {
1850         struct sk_buff *msg;
1851         struct cfg80211_registered_device *dev = info->user_ptr[0];
1852         struct wireless_dev *wdev = info->user_ptr[1];
1853
1854         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1855         if (!msg)
1856                 return -ENOMEM;
1857
1858         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
1859                                dev, wdev) < 0) {
1860                 nlmsg_free(msg);
1861                 return -ENOBUFS;
1862         }
1863
1864         return genlmsg_reply(msg, info);
1865 }
1866
1867 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1868         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1869         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1870         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1871         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1872         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1873 };
1874
1875 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1876 {
1877         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1878         int flag;
1879
1880         *mntrflags = 0;
1881
1882         if (!nla)
1883                 return -EINVAL;
1884
1885         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1886                              nla, mntr_flags_policy))
1887                 return -EINVAL;
1888
1889         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1890                 if (flags[flag])
1891                         *mntrflags |= (1<<flag);
1892
1893         return 0;
1894 }
1895
1896 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1897                                struct net_device *netdev, u8 use_4addr,
1898                                enum nl80211_iftype iftype)
1899 {
1900         if (!use_4addr) {
1901                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1902                         return -EBUSY;
1903                 return 0;
1904         }
1905
1906         switch (iftype) {
1907         case NL80211_IFTYPE_AP_VLAN:
1908                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1909                         return 0;
1910                 break;
1911         case NL80211_IFTYPE_STATION:
1912                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1913                         return 0;
1914                 break;
1915         default:
1916                 break;
1917         }
1918
1919         return -EOPNOTSUPP;
1920 }
1921
1922 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1923 {
1924         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1925         struct vif_params params;
1926         int err;
1927         enum nl80211_iftype otype, ntype;
1928         struct net_device *dev = info->user_ptr[1];
1929         u32 _flags, *flags = NULL;
1930         bool change = false;
1931
1932         memset(&params, 0, sizeof(params));
1933
1934         otype = ntype = dev->ieee80211_ptr->iftype;
1935
1936         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1937                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1938                 if (otype != ntype)
1939                         change = true;
1940                 if (ntype > NL80211_IFTYPE_MAX)
1941                         return -EINVAL;
1942         }
1943
1944         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1945                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1946
1947                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1948                         return -EINVAL;
1949                 if (netif_running(dev))
1950                         return -EBUSY;
1951
1952                 wdev_lock(wdev);
1953                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1954                              IEEE80211_MAX_MESH_ID_LEN);
1955                 wdev->mesh_id_up_len =
1956                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1957                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1958                        wdev->mesh_id_up_len);
1959                 wdev_unlock(wdev);
1960         }
1961
1962         if (info->attrs[NL80211_ATTR_4ADDR]) {
1963                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1964                 change = true;
1965                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1966                 if (err)
1967                         return err;
1968         } else {
1969                 params.use_4addr = -1;
1970         }
1971
1972         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1973                 if (ntype != NL80211_IFTYPE_MONITOR)
1974                         return -EINVAL;
1975                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1976                                           &_flags);
1977                 if (err)
1978                         return err;
1979
1980                 flags = &_flags;
1981                 change = true;
1982         }
1983
1984         if (change)
1985                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1986         else
1987                 err = 0;
1988
1989         if (!err && params.use_4addr != -1)
1990                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1991
1992         return err;
1993 }
1994
1995 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1996 {
1997         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1998         struct vif_params params;
1999         struct wireless_dev *wdev;
2000         struct sk_buff *msg;
2001         int err;
2002         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2003         u32 flags;
2004
2005         memset(&params, 0, sizeof(params));
2006
2007         if (!info->attrs[NL80211_ATTR_IFNAME])
2008                 return -EINVAL;
2009
2010         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2011                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2012                 if (type > NL80211_IFTYPE_MAX)
2013                         return -EINVAL;
2014         }
2015
2016         if (!rdev->ops->add_virtual_intf ||
2017             !(rdev->wiphy.interface_modes & (1 << type)))
2018                 return -EOPNOTSUPP;
2019
2020         if (info->attrs[NL80211_ATTR_4ADDR]) {
2021                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2022                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2023                 if (err)
2024                         return err;
2025         }
2026
2027         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2028         if (!msg)
2029                 return -ENOMEM;
2030
2031         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2032                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2033                                   &flags);
2034         wdev = rdev_add_virtual_intf(rdev,
2035                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2036                                 type, err ? NULL : &flags, &params);
2037         if (IS_ERR(wdev)) {
2038                 nlmsg_free(msg);
2039                 return PTR_ERR(wdev);
2040         }
2041
2042         switch (type) {
2043         case NL80211_IFTYPE_MESH_POINT:
2044                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2045                         break;
2046                 wdev_lock(wdev);
2047                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2048                              IEEE80211_MAX_MESH_ID_LEN);
2049                 wdev->mesh_id_up_len =
2050                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2051                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2052                        wdev->mesh_id_up_len);
2053                 wdev_unlock(wdev);
2054                 break;
2055         case NL80211_IFTYPE_P2P_DEVICE:
2056                 /*
2057                  * P2P Device doesn't have a netdev, so doesn't go
2058                  * through the netdev notifier and must be added here
2059                  */
2060                 mutex_init(&wdev->mtx);
2061                 INIT_LIST_HEAD(&wdev->event_list);
2062                 spin_lock_init(&wdev->event_lock);
2063                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2064                 spin_lock_init(&wdev->mgmt_registrations_lock);
2065
2066                 mutex_lock(&rdev->devlist_mtx);
2067                 wdev->identifier = ++rdev->wdev_id;
2068                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2069                 rdev->devlist_generation++;
2070                 mutex_unlock(&rdev->devlist_mtx);
2071                 break;
2072         default:
2073                 break;
2074         }
2075
2076         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2077                                rdev, wdev) < 0) {
2078                 nlmsg_free(msg);
2079                 return -ENOBUFS;
2080         }
2081
2082         return genlmsg_reply(msg, info);
2083 }
2084
2085 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2086 {
2087         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2088         struct wireless_dev *wdev = info->user_ptr[1];
2089
2090         if (!rdev->ops->del_virtual_intf)
2091                 return -EOPNOTSUPP;
2092
2093         /*
2094          * If we remove a wireless device without a netdev then clear
2095          * user_ptr[1] so that nl80211_post_doit won't dereference it
2096          * to check if it needs to do dev_put(). Otherwise it crashes
2097          * since the wdev has been freed, unlike with a netdev where
2098          * we need the dev_put() for the netdev to really be freed.
2099          */
2100         if (!wdev->netdev)
2101                 info->user_ptr[1] = NULL;
2102
2103         return rdev_del_virtual_intf(rdev, wdev);
2104 }
2105
2106 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2107 {
2108         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2109         struct net_device *dev = info->user_ptr[1];
2110         u16 noack_map;
2111
2112         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2113                 return -EINVAL;
2114
2115         if (!rdev->ops->set_noack_map)
2116                 return -EOPNOTSUPP;
2117
2118         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2119
2120         return rdev_set_noack_map(rdev, dev, noack_map);
2121 }
2122
2123 struct get_key_cookie {
2124         struct sk_buff *msg;
2125         int error;
2126         int idx;
2127 };
2128
2129 static void get_key_callback(void *c, struct key_params *params)
2130 {
2131         struct nlattr *key;
2132         struct get_key_cookie *cookie = c;
2133
2134         if ((params->key &&
2135              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2136                      params->key_len, params->key)) ||
2137             (params->seq &&
2138              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2139                      params->seq_len, params->seq)) ||
2140             (params->cipher &&
2141              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2142                          params->cipher)))
2143                 goto nla_put_failure;
2144
2145         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2146         if (!key)
2147                 goto nla_put_failure;
2148
2149         if ((params->key &&
2150              nla_put(cookie->msg, NL80211_KEY_DATA,
2151                      params->key_len, params->key)) ||
2152             (params->seq &&
2153              nla_put(cookie->msg, NL80211_KEY_SEQ,
2154                      params->seq_len, params->seq)) ||
2155             (params->cipher &&
2156              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2157                          params->cipher)))
2158                 goto nla_put_failure;
2159
2160         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2161                 goto nla_put_failure;
2162
2163         nla_nest_end(cookie->msg, key);
2164
2165         return;
2166  nla_put_failure:
2167         cookie->error = 1;
2168 }
2169
2170 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2171 {
2172         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2173         int err;
2174         struct net_device *dev = info->user_ptr[1];
2175         u8 key_idx = 0;
2176         const u8 *mac_addr = NULL;
2177         bool pairwise;
2178         struct get_key_cookie cookie = {
2179                 .error = 0,
2180         };
2181         void *hdr;
2182         struct sk_buff *msg;
2183
2184         if (info->attrs[NL80211_ATTR_KEY_IDX])
2185                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2186
2187         if (key_idx > 5)
2188                 return -EINVAL;
2189
2190         if (info->attrs[NL80211_ATTR_MAC])
2191                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2192
2193         pairwise = !!mac_addr;
2194         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2195                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2196                 if (kt >= NUM_NL80211_KEYTYPES)
2197                         return -EINVAL;
2198                 if (kt != NL80211_KEYTYPE_GROUP &&
2199                     kt != NL80211_KEYTYPE_PAIRWISE)
2200                         return -EINVAL;
2201                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2202         }
2203
2204         if (!rdev->ops->get_key)
2205                 return -EOPNOTSUPP;
2206
2207         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2208         if (!msg)
2209                 return -ENOMEM;
2210
2211         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2212                              NL80211_CMD_NEW_KEY);
2213         if (IS_ERR(hdr))
2214                 return PTR_ERR(hdr);
2215
2216         cookie.msg = msg;
2217         cookie.idx = key_idx;
2218
2219         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2220             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2221                 goto nla_put_failure;
2222         if (mac_addr &&
2223             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2224                 goto nla_put_failure;
2225
2226         if (pairwise && mac_addr &&
2227             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2228                 return -ENOENT;
2229
2230         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2231                            get_key_callback);
2232
2233         if (err)
2234                 goto free_msg;
2235
2236         if (cookie.error)
2237                 goto nla_put_failure;
2238
2239         genlmsg_end(msg, hdr);
2240         return genlmsg_reply(msg, info);
2241
2242  nla_put_failure:
2243         err = -ENOBUFS;
2244  free_msg:
2245         nlmsg_free(msg);
2246         return err;
2247 }
2248
2249 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2250 {
2251         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2252         struct key_parse key;
2253         int err;
2254         struct net_device *dev = info->user_ptr[1];
2255
2256         err = nl80211_parse_key(info, &key);
2257         if (err)
2258                 return err;
2259
2260         if (key.idx < 0)
2261                 return -EINVAL;
2262
2263         /* only support setting default key */
2264         if (!key.def && !key.defmgmt)
2265                 return -EINVAL;
2266
2267         wdev_lock(dev->ieee80211_ptr);
2268
2269         if (key.def) {
2270                 if (!rdev->ops->set_default_key) {
2271                         err = -EOPNOTSUPP;
2272                         goto out;
2273                 }
2274
2275                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2276                 if (err)
2277                         goto out;
2278
2279                 err = rdev_set_default_key(rdev, dev, key.idx,
2280                                                  key.def_uni, key.def_multi);
2281
2282                 if (err)
2283                         goto out;
2284
2285 #ifdef CONFIG_CFG80211_WEXT
2286                 dev->ieee80211_ptr->wext.default_key = key.idx;
2287 #endif
2288         } else {
2289                 if (key.def_uni || !key.def_multi) {
2290                         err = -EINVAL;
2291                         goto out;
2292                 }
2293
2294                 if (!rdev->ops->set_default_mgmt_key) {
2295                         err = -EOPNOTSUPP;
2296                         goto out;
2297                 }
2298
2299                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2300                 if (err)
2301                         goto out;
2302
2303                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2304                 if (err)
2305                         goto out;
2306
2307 #ifdef CONFIG_CFG80211_WEXT
2308                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2309 #endif
2310         }
2311
2312  out:
2313         wdev_unlock(dev->ieee80211_ptr);
2314
2315         return err;
2316 }
2317
2318 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2319 {
2320         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2321         int err;
2322         struct net_device *dev = info->user_ptr[1];
2323         struct key_parse key;
2324         const u8 *mac_addr = NULL;
2325
2326         err = nl80211_parse_key(info, &key);
2327         if (err)
2328                 return err;
2329
2330         if (!key.p.key)
2331                 return -EINVAL;
2332
2333         if (info->attrs[NL80211_ATTR_MAC])
2334                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2335
2336         if (key.type == -1) {
2337                 if (mac_addr)
2338                         key.type = NL80211_KEYTYPE_PAIRWISE;
2339                 else
2340                         key.type = NL80211_KEYTYPE_GROUP;
2341         }
2342
2343         /* for now */
2344         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2345             key.type != NL80211_KEYTYPE_GROUP)
2346                 return -EINVAL;
2347
2348         if (!rdev->ops->add_key)
2349                 return -EOPNOTSUPP;
2350
2351         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2352                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2353                                            mac_addr))
2354                 return -EINVAL;
2355
2356         wdev_lock(dev->ieee80211_ptr);
2357         err = nl80211_key_allowed(dev->ieee80211_ptr);
2358         if (!err)
2359                 err = rdev_add_key(rdev, dev, key.idx,
2360                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2361                                     mac_addr, &key.p);
2362         wdev_unlock(dev->ieee80211_ptr);
2363
2364         return err;
2365 }
2366
2367 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2368 {
2369         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2370         int err;
2371         struct net_device *dev = info->user_ptr[1];
2372         u8 *mac_addr = NULL;
2373         struct key_parse key;
2374
2375         err = nl80211_parse_key(info, &key);
2376         if (err)
2377                 return err;
2378
2379         if (info->attrs[NL80211_ATTR_MAC])
2380                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2381
2382         if (key.type == -1) {
2383                 if (mac_addr)
2384                         key.type = NL80211_KEYTYPE_PAIRWISE;
2385                 else
2386                         key.type = NL80211_KEYTYPE_GROUP;
2387         }
2388
2389         /* for now */
2390         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2391             key.type != NL80211_KEYTYPE_GROUP)
2392                 return -EINVAL;
2393
2394         if (!rdev->ops->del_key)
2395                 return -EOPNOTSUPP;
2396
2397         wdev_lock(dev->ieee80211_ptr);
2398         err = nl80211_key_allowed(dev->ieee80211_ptr);
2399
2400         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2401             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2402                 err = -ENOENT;
2403
2404         if (!err)
2405                 err = rdev_del_key(rdev, dev, key.idx,
2406                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2407                                    mac_addr);
2408
2409 #ifdef CONFIG_CFG80211_WEXT
2410         if (!err) {
2411                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2412                         dev->ieee80211_ptr->wext.default_key = -1;
2413                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2414                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2415         }
2416 #endif
2417         wdev_unlock(dev->ieee80211_ptr);
2418
2419         return err;
2420 }
2421
2422 static int nl80211_parse_beacon(struct genl_info *info,
2423                                 struct cfg80211_beacon_data *bcn)
2424 {
2425         bool haveinfo = false;
2426
2427         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2428             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2429             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2430             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2431                 return -EINVAL;
2432
2433         memset(bcn, 0, sizeof(*bcn));
2434
2435         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2436                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2437                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2438                 if (!bcn->head_len)
2439                         return -EINVAL;
2440                 haveinfo = true;
2441         }
2442
2443         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2444                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2445                 bcn->tail_len =
2446                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2447                 haveinfo = true;
2448         }
2449
2450         if (!haveinfo)
2451                 return -EINVAL;
2452
2453         if (info->attrs[NL80211_ATTR_IE]) {
2454                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2455                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2456         }
2457
2458         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2459                 bcn->proberesp_ies =
2460                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2461                 bcn->proberesp_ies_len =
2462                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2463         }
2464
2465         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2466                 bcn->assocresp_ies =
2467                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2468                 bcn->assocresp_ies_len =
2469                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2470         }
2471
2472         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2473                 bcn->probe_resp =
2474                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2475                 bcn->probe_resp_len =
2476                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2477         }
2478
2479         return 0;
2480 }
2481
2482 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2483                                    struct cfg80211_ap_settings *params)
2484 {
2485         struct wireless_dev *wdev;
2486         bool ret = false;
2487
2488         mutex_lock(&rdev->devlist_mtx);
2489
2490         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2491                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2492                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2493                         continue;
2494
2495                 if (!wdev->preset_chan)
2496                         continue;
2497
2498                 params->channel = wdev->preset_chan;
2499                 params->channel_type = wdev->preset_chantype;
2500                 ret = true;
2501                 break;
2502         }
2503
2504         mutex_unlock(&rdev->devlist_mtx);
2505
2506         return ret;
2507 }
2508
2509 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
2510                                     enum nl80211_auth_type auth_type,
2511                                     enum nl80211_commands cmd)
2512 {
2513         if (auth_type > NL80211_AUTHTYPE_MAX)
2514                 return false;
2515
2516         switch (cmd) {
2517         case NL80211_CMD_AUTHENTICATE:
2518                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
2519                     auth_type == NL80211_AUTHTYPE_SAE)
2520                         return false;
2521                 return true;
2522         case NL80211_CMD_CONNECT:
2523         case NL80211_CMD_START_AP:
2524                 /* SAE not supported yet */
2525                 if (auth_type == NL80211_AUTHTYPE_SAE)
2526                         return false;
2527                 return true;
2528         default:
2529                 return false;
2530         }
2531 }
2532
2533 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2534 {
2535         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2536         struct net_device *dev = info->user_ptr[1];
2537         struct wireless_dev *wdev = dev->ieee80211_ptr;
2538         struct cfg80211_ap_settings params;
2539         int err;
2540
2541         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2542             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2543                 return -EOPNOTSUPP;
2544
2545         if (!rdev->ops->start_ap)
2546                 return -EOPNOTSUPP;
2547
2548         if (wdev->beacon_interval)
2549                 return -EALREADY;
2550
2551         memset(&params, 0, sizeof(params));
2552
2553         /* these are required for START_AP */
2554         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2555             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2556             !info->attrs[NL80211_ATTR_BEACON_HEAD])
2557                 return -EINVAL;
2558
2559         err = nl80211_parse_beacon(info, &params.beacon);
2560         if (err)
2561                 return err;
2562
2563         params.beacon_interval =
2564                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2565         params.dtim_period =
2566                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2567
2568         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
2569         if (err)
2570                 return err;
2571
2572         /*
2573          * In theory, some of these attributes should be required here
2574          * but since they were not used when the command was originally
2575          * added, keep them optional for old user space programs to let
2576          * them continue to work with drivers that do not need the
2577          * additional information -- drivers must check!
2578          */
2579         if (info->attrs[NL80211_ATTR_SSID]) {
2580                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2581                 params.ssid_len =
2582                         nla_len(info->attrs[NL80211_ATTR_SSID]);
2583                 if (params.ssid_len == 0 ||
2584                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
2585                         return -EINVAL;
2586         }
2587
2588         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2589                 params.hidden_ssid = nla_get_u32(
2590                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2591                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
2592                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
2593                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2594                         return -EINVAL;
2595         }
2596
2597         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2598
2599         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2600                 params.auth_type = nla_get_u32(
2601                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
2602                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
2603                                              NL80211_CMD_START_AP))
2604                         return -EINVAL;
2605         } else
2606                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2607
2608         err = nl80211_crypto_settings(rdev, info, &params.crypto,
2609                                       NL80211_MAX_NR_CIPHER_SUITES);
2610         if (err)
2611                 return err;
2612
2613         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
2614                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
2615                         return -EOPNOTSUPP;
2616                 params.inactivity_timeout = nla_get_u16(
2617                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
2618         }
2619
2620         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2621                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
2622
2623                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
2624                     !nl80211_valid_channel_type(info, &channel_type))
2625                         return -EINVAL;
2626
2627                 params.channel = rdev_freq_to_chan(rdev,
2628                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
2629                         channel_type);
2630                 if (!params.channel)
2631                         return -EINVAL;
2632                 params.channel_type = channel_type;
2633         } else if (wdev->preset_chan) {
2634                 params.channel = wdev->preset_chan;
2635                 params.channel_type = wdev->preset_chantype;
2636         } else if (!nl80211_get_ap_channel(rdev, &params))
2637                 return -EINVAL;
2638
2639         if (!cfg80211_can_beacon_sec_chan(&rdev->wiphy, params.channel,
2640                                           params.channel_type))
2641                 return -EINVAL;
2642
2643         mutex_lock(&rdev->devlist_mtx);
2644         err = cfg80211_can_use_chan(rdev, wdev, params.channel,
2645                                     CHAN_MODE_SHARED);
2646         mutex_unlock(&rdev->devlist_mtx);
2647
2648         if (err)
2649                 return err;
2650
2651         err = rdev_start_ap(rdev, dev, &params);
2652         if (!err) {
2653                 wdev->preset_chan = params.channel;
2654                 wdev->preset_chantype = params.channel_type;
2655                 wdev->beacon_interval = params.beacon_interval;
2656                 wdev->channel = params.channel;
2657                 wdev->ssid_len = params.ssid_len;
2658                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
2659         }
2660         return err;
2661 }
2662
2663 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
2664 {
2665         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2666         struct net_device *dev = info->user_ptr[1];
2667         struct wireless_dev *wdev = dev->ieee80211_ptr;
2668         struct cfg80211_beacon_data params;
2669         int err;
2670
2671         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2672             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2673                 return -EOPNOTSUPP;
2674
2675         if (!rdev->ops->change_beacon)
2676                 return -EOPNOTSUPP;
2677
2678         if (!wdev->beacon_interval)
2679                 return -EINVAL;
2680
2681         err = nl80211_parse_beacon(info, &params);
2682         if (err)
2683                 return err;
2684
2685         return rdev_change_beacon(rdev, dev, &params);
2686 }
2687
2688 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
2689 {
2690         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2691         struct net_device *dev = info->user_ptr[1];
2692
2693         return cfg80211_stop_ap(rdev, dev);
2694 }
2695
2696 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2697         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2698         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2699         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2700         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2701         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2702         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2703 };
2704
2705 static int parse_station_flags(struct genl_info *info,
2706                                enum nl80211_iftype iftype,
2707                                struct station_parameters *params)
2708 {
2709         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2710         struct nlattr *nla;
2711         int flag;
2712
2713         /*
2714          * Try parsing the new attribute first so userspace
2715          * can specify both for older kernels.
2716          */
2717         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2718         if (nla) {
2719                 struct nl80211_sta_flag_update *sta_flags;
2720
2721                 sta_flags = nla_data(nla);
2722                 params->sta_flags_mask = sta_flags->mask;
2723                 params->sta_flags_set = sta_flags->set;
2724                 if ((params->sta_flags_mask |
2725                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2726                         return -EINVAL;
2727                 return 0;
2728         }
2729
2730         /* if present, parse the old attribute */
2731
2732         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2733         if (!nla)
2734                 return 0;
2735
2736         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2737                              nla, sta_flags_policy))
2738                 return -EINVAL;
2739
2740         /*
2741          * Only allow certain flags for interface types so that
2742          * other attributes are silently ignored. Remember that
2743          * this is backward compatibility code with old userspace
2744          * and shouldn't be hit in other cases anyway.
2745          */
2746         switch (iftype) {
2747         case NL80211_IFTYPE_AP:
2748         case NL80211_IFTYPE_AP_VLAN:
2749         case NL80211_IFTYPE_P2P_GO:
2750                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2751                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2752                                          BIT(NL80211_STA_FLAG_WME) |
2753                                          BIT(NL80211_STA_FLAG_MFP);
2754                 break;
2755         case NL80211_IFTYPE_P2P_CLIENT:
2756         case NL80211_IFTYPE_STATION:
2757                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2758                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
2759                 break;
2760         case NL80211_IFTYPE_MESH_POINT:
2761                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2762                                          BIT(NL80211_STA_FLAG_MFP) |
2763                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
2764         default:
2765                 return -EINVAL;
2766         }
2767
2768         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
2769                 if (flags[flag]) {
2770                         params->sta_flags_set |= (1<<flag);
2771
2772                         /* no longer support new API additions in old API */
2773                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
2774                                 return -EINVAL;
2775                 }
2776         }
2777
2778         return 0;
2779 }
2780
2781 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2782                                  int attr)
2783 {
2784         struct nlattr *rate;
2785         u32 bitrate;
2786         u16 bitrate_compat;
2787
2788         rate = nla_nest_start(msg, attr);
2789         if (!rate)
2790                 goto nla_put_failure;
2791
2792         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2793         bitrate = cfg80211_calculate_bitrate(info);
2794         /* report 16-bit bitrate only if we can */
2795         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
2796         if ((bitrate > 0 &&
2797              nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) ||
2798             (bitrate_compat > 0 &&
2799              nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) ||
2800             ((info->flags & RATE_INFO_FLAGS_MCS) &&
2801              nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) ||
2802             ((info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) &&
2803              nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH)) ||
2804             ((info->flags & RATE_INFO_FLAGS_SHORT_GI) &&
2805              nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)))
2806                 goto nla_put_failure;
2807
2808         nla_nest_end(msg, rate);
2809         return true;
2810
2811 nla_put_failure:
2812         return false;
2813 }
2814
2815 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
2816                                 int flags,
2817                                 struct cfg80211_registered_device *rdev,
2818                                 struct net_device *dev,
2819                                 const u8 *mac_addr, struct station_info *sinfo)
2820 {
2821         void *hdr;
2822         struct nlattr *sinfoattr, *bss_param;
2823
2824         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
2825         if (!hdr)
2826                 return -1;
2827
2828         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2829             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
2830             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
2831                 goto nla_put_failure;
2832
2833         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2834         if (!sinfoattr)
2835                 goto nla_put_failure;
2836         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
2837             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2838                         sinfo->connected_time))
2839                 goto nla_put_failure;
2840         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
2841             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2842                         sinfo->inactive_time))
2843                 goto nla_put_failure;
2844         if ((sinfo->filled & STATION_INFO_RX_BYTES) &&
2845             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
2846                         sinfo->rx_bytes))
2847                 goto nla_put_failure;
2848         if ((sinfo->filled & STATION_INFO_TX_BYTES) &&
2849             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
2850                         sinfo->tx_bytes))
2851                 goto nla_put_failure;
2852         if ((sinfo->filled & STATION_INFO_LLID) &&
2853             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
2854                 goto nla_put_failure;
2855         if ((sinfo->filled & STATION_INFO_PLID) &&
2856             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
2857                 goto nla_put_failure;
2858         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
2859             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
2860                        sinfo->plink_state))
2861                 goto nla_put_failure;
2862         switch (rdev->wiphy.signal_type) {
2863         case CFG80211_SIGNAL_TYPE_MBM:
2864                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
2865                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
2866                                sinfo->signal))
2867                         goto nla_put_failure;
2868                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
2869                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2870                                sinfo->signal_avg))
2871                         goto nla_put_failure;
2872                 break;
2873         default:
2874                 break;
2875         }
2876         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2877                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2878                                           NL80211_STA_INFO_TX_BITRATE))
2879                         goto nla_put_failure;
2880         }
2881         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2882                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2883                                           NL80211_STA_INFO_RX_BITRATE))
2884                         goto nla_put_failure;
2885         }
2886         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
2887             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
2888                         sinfo->rx_packets))
2889                 goto nla_put_failure;
2890         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
2891             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
2892                         sinfo->tx_packets))
2893                 goto nla_put_failure;
2894         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
2895             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
2896                         sinfo->tx_retries))
2897                 goto nla_put_failure;
2898         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
2899             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
2900                         sinfo->tx_failed))
2901                 goto nla_put_failure;
2902         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
2903             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
2904                         sinfo->beacon_loss_count))
2905                 goto nla_put_failure;
2906         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2907                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2908                 if (!bss_param)
2909                         goto nla_put_failure;
2910
2911                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
2912                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
2913                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
2914                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
2915                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
2916                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
2917                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2918                                sinfo->bss_param.dtim_period) ||
2919                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2920                                 sinfo->bss_param.beacon_interval))
2921                         goto nla_put_failure;
2922
2923                 nla_nest_end(msg, bss_param);
2924         }
2925         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
2926             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
2927                     sizeof(struct nl80211_sta_flag_update),
2928                     &sinfo->sta_flags))
2929                 goto nla_put_failure;
2930         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
2931                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
2932                             sinfo->t_offset))
2933                 goto nla_put_failure;
2934         nla_nest_end(msg, sinfoattr);
2935
2936         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
2937             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2938                     sinfo->assoc_req_ies))
2939                 goto nla_put_failure;
2940
2941         return genlmsg_end(msg, hdr);
2942
2943  nla_put_failure:
2944         genlmsg_cancel(msg, hdr);
2945         return -EMSGSIZE;
2946 }
2947
2948 static int nl80211_dump_station(struct sk_buff *skb,
2949                                 struct netlink_callback *cb)
2950 {
2951         struct station_info sinfo;
2952         struct cfg80211_registered_device *dev;
2953         struct net_device *netdev;
2954         u8 mac_addr[ETH_ALEN];
2955         int sta_idx = cb->args[1];
2956         int err;
2957
2958         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2959         if (err)
2960                 return err;
2961
2962         if (!dev->ops->dump_station) {
2963                 err = -EOPNOTSUPP;
2964                 goto out_err;
2965         }
2966
2967         while (1) {
2968                 memset(&sinfo, 0, sizeof(sinfo));
2969                 err = rdev_dump_station(dev, netdev, sta_idx,
2970                                         mac_addr, &sinfo);
2971                 if (err == -ENOENT)
2972                         break;
2973                 if (err)
2974                         goto out_err;
2975
2976                 if (nl80211_send_station(skb,
2977                                 NETLINK_CB(cb->skb).portid,
2978                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2979                                 dev, netdev, mac_addr,
2980                                 &sinfo) < 0)
2981                         goto out;
2982
2983                 sta_idx++;
2984         }
2985
2986
2987  out:
2988         cb->args[1] = sta_idx;
2989         err = skb->len;
2990  out_err:
2991         nl80211_finish_netdev_dump(dev);
2992
2993         return err;
2994 }
2995
2996 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2997 {
2998         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2999         struct net_device *dev = info->user_ptr[1];
3000         struct station_info sinfo;
3001         struct sk_buff *msg;
3002         u8 *mac_addr = NULL;
3003         int err;
3004
3005         memset(&sinfo, 0, sizeof(sinfo));
3006
3007         if (!info->attrs[NL80211_ATTR_MAC])
3008                 return -EINVAL;
3009
3010         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3011
3012         if (!rdev->ops->get_station)
3013                 return -EOPNOTSUPP;
3014
3015         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3016         if (err)
3017                 return err;
3018
3019         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3020         if (!msg)
3021                 return -ENOMEM;
3022
3023         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3024                                  rdev, dev, mac_addr, &sinfo) < 0) {
3025                 nlmsg_free(msg);
3026                 return -ENOBUFS;
3027         }
3028
3029         return genlmsg_reply(msg, info);
3030 }
3031
3032 /*
3033  * Get vlan interface making sure it is running and on the right wiphy.
3034  */
3035 static struct net_device *get_vlan(struct genl_info *info,
3036                                    struct cfg80211_registered_device *rdev)
3037 {
3038         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3039         struct net_device *v;
3040         int ret;
3041
3042         if (!vlanattr)
3043                 return NULL;
3044
3045         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3046         if (!v)
3047                 return ERR_PTR(-ENODEV);
3048
3049         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3050                 ret = -EINVAL;
3051                 goto error;
3052         }
3053
3054         if (!netif_running(v)) {
3055                 ret = -ENETDOWN;
3056                 goto error;
3057         }
3058
3059         return v;
3060  error:
3061         dev_put(v);
3062         return ERR_PTR(ret);
3063 }
3064
3065 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3066 {
3067         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3068         int err;
3069         struct net_device *dev = info->user_ptr[1];
3070         struct station_parameters params;
3071         u8 *mac_addr = NULL;
3072
3073         memset(&params, 0, sizeof(params));
3074
3075         params.listen_interval = -1;
3076         params.plink_state = -1;
3077
3078         if (info->attrs[NL80211_ATTR_STA_AID])
3079                 return -EINVAL;
3080
3081         if (!info->attrs[NL80211_ATTR_MAC])
3082                 return -EINVAL;
3083
3084         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3085
3086         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3087                 params.supported_rates =
3088                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3089                 params.supported_rates_len =
3090                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3091         }
3092
3093         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3094                 params.listen_interval =
3095                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3096
3097         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3098                 params.ht_capa =
3099                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3100
3101         if (!rdev->ops->change_station)
3102                 return -EOPNOTSUPP;
3103
3104         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3105                 return -EINVAL;
3106
3107         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3108                 params.plink_action =
3109                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3110
3111         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
3112                 params.plink_state =
3113                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3114
3115         switch (dev->ieee80211_ptr->iftype) {
3116         case NL80211_IFTYPE_AP:
3117         case NL80211_IFTYPE_AP_VLAN:
3118         case NL80211_IFTYPE_P2P_GO:
3119                 /* disallow mesh-specific things */
3120                 if (params.plink_action)
3121                         return -EINVAL;
3122
3123                 /* TDLS can't be set, ... */
3124                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3125                         return -EINVAL;
3126                 /*
3127                  * ... but don't bother the driver with it. This works around
3128                  * a hostapd/wpa_supplicant issue -- it always includes the
3129                  * TLDS_PEER flag in the mask even for AP mode.
3130                  */
3131                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3132
3133                 /* accept only the listed bits */
3134                 if (params.sta_flags_mask &
3135                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3136                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3137                                   BIT(NL80211_STA_FLAG_WME) |
3138                                   BIT(NL80211_STA_FLAG_MFP)))
3139                         return -EINVAL;
3140
3141                 /* must be last in here for error handling */
3142                 params.vlan = get_vlan(info, rdev);
3143                 if (IS_ERR(params.vlan))
3144                         return PTR_ERR(params.vlan);
3145                 break;
3146         case NL80211_IFTYPE_P2P_CLIENT:
3147         case NL80211_IFTYPE_STATION:
3148                 /*
3149                  * Don't allow userspace to change the TDLS_PEER flag,
3150                  * but silently ignore attempts to change it since we
3151                  * don't have state here to verify that it doesn't try
3152                  * to change the flag.
3153                  */
3154                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3155                 /* fall through */
3156         case NL80211_IFTYPE_ADHOC:
3157                 /* disallow things sta doesn't support */
3158                 if (params.plink_action)
3159                         return -EINVAL;
3160                 if (params.ht_capa)
3161                         return -EINVAL;
3162                 if (params.listen_interval >= 0)
3163                         return -EINVAL;
3164                 /* reject any changes other than AUTHORIZED */
3165                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3166                         return -EINVAL;
3167                 break;
3168         case NL80211_IFTYPE_MESH_POINT:
3169                 /* disallow things mesh doesn't support */
3170                 if (params.vlan)
3171                         return -EINVAL;
3172                 if (params.ht_capa)
3173                         return -EINVAL;
3174                 if (params.listen_interval >= 0)
3175                         return -EINVAL;
3176                 /*
3177                  * No special handling for TDLS here -- the userspace
3178                  * mesh code doesn't have this bug.
3179                  */
3180                 if (params.sta_flags_mask &
3181                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3182                                   BIT(NL80211_STA_FLAG_MFP) |
3183                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3184                         return -EINVAL;
3185                 break;
3186         default:
3187                 return -EOPNOTSUPP;
3188         }
3189
3190         /* be aware of params.vlan when changing code here */
3191
3192         err = rdev_change_station(rdev, dev, mac_addr, &params);
3193
3194         if (params.vlan)
3195                 dev_put(params.vlan);
3196
3197         return err;
3198 }
3199
3200 static struct nla_policy
3201 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3202         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3203         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3204 };
3205
3206 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3207 {
3208         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3209         int err;
3210         struct net_device *dev = info->user_ptr[1];
3211         struct station_parameters params;
3212         u8 *mac_addr = NULL;
3213
3214         memset(&params, 0, sizeof(params));
3215
3216         if (!info->attrs[NL80211_ATTR_MAC])
3217                 return -EINVAL;
3218
3219         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3220                 return -EINVAL;
3221
3222         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3223                 return -EINVAL;
3224
3225         if (!info->attrs[NL80211_ATTR_STA_AID])
3226                 return -EINVAL;
3227
3228         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3229         params.supported_rates =
3230                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3231         params.supported_rates_len =
3232                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3233         params.listen_interval =
3234                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3235
3236         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3237         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3238                 return -EINVAL;
3239
3240         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3241                 params.ht_capa =
3242                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3243
3244         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3245                 params.vht_capa =
3246                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3247
3248         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3249                 params.plink_action =
3250                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3251
3252         if (!rdev->ops->add_station)
3253                 return -EOPNOTSUPP;
3254
3255         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3256                 return -EINVAL;
3257
3258         switch (dev->ieee80211_ptr->iftype) {
3259         case NL80211_IFTYPE_AP:
3260         case NL80211_IFTYPE_AP_VLAN:
3261         case NL80211_IFTYPE_P2P_GO:
3262                 /* parse WME attributes if sta is WME capable */
3263                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
3264                     (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
3265                     info->attrs[NL80211_ATTR_STA_WME]) {
3266                         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3267                         struct nlattr *nla;
3268
3269                         nla = info->attrs[NL80211_ATTR_STA_WME];
3270                         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3271                                                nl80211_sta_wme_policy);
3272                         if (err)
3273                                 return err;
3274
3275                         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3276                                 params.uapsd_queues =
3277                                      nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
3278                         if (params.uapsd_queues &
3279                                         ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3280                                 return -EINVAL;
3281
3282                         if (tb[NL80211_STA_WME_MAX_SP])
3283                                 params.max_sp =
3284                                      nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3285
3286                         if (params.max_sp &
3287                                         ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3288                                 return -EINVAL;
3289
3290                         params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3291                 }
3292                 /* TDLS peers cannot be added */
3293                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3294                         return -EINVAL;
3295                 /* but don't bother the driver with it */
3296                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3297
3298                 /* must be last in here for error handling */
3299                 params.vlan = get_vlan(info, rdev);
3300                 if (IS_ERR(params.vlan))
3301                         return PTR_ERR(params.vlan);
3302                 break;
3303         case NL80211_IFTYPE_MESH_POINT:
3304                 /* TDLS peers cannot be added */
3305                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3306                         return -EINVAL;
3307                 break;
3308         case NL80211_IFTYPE_STATION:
3309                 /* Only TDLS peers can be added */
3310                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3311                         return -EINVAL;
3312                 /* Can only add if TDLS ... */
3313                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
3314                         return -EOPNOTSUPP;
3315                 /* ... with external setup is supported */
3316                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
3317                         return -EOPNOTSUPP;
3318                 break;
3319         default:
3320                 return -EOPNOTSUPP;
3321         }
3322
3323         /* be aware of params.vlan when changing code here */
3324
3325         err = rdev_add_station(rdev, dev, mac_addr, &params);
3326
3327         if (params.vlan)
3328                 dev_put(params.vlan);
3329         return err;
3330 }
3331
3332 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
3333 {
3334         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3335         struct net_device *dev = info->user_ptr[1];
3336         u8 *mac_addr = NULL;
3337
3338         if (info->attrs[NL80211_ATTR_MAC])
3339                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3340
3341         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3342             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3343             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
3344             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3345                 return -EINVAL;
3346
3347         if (!rdev->ops->del_station)
3348                 return -EOPNOTSUPP;
3349
3350         return rdev_del_station(rdev, dev, mac_addr);
3351 }
3352
3353 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
3354                                 int flags, struct net_device *dev,
3355                                 u8 *dst, u8 *next_hop,
3356                                 struct mpath_info *pinfo)
3357 {
3358         void *hdr;
3359         struct nlattr *pinfoattr;
3360
3361         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3362         if (!hdr)
3363                 return -1;
3364
3365         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3366             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
3367             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
3368             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
3369                 goto nla_put_failure;
3370
3371         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
3372         if (!pinfoattr)
3373                 goto nla_put_failure;
3374         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
3375             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
3376                         pinfo->frame_qlen))
3377                 goto nla_put_failure;
3378         if (((pinfo->filled & MPATH_INFO_SN) &&
3379              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
3380             ((pinfo->filled & MPATH_INFO_METRIC) &&
3381              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
3382                          pinfo->metric)) ||
3383             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
3384              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
3385                          pinfo->exptime)) ||
3386             ((pinfo->filled & MPATH_INFO_FLAGS) &&
3387              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
3388                         pinfo->flags)) ||
3389             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
3390              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
3391                          pinfo->discovery_timeout)) ||
3392             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
3393              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
3394                         pinfo->discovery_retries)))
3395                 goto nla_put_failure;
3396
3397         nla_nest_end(msg, pinfoattr);
3398
3399         return genlmsg_end(msg, hdr);
3400
3401  nla_put_failure:
3402         genlmsg_cancel(msg, hdr);
3403         return -EMSGSIZE;
3404 }
3405
3406 static int nl80211_dump_mpath(struct sk_buff *skb,
3407                               struct netlink_callback *cb)
3408 {
3409         struct mpath_info pinfo;
3410         struct cfg80211_registered_device *dev;
3411         struct net_device *netdev;
3412         u8 dst[ETH_ALEN];
3413         u8 next_hop[ETH_ALEN];
3414         int path_idx = cb->args[1];
3415         int err;
3416
3417         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3418         if (err)
3419                 return err;
3420
3421         if (!dev->ops->dump_mpath) {
3422                 err = -EOPNOTSUPP;
3423                 goto out_err;
3424         }
3425
3426         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
3427                 err = -EOPNOTSUPP;
3428                 goto out_err;
3429         }
3430
3431         while (1) {
3432                 err = rdev_dump_mpath(dev, netdev, path_idx, dst, next_hop,
3433                                       &pinfo);
3434                 if (err == -ENOENT)
3435                         break;
3436                 if (err)
3437                         goto out_err;
3438
3439                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
3440                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
3441                                        netdev, dst, next_hop,
3442                                        &pinfo) < 0)
3443                         goto out;
3444
3445                 path_idx++;
3446         }
3447
3448
3449  out:
3450         cb->args[1] = path_idx;
3451         err = skb->len;
3452  out_err:
3453         nl80211_finish_netdev_dump(dev);
3454         return err;
3455 }
3456
3457 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
3458 {
3459         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3460         int err;
3461         struct net_device *dev = info->user_ptr[1];
3462         struct mpath_info pinfo;
3463         struct sk_buff *msg;
3464         u8 *dst = NULL;
3465         u8 next_hop[ETH_ALEN];
3466
3467         memset(&pinfo, 0, sizeof(pinfo));
3468
3469         if (!info->attrs[NL80211_ATTR_MAC])
3470                 return -EINVAL;
3471
3472         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3473
3474         if (!rdev->ops->get_mpath)
3475                 return -EOPNOTSUPP;
3476
3477         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3478                 return -EOPNOTSUPP;
3479
3480         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
3481         if (err)
3482                 return err;
3483
3484         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3485         if (!msg)
3486                 return -ENOMEM;
3487
3488         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
3489                                  dev, dst, next_hop, &pinfo) < 0) {
3490                 nlmsg_free(msg);
3491                 return -ENOBUFS;
3492         }
3493
3494         return genlmsg_reply(msg, info);
3495 }
3496
3497 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
3498 {
3499         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3500         struct net_device *dev = info->user_ptr[1];
3501         u8 *dst = NULL;
3502         u8 *next_hop = NULL;
3503
3504         if (!info->attrs[NL80211_ATTR_MAC])
3505                 return -EINVAL;
3506
3507         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3508                 return -EINVAL;
3509
3510         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3511         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3512
3513         if (!rdev->ops->change_mpath)
3514                 return -EOPNOTSUPP;
3515
3516         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3517                 return -EOPNOTSUPP;
3518
3519         return rdev_change_mpath(rdev, dev, dst, next_hop);
3520 }
3521
3522 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3523 {
3524         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3525         struct net_device *dev = info->user_ptr[1];
3526         u8 *dst = NULL;
3527         u8 *next_hop = NULL;
3528
3529         if (!info->attrs[NL80211_ATTR_MAC])
3530                 return -EINVAL;
3531
3532         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3533                 return -EINVAL;
3534
3535         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3536         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3537
3538         if (!rdev->ops->add_mpath)
3539                 return -EOPNOTSUPP;
3540
3541         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3542                 return -EOPNOTSUPP;
3543
3544         return rdev_add_mpath(rdev, dev, dst, next_hop);
3545 }
3546
3547 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
3548 {
3549         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3550         struct net_device *dev = info->user_ptr[1];
3551         u8 *dst = NULL;
3552
3553         if (info->attrs[NL80211_ATTR_MAC])
3554                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3555
3556         if (!rdev->ops->del_mpath)
3557                 return -EOPNOTSUPP;
3558
3559         return rdev_del_mpath(rdev, dev, dst);
3560 }
3561
3562 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
3563 {
3564         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3565         struct net_device *dev = info->user_ptr[1];
3566         struct bss_parameters params;
3567
3568         memset(&params, 0, sizeof(params));
3569         /* default to not changing parameters */
3570         params.use_cts_prot = -1;
3571         params.use_short_preamble = -1;
3572         params.use_short_slot_time = -1;
3573         params.ap_isolate = -1;
3574         params.ht_opmode = -1;
3575
3576         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
3577                 params.use_cts_prot =
3578                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
3579         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
3580                 params.use_short_preamble =
3581                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
3582         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
3583                 params.use_short_slot_time =
3584                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
3585         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3586                 params.basic_rates =
3587                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3588                 params.basic_rates_len =
3589                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3590         }
3591         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
3592                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
3593         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
3594                 params.ht_opmode =
3595                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
3596
3597         if (!rdev->ops->change_bss)
3598                 return -EOPNOTSUPP;
3599
3600         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3601             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3602                 return -EOPNOTSUPP;
3603
3604         return rdev_change_bss(rdev, dev, &params);
3605 }
3606
3607 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
3608         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
3609         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
3610         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
3611         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
3612         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
3613         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
3614 };
3615
3616 static int parse_reg_rule(struct nlattr *tb[],
3617         struct ieee80211_reg_rule *reg_rule)
3618 {
3619         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
3620         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
3621
3622         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
3623                 return -EINVAL;
3624         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
3625                 return -EINVAL;
3626         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
3627                 return -EINVAL;
3628         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
3629                 return -EINVAL;
3630         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
3631                 return -EINVAL;
3632
3633         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
3634
3635         freq_range->start_freq_khz =
3636                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
3637         freq_range->end_freq_khz =
3638                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
3639         freq_range->max_bandwidth_khz =
3640                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
3641
3642         power_rule->max_eirp =
3643                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
3644
3645         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
3646                 power_rule->max_antenna_gain =
3647                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
3648
3649         return 0;
3650 }
3651
3652 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
3653 {
3654         int r;
3655         char *data = NULL;
3656         enum nl80211_user_reg_hint_type user_reg_hint_type;
3657
3658         /*
3659          * You should only get this when cfg80211 hasn't yet initialized
3660          * completely when built-in to the kernel right between the time
3661          * window between nl80211_init() and regulatory_init(), if that is
3662          * even possible.
3663          */
3664         mutex_lock(&cfg80211_mutex);
3665         if (unlikely(!cfg80211_regdomain)) {
3666                 mutex_unlock(&cfg80211_mutex);
3667                 return -EINPROGRESS;
3668         }
3669         mutex_unlock(&cfg80211_mutex);
3670
3671         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3672                 return -EINVAL;
3673
3674         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3675
3676         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
3677                 user_reg_hint_type =
3678                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
3679         else
3680                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
3681
3682         switch (user_reg_hint_type) {
3683         case NL80211_USER_REG_HINT_USER:
3684         case NL80211_USER_REG_HINT_CELL_BASE:
3685                 break;
3686         default:
3687                 return -EINVAL;
3688         }
3689
3690         r = regulatory_hint_user(data, user_reg_hint_type);
3691
3692         return r;
3693 }
3694
3695 static int nl80211_get_mesh_config(struct sk_buff *skb,
3696                                    struct genl_info *info)
3697 {
3698         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3699         struct net_device *dev = info->user_ptr[1];
3700         struct wireless_dev *wdev = dev->ieee80211_ptr;
3701         struct mesh_config cur_params;
3702         int err = 0;
3703         void *hdr;
3704         struct nlattr *pinfoattr;
3705         struct sk_buff *msg;
3706
3707         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3708                 return -EOPNOTSUPP;
3709
3710         if (!rdev->ops->get_mesh_config)
3711                 return -EOPNOTSUPP;
3712
3713         wdev_lock(wdev);
3714         /* If not connected, get default parameters */
3715         if (!wdev->mesh_id_len)
3716                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3717         else
3718                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
3719         wdev_unlock(wdev);
3720
3721         if (err)
3722                 return err;
3723
3724         /* Draw up a netlink message to send back */
3725         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3726         if (!msg)
3727                 return -ENOMEM;
3728         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3729                              NL80211_CMD_GET_MESH_CONFIG);
3730         if (!hdr)
3731                 goto out;
3732         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3733         if (!pinfoattr)
3734                 goto nla_put_failure;
3735         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3736             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3737                         cur_params.dot11MeshRetryTimeout) ||
3738             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3739                         cur_params.dot11MeshConfirmTimeout) ||
3740             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3741                         cur_params.dot11MeshHoldingTimeout) ||
3742             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3743                         cur_params.dot11MeshMaxPeerLinks) ||
3744             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
3745                        cur_params.dot11MeshMaxRetries) ||
3746             nla_put_u8(msg, NL80211_MESHCONF_TTL,
3747                        cur_params.dot11MeshTTL) ||
3748             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3749                        cur_params.element_ttl) ||
3750             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3751                        cur_params.auto_open_plinks) ||
3752             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3753                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
3754             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3755                        cur_params.dot11MeshHWMPmaxPREQretries) ||
3756             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3757                         cur_params.path_refresh_time) ||
3758             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3759                         cur_params.min_discovery_timeout) ||
3760             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3761                         cur_params.dot11MeshHWMPactivePathTimeout) ||
3762             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3763                         cur_params.dot11MeshHWMPpreqMinInterval) ||
3764             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3765                         cur_params.dot11MeshHWMPperrMinInterval) ||
3766             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3767                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
3768             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3769                        cur_params.dot11MeshHWMPRootMode) ||
3770             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3771                         cur_params.dot11MeshHWMPRannInterval) ||
3772             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3773                        cur_params.dot11MeshGateAnnouncementProtocol) ||
3774             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
3775                        cur_params.dot11MeshForwarding) ||
3776             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
3777                         cur_params.rssi_threshold) ||
3778             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
3779                         cur_params.ht_opmode) ||
3780             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3781                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
3782             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3783                         cur_params.dot11MeshHWMProotInterval) ||
3784             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3785                         cur_params.dot11MeshHWMPconfirmationInterval))
3786                 goto nla_put_failure;
3787         nla_nest_end(msg, pinfoattr);
3788         genlmsg_end(msg, hdr);
3789         return genlmsg_reply(msg, info);
3790
3791  nla_put_failure:
3792         genlmsg_cancel(msg, hdr);
3793  out:
3794         nlmsg_free(msg);
3795         return -ENOBUFS;
3796 }
3797
3798 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3799         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3800         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3801         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3802         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3803         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3804         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3805         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3806         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3807         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
3808         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3809         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3810         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3811         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3812         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3813         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
3814         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3815         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3816         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3817         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3818         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
3819         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
3820         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
3821         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
3822         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
3823         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
3824 };
3825
3826 static const struct nla_policy
3827         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3828         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
3829         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3830         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3831         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3832         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3833                                     .len = IEEE80211_MAX_DATA_LEN },
3834         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3835 };
3836
3837 static int nl80211_parse_mesh_config(struct genl_info *info,
3838                                      struct mesh_config *cfg,
3839                                      u32 *mask_out)
3840 {
3841         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3842         u32 mask = 0;
3843
3844 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3845 do {\
3846         if (table[attr_num]) {\
3847                 cfg->param = nla_fn(table[attr_num]); \
3848                 mask |= (1 << (attr_num - 1)); \
3849         } \
3850 } while (0);\
3851
3852
3853         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3854                 return -EINVAL;
3855         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3856                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3857                              nl80211_meshconf_params_policy))
3858                 return -EINVAL;
3859
3860         /* This makes sure that there aren't more than 32 mesh config
3861          * parameters (otherwise our bitfield scheme would not work.) */
3862         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3863
3864         /* Fill in the params struct */
3865         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3866                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
3867                                   nla_get_u16);
3868         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3869                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3870                                   nla_get_u16);
3871         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3872                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
3873                                   nla_get_u16);
3874         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3875                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
3876                                   nla_get_u16);
3877         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3878                                   mask, NL80211_MESHCONF_MAX_RETRIES,
3879                                   nla_get_u8);
3880         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3881                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
3882         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3883                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
3884                                   nla_get_u8);
3885         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3886                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3887                                   nla_get_u8);
3888         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, mask,
3889                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3890                                   nla_get_u32);
3891         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3892                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3893                                   nla_get_u8);
3894         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3895                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
3896                                   nla_get_u32);
3897         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3898                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3899                                   nla_get_u16);
3900         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, mask,
3901                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3902                                   nla_get_u32);
3903         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3904                                   mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3905                                   nla_get_u16);
3906         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
3907                                   mask, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3908                                   nla_get_u16);
3909         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3910                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
3911                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3912                                   nla_get_u16);
3913         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
3914                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
3915         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
3916                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3917                                   nla_get_u16);
3918         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3919                                   dot11MeshGateAnnouncementProtocol, mask,
3920                                   NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3921                                   nla_get_u8);
3922         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding,
3923                                   mask, NL80211_MESHCONF_FORWARDING,
3924                                   nla_get_u8);
3925         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold,
3926                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
3927                                   nla_get_u32);
3928         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode,
3929                                   mask, NL80211_MESHCONF_HT_OPMODE,
3930                                   nla_get_u16);
3931         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
3932                                   mask,
3933                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3934                                   nla_get_u32);
3935         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval,
3936                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3937                                   nla_get_u16);
3938         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3939                                   dot11MeshHWMPconfirmationInterval, mask,
3940                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3941                                   nla_get_u16);
3942         if (mask_out)
3943                 *mask_out = mask;
3944
3945         return 0;
3946
3947 #undef FILL_IN_MESH_PARAM_IF_SET
3948 }
3949
3950 static int nl80211_parse_mesh_setup(struct genl_info *info,
3951                                      struct mesh_setup *setup)
3952 {
3953         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3954
3955         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3956                 return -EINVAL;
3957         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3958                              info->attrs[NL80211_ATTR_MESH_SETUP],
3959                              nl80211_mesh_setup_params_policy))
3960                 return -EINVAL;
3961
3962         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
3963                 setup->sync_method =
3964                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
3965                  IEEE80211_SYNC_METHOD_VENDOR :
3966                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
3967
3968         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3969                 setup->path_sel_proto =
3970                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3971                  IEEE80211_PATH_PROTOCOL_VENDOR :
3972                  IEEE80211_PATH_PROTOCOL_HWMP;
3973
3974         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3975                 setup->path_metric =
3976                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3977                  IEEE80211_PATH_METRIC_VENDOR :
3978                  IEEE80211_PATH_METRIC_AIRTIME;
3979
3980
3981         if (tb[NL80211_MESH_SETUP_IE]) {
3982                 struct nlattr *ieattr =
3983                         tb[NL80211_MESH_SETUP_IE];
3984                 if (!is_valid_ie_attr(ieattr))
3985                         return -EINVAL;
3986                 setup->ie = nla_data(ieattr);
3987                 setup->ie_len = nla_len(ieattr);
3988         }
3989         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3990         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3991
3992         return 0;
3993 }
3994
3995 static int nl80211_update_mesh_config(struct sk_buff *skb,
3996                                       struct genl_info *info)
3997 {
3998         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3999         struct net_device *dev = info->user_ptr[1];
4000         struct wireless_dev *wdev = dev->ieee80211_ptr;
4001         struct mesh_config cfg;
4002         u32 mask;
4003         int err;
4004
4005         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4006                 return -EOPNOTSUPP;
4007
4008         if (!rdev->ops->update_mesh_config)
4009                 return -EOPNOTSUPP;
4010
4011         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4012         if (err)
4013                 return err;
4014
4015         wdev_lock(wdev);
4016         if (!wdev->mesh_id_len)
4017                 err = -ENOLINK;
4018
4019         if (!err)
4020                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4021
4022         wdev_unlock(wdev);
4023
4024         return err;
4025 }
4026
4027 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4028 {
4029         struct sk_buff *msg;
4030         void *hdr = NULL;
4031         struct nlattr *nl_reg_rules;
4032         unsigned int i;
4033         int err = -EINVAL;
4034
4035         mutex_lock(&cfg80211_mutex);
4036
4037         if (!cfg80211_regdomain)
4038                 goto out;
4039
4040         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4041         if (!msg) {
4042                 err = -ENOBUFS;
4043                 goto out;
4044         }
4045
4046         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4047                              NL80211_CMD_GET_REG);
4048         if (!hdr)
4049                 goto put_failure;
4050
4051         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
4052                            cfg80211_regdomain->alpha2) ||
4053             (cfg80211_regdomain->dfs_region &&
4054              nla_put_u8(msg, NL80211_ATTR_DFS_REGION,
4055                         cfg80211_regdomain->dfs_region)))
4056                 goto nla_put_failure;
4057
4058         if (reg_last_request_cell_base() &&
4059             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4060                         NL80211_USER_REG_HINT_CELL_BASE))
4061                 goto nla_put_failure;
4062
4063         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4064         if (!nl_reg_rules)
4065                 goto nla_put_failure;
4066
4067         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
4068                 struct nlattr *nl_reg_rule;
4069                 const struct ieee80211_reg_rule *reg_rule;
4070                 const struct ieee80211_freq_range *freq_range;
4071                 const struct ieee80211_power_rule *power_rule;
4072
4073                 reg_rule = &cfg80211_regdomain->reg_rules[i];
4074                 freq_range = &reg_rule->freq_range;
4075                 power_rule = &reg_rule->power_rule;
4076
4077                 nl_reg_rule = nla_nest_start(msg, i);
4078                 if (!nl_reg_rule)
4079                         goto nla_put_failure;
4080
4081                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4082                                 reg_rule->flags) ||
4083                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4084                                 freq_range->start_freq_khz) ||
4085                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4086                                 freq_range->end_freq_khz) ||
4087                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4088                                 freq_range->max_bandwidth_khz) ||
4089                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4090                                 power_rule->max_antenna_gain) ||
4091                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4092                                 power_rule->max_eirp))
4093                         goto nla_put_failure;
4094
4095                 nla_nest_end(msg, nl_reg_rule);
4096         }
4097
4098         nla_nest_end(msg, nl_reg_rules);
4099
4100         genlmsg_end(msg, hdr);
4101         err = genlmsg_reply(msg, info);
4102         goto out;
4103
4104 nla_put_failure:
4105         genlmsg_cancel(msg, hdr);
4106 put_failure:
4107         nlmsg_free(msg);
4108         err = -EMSGSIZE;
4109 out:
4110         mutex_unlock(&cfg80211_mutex);
4111         return err;
4112 }
4113
4114 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4115 {
4116         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4117         struct nlattr *nl_reg_rule;
4118         char *alpha2 = NULL;
4119         int rem_reg_rules = 0, r = 0;
4120         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4121         u8 dfs_region = 0;
4122         struct ieee80211_regdomain *rd = NULL;
4123
4124         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4125                 return -EINVAL;
4126
4127         if (!info->attrs[NL80211_ATTR_REG_RULES])
4128                 return -EINVAL;
4129
4130         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4131
4132         if (info->attrs[NL80211_ATTR_DFS_REGION])
4133                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4134
4135         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4136                         rem_reg_rules) {
4137                 num_rules++;
4138                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4139                         return -EINVAL;
4140         }
4141
4142         mutex_lock(&cfg80211_mutex);
4143
4144         if (!reg_is_valid_request(alpha2)) {
4145                 r = -EINVAL;
4146                 goto bad_reg;
4147         }
4148
4149         size_of_regd = sizeof(struct ieee80211_regdomain) +
4150                 (num_rules * sizeof(struct ieee80211_reg_rule));
4151
4152         rd = kzalloc(size_of_regd, GFP_KERNEL);
4153         if (!rd) {
4154                 r = -ENOMEM;
4155                 goto bad_reg;
4156         }
4157
4158         rd->n_reg_rules = num_rules;
4159         rd->alpha2[0] = alpha2[0];
4160         rd->alpha2[1] = alpha2[1];
4161
4162         /*
4163          * Disable DFS master mode if the DFS region was
4164          * not supported or known on this kernel.
4165          */
4166         if (reg_supported_dfs_region(dfs_region))
4167                 rd->dfs_region = dfs_region;
4168
4169         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4170                         rem_reg_rules) {
4171                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4172                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4173                         reg_rule_policy);
4174                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4175                 if (r)
4176                         goto bad_reg;
4177
4178                 rule_idx++;
4179
4180                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
4181                         r = -EINVAL;
4182                         goto bad_reg;
4183                 }
4184         }
4185
4186         BUG_ON(rule_idx != num_rules);
4187
4188         r = set_regdom(rd);
4189
4190         mutex_unlock(&cfg80211_mutex);
4191
4192         return r;
4193
4194  bad_reg:
4195         mutex_unlock(&cfg80211_mutex);
4196         kfree(rd);
4197         return r;
4198 }
4199
4200 static int validate_scan_freqs(struct nlattr *freqs)
4201 {
4202         struct nlattr *attr1, *attr2;
4203         int n_channels = 0, tmp1, tmp2;
4204
4205         nla_for_each_nested(attr1, freqs, tmp1) {
4206                 n_channels++;
4207                 /*
4208                  * Some hardware has a limited channel list for
4209                  * scanning, and it is pretty much nonsensical
4210                  * to scan for a channel twice, so disallow that
4211                  * and don't require drivers to check that the
4212                  * channel list they get isn't longer than what
4213                  * they can scan, as long as they can scan all
4214                  * the channels they registered at once.
4215                  */
4216                 nla_for_each_nested(attr2, freqs, tmp2)
4217                         if (attr1 != attr2 &&
4218                             nla_get_u32(attr1) == nla_get_u32(attr2))
4219                                 return 0;
4220         }
4221
4222         return n_channels;
4223 }
4224
4225 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4226 {
4227         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4228         struct wireless_dev *wdev = info->user_ptr[1];
4229         struct cfg80211_scan_request *request;
4230         struct nlattr *attr;
4231         struct wiphy *wiphy;
4232         int err, tmp, n_ssids = 0, n_channels, i;
4233         size_t ie_len;
4234
4235         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4236                 return -EINVAL;
4237
4238         wiphy = &rdev->wiphy;
4239
4240         if (!rdev->ops->scan)
4241                 return -EOPNOTSUPP;
4242
4243         if (rdev->scan_req)
4244                 return -EBUSY;
4245
4246         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4247                 n_channels = validate_scan_freqs(
4248                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4249                 if (!n_channels)
4250                         return -EINVAL;
4251         } else {
4252                 enum ieee80211_band band;
4253                 n_channels = 0;
4254
4255                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4256                         if (wiphy->bands[band])
4257                                 n_channels += wiphy->bands[band]->n_channels;
4258         }
4259
4260         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4261                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4262                         n_ssids++;
4263
4264         if (n_ssids > wiphy->max_scan_ssids)
4265                 return -EINVAL;
4266
4267         if (info->attrs[NL80211_ATTR_IE])
4268                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4269         else
4270                 ie_len = 0;
4271
4272         if (ie_len > wiphy->max_scan_ie_len)
4273                 return -EINVAL;
4274
4275         request = kzalloc(sizeof(*request)
4276                         + sizeof(*request->ssids) * n_ssids
4277                         + sizeof(*request->channels) * n_channels
4278                         + ie_len, GFP_KERNEL);
4279         if (!request)
4280                 return -ENOMEM;
4281
4282         if (n_ssids)
4283                 request->ssids = (void *)&request->channels[n_channels];
4284         request->n_ssids = n_ssids;
4285         if (ie_len) {
4286                 if (request->ssids)
4287                         request->ie = (void *)(request->ssids + n_ssids);
4288                 else
4289                         request->ie = (void *)(request->channels + n_channels);
4290         }
4291
4292         i = 0;
4293         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4294                 /* user specified, bail out if channel not found */
4295                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
4296                         struct ieee80211_channel *chan;
4297
4298                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4299
4300                         if (!chan) {
4301                                 err = -EINVAL;
4302                                 goto out_free;
4303                         }
4304
4305                         /* ignore disabled channels */
4306                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4307                                 continue;
4308
4309                         request->channels[i] = chan;
4310                         i++;
4311                 }
4312         } else {
4313                 enum ieee80211_band band;
4314
4315                 /* all channels */
4316                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4317                         int j;
4318                         if (!wiphy->bands[band])
4319                                 continue;
4320                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4321                                 struct ieee80211_channel *chan;
4322
4323                                 chan = &wiphy->bands[band]->channels[j];
4324
4325                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4326                                         continue;
4327
4328                                 request->channels[i] = chan;
4329                                 i++;
4330                         }
4331                 }
4332         }
4333
4334         if (!i) {
4335                 err = -EINVAL;
4336                 goto out_free;
4337         }
4338
4339         request->n_channels = i;
4340
4341         i = 0;
4342         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4343                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
4344                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4345                                 err = -EINVAL;
4346                                 goto out_free;
4347                         }
4348                         request->ssids[i].ssid_len = nla_len(attr);
4349                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
4350                         i++;
4351                 }
4352         }
4353
4354         if (info->attrs[NL80211_ATTR_IE]) {
4355                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4356                 memcpy((void *)request->ie,
4357                        nla_data(info->attrs[NL80211_ATTR_IE]),
4358                        request->ie_len);
4359         }
4360
4361         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
4362                 if (wiphy->bands[i])
4363                         request->rates[i] =
4364                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
4365
4366         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
4367                 nla_for_each_nested(attr,
4368                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
4369                                     tmp) {
4370                         enum ieee80211_band band = nla_type(attr);
4371
4372                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4373                                 err = -EINVAL;
4374                                 goto out_free;
4375                         }
4376                         err = ieee80211_get_ratemask(wiphy->bands[band],
4377                                                      nla_data(attr),
4378                                                      nla_len(attr),
4379                                                      &request->rates[band]);
4380                         if (err)
4381                                 goto out_free;
4382                 }
4383         }
4384
4385         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4386                 request->flags = nla_get_u32(
4387                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4388                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4389                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4390                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4391                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4392                         err = -EOPNOTSUPP;
4393                         goto out_free;
4394                 }
4395         }
4396
4397         request->no_cck =
4398                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
4399
4400         request->wdev = wdev;
4401         request->wiphy = &rdev->wiphy;
4402         request->scan_start = jiffies;
4403
4404         rdev->scan_req = request;
4405         err = rdev_scan(rdev, request);
4406
4407         if (!err) {
4408                 nl80211_send_scan_start(rdev, wdev);
4409                 if (wdev->netdev)
4410                         dev_hold(wdev->netdev);
4411         } else {
4412  out_free:
4413                 rdev->scan_req = NULL;
4414                 kfree(request);
4415         }
4416
4417         return err;
4418 }
4419
4420 static int nl80211_start_sched_scan(struct sk_buff *skb,
4421                                     struct genl_info *info)
4422 {
4423         struct cfg80211_sched_scan_request *request;
4424         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4425         struct net_device *dev = info->user_ptr[1];
4426         struct nlattr *attr;
4427         struct wiphy *wiphy;
4428         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
4429         u32 interval;
4430         enum ieee80211_band band;
4431         size_t ie_len;
4432         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
4433
4434         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4435             !rdev->ops->sched_scan_start)
4436                 return -EOPNOTSUPP;
4437
4438         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4439                 return -EINVAL;
4440
4441         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
4442                 return -EINVAL;
4443
4444         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
4445         if (interval == 0)
4446                 return -EINVAL;
4447
4448         wiphy = &rdev->wiphy;
4449
4450         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4451                 n_channels = validate_scan_freqs(
4452                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4453                 if (!n_channels)
4454                         return -EINVAL;
4455         } else {
4456                 n_channels = 0;
4457
4458                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4459                         if (wiphy->bands[band])
4460                                 n_channels += wiphy->bands[band]->n_channels;
4461         }
4462
4463         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4464                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4465                                     tmp)
4466                         n_ssids++;
4467
4468         if (n_ssids > wiphy->max_sched_scan_ssids)
4469                 return -EINVAL;
4470
4471         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
4472                 nla_for_each_nested(attr,
4473                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4474                                     tmp)
4475                         n_match_sets++;
4476
4477         if (n_match_sets > wiphy->max_match_sets)
4478                 return -EINVAL;
4479
4480         if (info->attrs[NL80211_ATTR_IE])
4481                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4482         else
4483                 ie_len = 0;
4484
4485         if (ie_len > wiphy->max_sched_scan_ie_len)
4486                 return -EINVAL;
4487
4488         mutex_lock(&rdev->sched_scan_mtx);
4489
4490         if (rdev->sched_scan_req) {
4491                 err = -EINPROGRESS;
4492                 goto out;
4493         }
4494
4495         request = kzalloc(sizeof(*request)
4496                         + sizeof(*request->ssids) * n_ssids
4497                         + sizeof(*request->match_sets) * n_match_sets
4498                         + sizeof(*request->channels) * n_channels
4499                         + ie_len, GFP_KERNEL);
4500         if (!request) {
4501                 err = -ENOMEM;
4502                 goto out;
4503         }
4504
4505         if (n_ssids)
4506                 request->ssids = (void *)&request->channels[n_channels];
4507         request->n_ssids = n_ssids;
4508         if (ie_len) {
4509                 if (request->ssids)
4510                         request->ie = (void *)(request->ssids + n_ssids);
4511                 else
4512                         request->ie = (void *)(request->channels + n_channels);
4513         }
4514
4515         if (n_match_sets) {
4516                 if (request->ie)
4517                         request->match_sets = (void *)(request->ie + ie_len);
4518                 else if (request->ssids)
4519                         request->match_sets =
4520                                 (void *)(request->ssids + n_ssids);
4521                 else
4522                         request->match_sets =
4523                                 (void *)(request->channels + n_channels);
4524         }
4525         request->n_match_sets = n_match_sets;
4526
4527         i = 0;
4528         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4529                 /* user specified, bail out if channel not found */
4530                 nla_for_each_nested(attr,
4531                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
4532                                     tmp) {
4533                         struct ieee80211_channel *chan;
4534
4535                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4536
4537                         if (!chan) {
4538                                 err = -EINVAL;
4539                                 goto out_free;
4540                         }
4541
4542                         /* ignore disabled channels */
4543                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4544                                 continue;
4545
4546                         request->channels[i] = chan;
4547                         i++;
4548                 }
4549         } else {
4550                 /* all channels */
4551                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4552                         int j;
4553                         if (!wiphy->bands[band])
4554                                 continue;
4555                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4556                                 struct ieee80211_channel *chan;
4557
4558                                 chan = &wiphy->bands[band]->channels[j];
4559
4560                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4561                                         continue;
4562
4563                                 request->channels[i] = chan;
4564                                 i++;
4565                         }
4566                 }
4567         }
4568
4569         if (!i) {
4570                 err = -EINVAL;
4571                 goto out_free;
4572         }
4573
4574         request->n_channels = i;
4575
4576         i = 0;
4577         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4578                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4579                                     tmp) {
4580                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4581                                 err = -EINVAL;
4582                                 goto out_free;
4583                         }
4584                         request->ssids[i].ssid_len = nla_len(attr);
4585                         memcpy(request->ssids[i].ssid, nla_data(attr),
4586                                nla_len(attr));
4587                         i++;
4588                 }
4589         }
4590
4591         i = 0;
4592         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
4593                 nla_for_each_nested(attr,
4594                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4595                                     tmp) {
4596                         struct nlattr *ssid, *rssi;
4597
4598                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
4599                                   nla_data(attr), nla_len(attr),
4600                                   nl80211_match_policy);
4601                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
4602                         if (ssid) {
4603                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
4604                                         err = -EINVAL;
4605                                         goto out_free;
4606                                 }
4607                                 memcpy(request->match_sets[i].ssid.ssid,
4608                                        nla_data(ssid), nla_len(ssid));
4609                                 request->match_sets[i].ssid.ssid_len =
4610                                         nla_len(ssid);
4611                         }
4612                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
4613                         if (rssi)
4614                                 request->rssi_thold = nla_get_u32(rssi);
4615                         else
4616                                 request->rssi_thold =
4617                                                    NL80211_SCAN_RSSI_THOLD_OFF;
4618                         i++;
4619                 }
4620         }
4621
4622         if (info->attrs[NL80211_ATTR_IE]) {
4623                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4624                 memcpy((void *)request->ie,
4625                        nla_data(info->attrs[NL80211_ATTR_IE]),
4626                        request->ie_len);
4627         }
4628
4629         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4630                 request->flags = nla_get_u32(
4631                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4632                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4633                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4634                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4635                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4636                         err = -EOPNOTSUPP;
4637                         goto out_free;
4638                 }
4639         }
4640
4641         request->dev = dev;
4642         request->wiphy = &rdev->wiphy;
4643         request->interval = interval;
4644         request->scan_start = jiffies;
4645
4646         err = rdev_sched_scan_start(rdev, dev, request);
4647         if (!err) {
4648                 rdev->sched_scan_req = request;
4649                 nl80211_send_sched_scan(rdev, dev,
4650                                         NL80211_CMD_START_SCHED_SCAN);
4651                 goto out;
4652         }
4653
4654 out_free:
4655         kfree(request);
4656 out:
4657         mutex_unlock(&rdev->sched_scan_mtx);
4658         return err;
4659 }
4660
4661 static int nl80211_stop_sched_scan(struct sk_buff *skb,
4662                                    struct genl_info *info)
4663 {
4664         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4665         int err;
4666
4667         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4668             !rdev->ops->sched_scan_stop)
4669                 return -EOPNOTSUPP;
4670
4671         mutex_lock(&rdev->sched_scan_mtx);
4672         err = __cfg80211_stop_sched_scan(rdev, false);
4673         mutex_unlock(&rdev->sched_scan_mtx);
4674
4675         return err;
4676 }
4677
4678 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
4679                             u32 seq, int flags,
4680                             struct cfg80211_registered_device *rdev,
4681                             struct wireless_dev *wdev,
4682                             struct cfg80211_internal_bss *intbss)
4683 {
4684         struct cfg80211_bss *res = &intbss->pub;
4685         void *hdr;
4686         struct nlattr *bss;
4687
4688         ASSERT_WDEV_LOCK(wdev);
4689
4690         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
4691                              NL80211_CMD_NEW_SCAN_RESULTS);
4692         if (!hdr)
4693                 return -1;
4694
4695         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
4696
4697         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
4698             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
4699                 goto nla_put_failure;
4700
4701         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
4702         if (!bss)
4703                 goto nla_put_failure;
4704         if ((!is_zero_ether_addr(res->bssid) &&
4705              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)) ||
4706             (res->information_elements && res->len_information_elements &&
4707              nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
4708                      res->len_information_elements,
4709                      res->information_elements)) ||
4710             (res->beacon_ies && res->len_beacon_ies &&
4711              res->beacon_ies != res->information_elements &&
4712              nla_put(msg, NL80211_BSS_BEACON_IES,
4713                      res->len_beacon_ies, res->beacon_ies)))
4714                 goto nla_put_failure;
4715         if (res->tsf &&
4716             nla_put_u64(msg, NL80211_BSS_TSF, res->tsf))
4717                 goto nla_put_failure;
4718         if (res->beacon_interval &&
4719             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
4720                 goto nla_put_failure;
4721         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
4722             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
4723             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
4724                         jiffies_to_msecs(jiffies - intbss->ts)))
4725                 goto nla_put_failure;
4726
4727         switch (rdev->wiphy.signal_type) {
4728         case CFG80211_SIGNAL_TYPE_MBM:
4729                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
4730                         goto nla_put_failure;
4731                 break;
4732         case CFG80211_SIGNAL_TYPE_UNSPEC:
4733                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
4734                         goto nla_put_failure;
4735                 break;
4736         default:
4737                 break;
4738         }
4739
4740         switch (wdev->iftype) {
4741         case NL80211_IFTYPE_P2P_CLIENT:
4742         case NL80211_IFTYPE_STATION:
4743                 if (intbss == wdev->current_bss &&
4744                     nla_put_u32(msg, NL80211_BSS_STATUS,
4745                                 NL80211_BSS_STATUS_ASSOCIATED))
4746                         goto nla_put_failure;
4747                 break;
4748         case NL80211_IFTYPE_ADHOC:
4749                 if (intbss == wdev->current_bss &&
4750                     nla_put_u32(msg, NL80211_BSS_STATUS,
4751                                 NL80211_BSS_STATUS_IBSS_JOINED))
4752                         goto nla_put_failure;
4753                 break;
4754         default:
4755                 break;
4756         }
4757
4758         nla_nest_end(msg, bss);
4759
4760         return genlmsg_end(msg, hdr);
4761
4762  nla_put_failure:
4763         genlmsg_cancel(msg, hdr);
4764         return -EMSGSIZE;
4765 }
4766
4767 static int nl80211_dump_scan(struct sk_buff *skb,
4768                              struct netlink_callback *cb)
4769 {
4770         struct cfg80211_registered_device *rdev;
4771         struct net_device *dev;
4772         struct cfg80211_internal_bss *scan;
4773         struct wireless_dev *wdev;
4774         int start = cb->args[1], idx = 0;
4775         int err;
4776
4777         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
4778         if (err)
4779                 return err;
4780
4781         wdev = dev->ieee80211_ptr;
4782
4783         wdev_lock(wdev);
4784         spin_lock_bh(&rdev->bss_lock);
4785         cfg80211_bss_expire(rdev);
4786
4787         cb->seq = rdev->bss_generation;
4788
4789         list_for_each_entry(scan, &rdev->bss_list, list) {
4790                 if (++idx <= start)
4791                         continue;
4792                 if (nl80211_send_bss(skb, cb,
4793                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4794                                 rdev, wdev, scan) < 0) {
4795                         idx--;
4796                         break;
4797                 }
4798         }
4799
4800         spin_unlock_bh(&rdev->bss_lock);
4801         wdev_unlock(wdev);
4802
4803         cb->args[1] = idx;
4804         nl80211_finish_netdev_dump(rdev);
4805
4806         return skb->len;
4807 }
4808
4809 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
4810                                 int flags, struct net_device *dev,
4811                                 struct survey_info *survey)
4812 {
4813         void *hdr;
4814         struct nlattr *infoattr;
4815
4816         hdr = nl80211hdr_put(msg, portid, seq, flags,
4817                              NL80211_CMD_NEW_SURVEY_RESULTS);
4818         if (!hdr)
4819                 return -ENOMEM;
4820
4821         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
4822                 goto nla_put_failure;
4823
4824         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
4825         if (!infoattr)
4826                 goto nla_put_failure;
4827
4828         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
4829                         survey->channel->center_freq))
4830                 goto nla_put_failure;
4831
4832         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
4833             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
4834                 goto nla_put_failure;
4835         if ((survey->filled & SURVEY_INFO_IN_USE) &&
4836             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
4837                 goto nla_put_failure;
4838         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
4839             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
4840                         survey->channel_time))
4841                 goto nla_put_failure;
4842         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
4843             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
4844                         survey->channel_time_busy))
4845                 goto nla_put_failure;
4846         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
4847             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
4848                         survey->channel_time_ext_busy))
4849                 goto nla_put_failure;
4850         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
4851             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
4852                         survey->channel_time_rx))
4853                 goto nla_put_failure;
4854         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
4855             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
4856                         survey->channel_time_tx))
4857                 goto nla_put_failure;
4858
4859         nla_nest_end(msg, infoattr);
4860
4861         return genlmsg_end(msg, hdr);
4862
4863  nla_put_failure:
4864         genlmsg_cancel(msg, hdr);
4865         return -EMSGSIZE;
4866 }
4867
4868 static int nl80211_dump_survey(struct sk_buff *skb,
4869                         struct netlink_callback *cb)
4870 {
4871         struct survey_info survey;
4872         struct cfg80211_registered_device *dev;
4873         struct net_device *netdev;
4874         int survey_idx = cb->args[1];
4875         int res;
4876
4877         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4878         if (res)
4879                 return res;
4880
4881         if (!dev->ops->dump_survey) {
4882                 res = -EOPNOTSUPP;
4883                 goto out_err;
4884         }
4885
4886         while (1) {
4887                 struct ieee80211_channel *chan;
4888
4889                 res = rdev_dump_survey(dev, netdev, survey_idx, &survey);
4890                 if (res == -ENOENT)
4891                         break;
4892                 if (res)
4893                         goto out_err;
4894
4895                 /* Survey without a channel doesn't make sense */
4896                 if (!survey.channel) {
4897                         res = -EINVAL;
4898                         goto out;
4899                 }
4900
4901                 chan = ieee80211_get_channel(&dev->wiphy,
4902                                              survey.channel->center_freq);
4903                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4904                         survey_idx++;
4905                         continue;
4906                 }
4907
4908                 if (nl80211_send_survey(skb,
4909                                 NETLINK_CB(cb->skb).portid,
4910                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4911                                 netdev,
4912                                 &survey) < 0)
4913                         goto out;
4914                 survey_idx++;
4915         }
4916
4917  out:
4918         cb->args[1] = survey_idx;
4919         res = skb->len;
4920  out_err:
4921         nl80211_finish_netdev_dump(dev);
4922         return res;
4923 }
4924
4925 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4926 {
4927         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4928                                   NL80211_WPA_VERSION_2));
4929 }
4930
4931 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4932 {
4933         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4934         struct net_device *dev = info->user_ptr[1];
4935         struct ieee80211_channel *chan;
4936         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
4937         int err, ssid_len, ie_len = 0, sae_data_len = 0;
4938         enum nl80211_auth_type auth_type;
4939         struct key_parse key;
4940         bool local_state_change;
4941
4942         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4943                 return -EINVAL;
4944
4945         if (!info->attrs[NL80211_ATTR_MAC])
4946                 return -EINVAL;
4947
4948         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4949                 return -EINVAL;
4950
4951         if (!info->attrs[NL80211_ATTR_SSID])
4952                 return -EINVAL;
4953
4954         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4955                 return -EINVAL;
4956
4957         err = nl80211_parse_key(info, &key);
4958         if (err)
4959                 return err;
4960
4961         if (key.idx >= 0) {
4962                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4963                         return -EINVAL;
4964                 if (!key.p.key || !key.p.key_len)
4965                         return -EINVAL;
4966                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4967                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4968                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4969                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4970                         return -EINVAL;
4971                 if (key.idx > 4)
4972                         return -EINVAL;
4973         } else {
4974                 key.p.key_len = 0;
4975                 key.p.key = NULL;
4976         }
4977
4978         if (key.idx >= 0) {
4979                 int i;
4980                 bool ok = false;
4981                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4982                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4983                                 ok = true;
4984                                 break;
4985                         }
4986                 }
4987                 if (!ok)
4988                         return -EINVAL;
4989         }
4990
4991         if (!rdev->ops->auth)
4992                 return -EOPNOTSUPP;
4993
4994         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4995             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4996                 return -EOPNOTSUPP;
4997
4998         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4999         chan = ieee80211_get_channel(&rdev->wiphy,
5000                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5001         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5002                 return -EINVAL;
5003
5004         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5005         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5006
5007         if (info->attrs[NL80211_ATTR_IE]) {
5008                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5009                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5010         }
5011
5012         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5013         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5014                 return -EINVAL;
5015
5016         if (auth_type == NL80211_AUTHTYPE_SAE &&
5017             !info->attrs[NL80211_ATTR_SAE_DATA])
5018                 return -EINVAL;
5019
5020         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5021                 if (auth_type != NL80211_AUTHTYPE_SAE)
5022                         return -EINVAL;
5023                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5024                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5025                 /* need to include at least Auth Transaction and Status Code */
5026                 if (sae_data_len < 4)
5027                         return -EINVAL;
5028         }
5029
5030         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5031
5032         /*
5033          * Since we no longer track auth state, ignore
5034          * requests to only change local state.
5035          */
5036         if (local_state_change)
5037                 return 0;
5038
5039         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5040                                   ssid, ssid_len, ie, ie_len,
5041                                   key.p.key, key.p.key_len, key.idx,
5042                                   sae_data, sae_data_len);
5043 }
5044
5045 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5046                                    struct genl_info *info,
5047                                    struct cfg80211_crypto_settings *settings,
5048                                    int cipher_limit)
5049 {
5050         memset(settings, 0, sizeof(*settings));
5051
5052         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5053
5054         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5055                 u16 proto;
5056                 proto = nla_get_u16(
5057                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5058                 settings->control_port_ethertype = cpu_to_be16(proto);
5059                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5060                     proto != ETH_P_PAE)
5061                         return -EINVAL;
5062                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5063                         settings->control_port_no_encrypt = true;
5064         } else
5065                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5066
5067         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5068                 void *data;
5069                 int len, i;
5070
5071                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5072                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5073                 settings->n_ciphers_pairwise = len / sizeof(u32);
5074
5075                 if (len % sizeof(u32))
5076                         return -EINVAL;
5077
5078                 if (settings->n_ciphers_pairwise > cipher_limit)
5079                         return -EINVAL;
5080
5081                 memcpy(settings->ciphers_pairwise, data, len);
5082
5083                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5084                         if (!cfg80211_supported_cipher_suite(
5085                                         &rdev->wiphy,
5086                                         settings->ciphers_pairwise[i]))
5087                                 return -EINVAL;
5088         }
5089
5090         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5091                 settings->cipher_group =
5092                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5093                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5094                                                      settings->cipher_group))
5095                         return -EINVAL;
5096         }
5097
5098         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5099                 settings->wpa_versions =
5100                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5101                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5102                         return -EINVAL;
5103         }
5104
5105         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5106                 void *data;
5107                 int len;
5108
5109                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5110                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5111                 settings->n_akm_suites = len / sizeof(u32);
5112
5113                 if (len % sizeof(u32))
5114                         return -EINVAL;
5115
5116                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
5117                         return -EINVAL;
5118
5119                 memcpy(settings->akm_suites, data, len);
5120         }
5121
5122         return 0;
5123 }
5124
5125 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
5126 {
5127         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5128         struct net_device *dev = info->user_ptr[1];
5129         struct cfg80211_crypto_settings crypto;
5130         struct ieee80211_channel *chan;
5131         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
5132         int err, ssid_len, ie_len = 0;
5133         bool use_mfp = false;
5134         u32 flags = 0;
5135         struct ieee80211_ht_cap *ht_capa = NULL;
5136         struct ieee80211_ht_cap *ht_capa_mask = NULL;
5137
5138         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5139                 return -EINVAL;
5140
5141         if (!info->attrs[NL80211_ATTR_MAC] ||
5142             !info->attrs[NL80211_ATTR_SSID] ||
5143             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5144                 return -EINVAL;
5145
5146         if (!rdev->ops->assoc)
5147                 return -EOPNOTSUPP;
5148
5149         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5150             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5151                 return -EOPNOTSUPP;
5152
5153         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5154
5155         chan = ieee80211_get_channel(&rdev->wiphy,
5156                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5157         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5158                 return -EINVAL;
5159
5160         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5161         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5162
5163         if (info->attrs[NL80211_ATTR_IE]) {
5164                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5165                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5166         }
5167
5168         if (info->attrs[NL80211_ATTR_USE_MFP]) {
5169                 enum nl80211_mfp mfp =
5170                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
5171                 if (mfp == NL80211_MFP_REQUIRED)
5172                         use_mfp = true;
5173                 else if (mfp != NL80211_MFP_NO)
5174                         return -EINVAL;
5175         }
5176
5177         if (info->attrs[NL80211_ATTR_PREV_BSSID])
5178                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
5179
5180         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5181                 flags |= ASSOC_REQ_DISABLE_HT;
5182
5183         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5184                 ht_capa_mask =
5185                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
5186
5187         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5188                 if (!ht_capa_mask)
5189                         return -EINVAL;
5190                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5191         }
5192
5193         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
5194         if (!err)
5195                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
5196                                           ssid, ssid_len, ie, ie_len, use_mfp,
5197                                           &crypto, flags, ht_capa,
5198                                           ht_capa_mask);
5199
5200         return err;
5201 }
5202
5203 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
5204 {
5205         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5206         struct net_device *dev = info->user_ptr[1];
5207         const u8 *ie = NULL, *bssid;
5208         int ie_len = 0;
5209         u16 reason_code;
5210         bool local_state_change;
5211
5212         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5213                 return -EINVAL;
5214
5215         if (!info->attrs[NL80211_ATTR_MAC])
5216                 return -EINVAL;
5217
5218         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5219                 return -EINVAL;
5220
5221         if (!rdev->ops->deauth)
5222                 return -EOPNOTSUPP;
5223
5224         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5225             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5226                 return -EOPNOTSUPP;
5227
5228         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5229
5230         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5231         if (reason_code == 0) {
5232                 /* Reason Code 0 is reserved */
5233                 return -EINVAL;
5234         }
5235
5236         if (info->attrs[NL80211_ATTR_IE]) {
5237                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5238                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5239         }
5240
5241         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5242
5243         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
5244                                     local_state_change);
5245 }
5246
5247 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
5248 {
5249         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5250         struct net_device *dev = info->user_ptr[1];
5251         const u8 *ie = NULL, *bssid;
5252         int ie_len = 0;
5253         u16 reason_code;
5254         bool local_state_change;
5255
5256         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5257                 return -EINVAL;
5258
5259         if (!info->attrs[NL80211_ATTR_MAC])
5260                 return -EINVAL;
5261
5262         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5263                 return -EINVAL;
5264
5265         if (!rdev->ops->disassoc)
5266                 return -EOPNOTSUPP;
5267
5268         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5269             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5270                 return -EOPNOTSUPP;
5271
5272         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5273
5274         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5275         if (reason_code == 0) {
5276                 /* Reason Code 0 is reserved */
5277                 return -EINVAL;
5278         }
5279
5280         if (info->attrs[NL80211_ATTR_IE]) {
5281                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5282                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5283         }
5284
5285         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5286
5287         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
5288                                       local_state_change);
5289 }
5290
5291 static bool
5292 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
5293                          int mcast_rate[IEEE80211_NUM_BANDS],
5294                          int rateval)
5295 {
5296         struct wiphy *wiphy = &rdev->wiphy;
5297         bool found = false;
5298         int band, i;
5299
5300         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5301                 struct ieee80211_supported_band *sband;
5302
5303                 sband = wiphy->bands[band];
5304                 if (!sband)
5305                         continue;
5306
5307                 for (i = 0; i < sband->n_bitrates; i++) {
5308                         if (sband->bitrates[i].bitrate == rateval) {
5309                                 mcast_rate[band] = i + 1;
5310                                 found = true;
5311                                 break;
5312                         }
5313                 }
5314         }
5315
5316         return found;
5317 }
5318
5319 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
5320 {
5321         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5322         struct net_device *dev = info->user_ptr[1];
5323         struct cfg80211_ibss_params ibss;
5324         struct wiphy *wiphy;
5325         struct cfg80211_cached_keys *connkeys = NULL;
5326         int err;
5327
5328         memset(&ibss, 0, sizeof(ibss));
5329
5330         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5331                 return -EINVAL;
5332
5333         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5334             !info->attrs[NL80211_ATTR_SSID] ||
5335             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5336                 return -EINVAL;
5337
5338         ibss.beacon_interval = 100;
5339
5340         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
5341                 ibss.beacon_interval =
5342                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5343                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
5344                         return -EINVAL;
5345         }
5346
5347         if (!rdev->ops->join_ibss)
5348                 return -EOPNOTSUPP;
5349
5350         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5351                 return -EOPNOTSUPP;
5352
5353         wiphy = &rdev->wiphy;
5354
5355         if (info->attrs[NL80211_ATTR_MAC]) {
5356                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5357
5358                 if (!is_valid_ether_addr(ibss.bssid))
5359                         return -EINVAL;
5360         }
5361         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5362         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5363
5364         if (info->attrs[NL80211_ATTR_IE]) {
5365                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5366                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5367         }
5368
5369         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5370                 enum nl80211_channel_type channel_type;
5371
5372                 if (!nl80211_valid_channel_type(info, &channel_type))
5373                         return -EINVAL;
5374
5375                 if (channel_type != NL80211_CHAN_NO_HT &&
5376                     !(wiphy->features & NL80211_FEATURE_HT_IBSS))
5377                         return -EINVAL;
5378
5379                 ibss.channel_type = channel_type;
5380         } else {
5381                 ibss.channel_type = NL80211_CHAN_NO_HT;
5382         }
5383
5384         ibss.channel = rdev_freq_to_chan(rdev,
5385                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
5386                 ibss.channel_type);
5387         if (!ibss.channel ||
5388             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
5389             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
5390                 return -EINVAL;
5391
5392         /* Both channels should be able to initiate communication */
5393         if ((ibss.channel_type == NL80211_CHAN_HT40PLUS ||
5394              ibss.channel_type == NL80211_CHAN_HT40MINUS) &&
5395             !cfg80211_can_beacon_sec_chan(&rdev->wiphy, ibss.channel,
5396                                           ibss.channel_type))
5397                 return -EINVAL;
5398
5399         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
5400         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5401
5402         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5403                 u8 *rates =
5404                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5405                 int n_rates =
5406                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5407                 struct ieee80211_supported_band *sband =
5408                         wiphy->bands[ibss.channel->band];
5409
5410                 err = ieee80211_get_ratemask(sband, rates, n_rates,
5411                                              &ibss.basic_rates);
5412                 if (err)
5413                         return err;
5414         }
5415
5416         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5417             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
5418                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5419                 return -EINVAL;
5420
5421         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5422                 bool no_ht = false;
5423
5424                 connkeys = nl80211_parse_connkeys(rdev,
5425                                           info->attrs[NL80211_ATTR_KEYS],
5426                                           &no_ht);
5427                 if (IS_ERR(connkeys))
5428                         return PTR_ERR(connkeys);
5429
5430                 if ((ibss.channel_type != NL80211_CHAN_NO_HT) && no_ht) {
5431                         kfree(connkeys);
5432                         return -EINVAL;
5433                 }
5434         }
5435
5436         ibss.control_port =
5437                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
5438
5439         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
5440         if (err)
5441                 kfree(connkeys);
5442         return err;
5443 }
5444
5445 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
5446 {
5447         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5448         struct net_device *dev = info->user_ptr[1];
5449
5450         if (!rdev->ops->leave_ibss)
5451                 return -EOPNOTSUPP;
5452
5453         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5454                 return -EOPNOTSUPP;
5455
5456         return cfg80211_leave_ibss(rdev, dev, false);
5457 }
5458
5459 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
5460 {
5461         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5462         struct net_device *dev = info->user_ptr[1];
5463         int mcast_rate[IEEE80211_NUM_BANDS];
5464         u32 nla_rate;
5465         int err;
5466
5467         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5468             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5469                 return -EOPNOTSUPP;
5470
5471         if (!rdev->ops->set_mcast_rate)
5472                 return -EOPNOTSUPP;
5473
5474         memset(mcast_rate, 0, sizeof(mcast_rate));
5475
5476         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
5477                 return -EINVAL;
5478
5479         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
5480         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
5481                 return -EINVAL;
5482
5483         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
5484
5485         return err;
5486 }
5487
5488
5489 #ifdef CONFIG_NL80211_TESTMODE
5490 static struct genl_multicast_group nl80211_testmode_mcgrp = {
5491         .name = "testmode",
5492 };
5493
5494 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
5495 {
5496         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5497         int err;
5498
5499         if (!info->attrs[NL80211_ATTR_TESTDATA])
5500                 return -EINVAL;
5501
5502         err = -EOPNOTSUPP;
5503         if (rdev->ops->testmode_cmd) {
5504                 rdev->testmode_info = info;
5505                 err = rdev_testmode_cmd(rdev,
5506                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
5507                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
5508                 rdev->testmode_info = NULL;
5509         }
5510
5511         return err;
5512 }
5513
5514 static int nl80211_testmode_dump(struct sk_buff *skb,
5515                                  struct netlink_callback *cb)
5516 {
5517         struct cfg80211_registered_device *rdev;
5518         int err;
5519         long phy_idx;
5520         void *data = NULL;
5521         int data_len = 0;
5522
5523         if (cb->args[0]) {
5524                 /*
5525                  * 0 is a valid index, but not valid for args[0],
5526                  * so we need to offset by 1.
5527                  */
5528                 phy_idx = cb->args[0] - 1;
5529         } else {
5530                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
5531                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
5532                                   nl80211_policy);
5533                 if (err)
5534                         return err;
5535
5536                 mutex_lock(&cfg80211_mutex);
5537                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
5538                                                   nl80211_fam.attrbuf);
5539                 if (IS_ERR(rdev)) {
5540                         mutex_unlock(&cfg80211_mutex);
5541                         return PTR_ERR(rdev);
5542                 }
5543                 phy_idx = rdev->wiphy_idx;
5544                 rdev = NULL;
5545                 mutex_unlock(&cfg80211_mutex);
5546
5547                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
5548                         cb->args[1] =
5549                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
5550         }
5551
5552         if (cb->args[1]) {
5553                 data = nla_data((void *)cb->args[1]);
5554                 data_len = nla_len((void *)cb->args[1]);
5555         }
5556
5557         mutex_lock(&cfg80211_mutex);
5558         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
5559         if (!rdev) {
5560                 mutex_unlock(&cfg80211_mutex);
5561                 return -ENOENT;
5562         }
5563         cfg80211_lock_rdev(rdev);
5564         mutex_unlock(&cfg80211_mutex);
5565
5566         if (!rdev->ops->testmode_dump) {
5567                 err = -EOPNOTSUPP;
5568                 goto out_err;
5569         }
5570
5571         while (1) {
5572                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
5573                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
5574                                            NL80211_CMD_TESTMODE);
5575                 struct nlattr *tmdata;
5576
5577                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
5578                         genlmsg_cancel(skb, hdr);
5579                         break;
5580                 }
5581
5582                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5583                 if (!tmdata) {
5584                         genlmsg_cancel(skb, hdr);
5585                         break;
5586                 }
5587                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
5588                 nla_nest_end(skb, tmdata);
5589
5590                 if (err == -ENOBUFS || err == -ENOENT) {
5591                         genlmsg_cancel(skb, hdr);
5592                         break;
5593                 } else if (err) {
5594                         genlmsg_cancel(skb, hdr);
5595                         goto out_err;
5596                 }
5597
5598                 genlmsg_end(skb, hdr);
5599         }
5600
5601         err = skb->len;
5602         /* see above */
5603         cb->args[0] = phy_idx + 1;
5604  out_err:
5605         cfg80211_unlock_rdev(rdev);
5606         return err;
5607 }
5608
5609 static struct sk_buff *
5610 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
5611                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
5612 {
5613         struct sk_buff *skb;
5614         void *hdr;
5615         struct nlattr *data;
5616
5617         skb = nlmsg_new(approxlen + 100, gfp);
5618         if (!skb)
5619                 return NULL;
5620
5621         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
5622         if (!hdr) {
5623                 kfree_skb(skb);
5624                 return NULL;
5625         }
5626
5627         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
5628                 goto nla_put_failure;
5629         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5630
5631         ((void **)skb->cb)[0] = rdev;
5632         ((void **)skb->cb)[1] = hdr;
5633         ((void **)skb->cb)[2] = data;
5634
5635         return skb;
5636
5637  nla_put_failure:
5638         kfree_skb(skb);
5639         return NULL;
5640 }
5641
5642 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
5643                                                   int approxlen)
5644 {
5645         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5646
5647         if (WARN_ON(!rdev->testmode_info))
5648                 return NULL;
5649
5650         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
5651                                 rdev->testmode_info->snd_portid,
5652                                 rdev->testmode_info->snd_seq,
5653                                 GFP_KERNEL);
5654 }
5655 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
5656
5657 int cfg80211_testmode_reply(struct sk_buff *skb)
5658 {
5659         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
5660         void *hdr = ((void **)skb->cb)[1];
5661         struct nlattr *data = ((void **)skb->cb)[2];
5662
5663         if (WARN_ON(!rdev->testmode_info)) {
5664                 kfree_skb(skb);
5665                 return -EINVAL;
5666         }
5667
5668         nla_nest_end(skb, data);
5669         genlmsg_end(skb, hdr);
5670         return genlmsg_reply(skb, rdev->testmode_info);
5671 }
5672 EXPORT_SYMBOL(cfg80211_testmode_reply);
5673
5674 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
5675                                                   int approxlen, gfp_t gfp)
5676 {
5677         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5678
5679         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
5680 }
5681 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
5682
5683 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
5684 {
5685         void *hdr = ((void **)skb->cb)[1];
5686         struct nlattr *data = ((void **)skb->cb)[2];
5687
5688         nla_nest_end(skb, data);
5689         genlmsg_end(skb, hdr);
5690         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
5691 }
5692 EXPORT_SYMBOL(cfg80211_testmode_event);
5693 #endif
5694
5695 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
5696 {
5697         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5698         struct net_device *dev = info->user_ptr[1];
5699         struct cfg80211_connect_params connect;
5700         struct wiphy *wiphy;
5701         struct cfg80211_cached_keys *connkeys = NULL;
5702         int err;
5703
5704         memset(&connect, 0, sizeof(connect));
5705
5706         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5707                 return -EINVAL;
5708
5709         if (!info->attrs[NL80211_ATTR_SSID] ||
5710             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5711                 return -EINVAL;
5712
5713         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5714                 connect.auth_type =
5715                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5716                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
5717                                              NL80211_CMD_CONNECT))
5718                         return -EINVAL;
5719         } else
5720                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5721
5722         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
5723
5724         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
5725                                       NL80211_MAX_NR_CIPHER_SUITES);
5726         if (err)
5727                 return err;
5728
5729         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5730             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5731                 return -EOPNOTSUPP;
5732
5733         wiphy = &rdev->wiphy;
5734
5735         connect.bg_scan_period = -1;
5736         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
5737                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
5738                 connect.bg_scan_period =
5739                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
5740         }
5741
5742         if (info->attrs[NL80211_ATTR_MAC])
5743                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5744         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5745         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5746
5747         if (info->attrs[NL80211_ATTR_IE]) {
5748                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5749                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5750         }
5751
5752         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5753                 connect.channel =
5754                         ieee80211_get_channel(wiphy,
5755                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5756                 if (!connect.channel ||
5757                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
5758                         return -EINVAL;
5759         }
5760
5761         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5762                 connkeys = nl80211_parse_connkeys(rdev,
5763                                           info->attrs[NL80211_ATTR_KEYS], NULL);
5764                 if (IS_ERR(connkeys))
5765                         return PTR_ERR(connkeys);
5766         }
5767
5768         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5769                 connect.flags |= ASSOC_REQ_DISABLE_HT;
5770
5771         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5772                 memcpy(&connect.ht_capa_mask,
5773                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
5774                        sizeof(connect.ht_capa_mask));
5775
5776         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5777                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
5778                         kfree(connkeys);
5779                         return -EINVAL;
5780                 }
5781                 memcpy(&connect.ht_capa,
5782                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
5783                        sizeof(connect.ht_capa));
5784         }
5785
5786         err = cfg80211_connect(rdev, dev, &connect, connkeys);
5787         if (err)
5788                 kfree(connkeys);
5789         return err;
5790 }
5791
5792 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
5793 {
5794         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5795         struct net_device *dev = info->user_ptr[1];
5796         u16 reason;
5797
5798         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5799                 reason = WLAN_REASON_DEAUTH_LEAVING;
5800         else
5801                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5802
5803         if (reason == 0)
5804                 return -EINVAL;
5805
5806         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5807             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5808                 return -EOPNOTSUPP;
5809
5810         return cfg80211_disconnect(rdev, dev, reason, true);
5811 }
5812
5813 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
5814 {
5815         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5816         struct net *net;
5817         int err;
5818         u32 pid;
5819
5820         if (!info->attrs[NL80211_ATTR_PID])
5821                 return -EINVAL;
5822
5823         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
5824
5825         net = get_net_ns_by_pid(pid);
5826         if (IS_ERR(net))
5827                 return PTR_ERR(net);
5828
5829         err = 0;
5830
5831         /* check if anything to do */
5832         if (!net_eq(wiphy_net(&rdev->wiphy), net))
5833                 err = cfg80211_switch_netns(rdev, net);
5834
5835         put_net(net);
5836         return err;
5837 }
5838
5839 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
5840 {
5841         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5842         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
5843                         struct cfg80211_pmksa *pmksa) = NULL;
5844         struct net_device *dev = info->user_ptr[1];
5845         struct cfg80211_pmksa pmksa;
5846
5847         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
5848
5849         if (!info->attrs[NL80211_ATTR_MAC])
5850                 return -EINVAL;
5851
5852         if (!info->attrs[NL80211_ATTR_PMKID])
5853                 return -EINVAL;
5854
5855         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
5856         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5857
5858         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5859             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5860                 return -EOPNOTSUPP;
5861
5862         switch (info->genlhdr->cmd) {
5863         case NL80211_CMD_SET_PMKSA:
5864                 rdev_ops = rdev->ops->set_pmksa;
5865                 break;
5866         case NL80211_CMD_DEL_PMKSA:
5867                 rdev_ops = rdev->ops->del_pmksa;
5868                 break;
5869         default:
5870                 WARN_ON(1);
5871                 break;
5872         }
5873
5874         if (!rdev_ops)
5875                 return -EOPNOTSUPP;
5876
5877         return rdev_ops(&rdev->wiphy, dev, &pmksa);
5878 }
5879
5880 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
5881 {
5882         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5883         struct net_device *dev = info->user_ptr[1];
5884
5885         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5886             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5887                 return -EOPNOTSUPP;
5888
5889         if (!rdev->ops->flush_pmksa)
5890                 return -EOPNOTSUPP;
5891
5892         return rdev_flush_pmksa(rdev, dev);
5893 }
5894
5895 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
5896 {
5897         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5898         struct net_device *dev = info->user_ptr[1];
5899         u8 action_code, dialog_token;
5900         u16 status_code;
5901         u8 *peer;
5902
5903         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5904             !rdev->ops->tdls_mgmt)
5905                 return -EOPNOTSUPP;
5906
5907         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
5908             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
5909             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
5910             !info->attrs[NL80211_ATTR_IE] ||
5911             !info->attrs[NL80211_ATTR_MAC])
5912                 return -EINVAL;
5913
5914         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5915         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
5916         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
5917         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
5918
5919         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
5920                               dialog_token, status_code,
5921                               nla_data(info->attrs[NL80211_ATTR_IE]),
5922                               nla_len(info->attrs[NL80211_ATTR_IE]));
5923 }
5924
5925 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
5926 {
5927         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5928         struct net_device *dev = info->user_ptr[1];
5929         enum nl80211_tdls_operation operation;
5930         u8 *peer;
5931
5932         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5933             !rdev->ops->tdls_oper)
5934                 return -EOPNOTSUPP;
5935
5936         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
5937             !info->attrs[NL80211_ATTR_MAC])
5938                 return -EINVAL;
5939
5940         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
5941         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5942
5943         return rdev_tdls_oper(rdev, dev, peer, operation);
5944 }
5945
5946 static int nl80211_remain_on_channel(struct sk_buff *skb,
5947                                      struct genl_info *info)
5948 {
5949         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5950         struct wireless_dev *wdev = info->user_ptr[1];
5951         struct ieee80211_channel *chan;
5952         struct sk_buff *msg;
5953         void *hdr;
5954         u64 cookie;
5955         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5956         u32 freq, duration;
5957         int err;
5958
5959         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5960             !info->attrs[NL80211_ATTR_DURATION])
5961                 return -EINVAL;
5962
5963         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5964
5965         if (!rdev->ops->remain_on_channel ||
5966             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
5967                 return -EOPNOTSUPP;
5968
5969         /*
5970          * We should be on that channel for at least a minimum amount of
5971          * time (10ms) but no longer than the driver supports.
5972          */
5973         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
5974             duration > rdev->wiphy.max_remain_on_channel_duration)
5975                 return -EINVAL;
5976
5977         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
5978             !nl80211_valid_channel_type(info, &channel_type))
5979                 return -EINVAL;
5980
5981         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5982         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5983         if (chan == NULL)
5984                 return -EINVAL;
5985
5986         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5987         if (!msg)
5988                 return -ENOMEM;
5989
5990         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5991                              NL80211_CMD_REMAIN_ON_CHANNEL);
5992
5993         if (IS_ERR(hdr)) {
5994                 err = PTR_ERR(hdr);
5995                 goto free_msg;
5996         }
5997
5998         err = rdev_remain_on_channel(rdev, wdev, chan, channel_type, duration,
5999                                      &cookie);
6000
6001         if (err)
6002                 goto free_msg;
6003
6004         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6005                 goto nla_put_failure;
6006
6007         genlmsg_end(msg, hdr);
6008
6009         return genlmsg_reply(msg, info);
6010
6011  nla_put_failure:
6012         err = -ENOBUFS;
6013  free_msg:
6014         nlmsg_free(msg);
6015         return err;
6016 }
6017
6018 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6019                                             struct genl_info *info)
6020 {
6021         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6022         struct wireless_dev *wdev = info->user_ptr[1];
6023         u64 cookie;
6024
6025         if (!info->attrs[NL80211_ATTR_COOKIE])
6026                 return -EINVAL;
6027
6028         if (!rdev->ops->cancel_remain_on_channel)
6029                 return -EOPNOTSUPP;
6030
6031         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6032
6033         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6034 }
6035
6036 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6037                            u8 *rates, u8 rates_len)
6038 {
6039         u8 i;
6040         u32 mask = 0;
6041
6042         for (i = 0; i < rates_len; i++) {
6043                 int rate = (rates[i] & 0x7f) * 5;
6044                 int ridx;
6045                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6046                         struct ieee80211_rate *srate =
6047                                 &sband->bitrates[ridx];
6048                         if (rate == srate->bitrate) {
6049                                 mask |= 1 << ridx;
6050                                 break;
6051                         }
6052                 }
6053                 if (ridx == sband->n_bitrates)
6054                         return 0; /* rate not found */
6055         }
6056
6057         return mask;
6058 }
6059
6060 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6061                                u8 *rates, u8 rates_len,
6062                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6063 {
6064         u8 i;
6065
6066         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6067
6068         for (i = 0; i < rates_len; i++) {
6069                 int ridx, rbit;
6070
6071                 ridx = rates[i] / 8;
6072                 rbit = BIT(rates[i] % 8);
6073
6074                 /* check validity */
6075                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6076                         return false;
6077
6078                 /* check availability */
6079                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
6080                         mcs[ridx] |= rbit;
6081                 else
6082                         return false;
6083         }
6084
6085         return true;
6086 }
6087
6088 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
6089         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
6090                                     .len = NL80211_MAX_SUPP_RATES },
6091         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
6092                                  .len = NL80211_MAX_SUPP_HT_RATES },
6093 };
6094
6095 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
6096                                        struct genl_info *info)
6097 {
6098         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
6099         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6100         struct cfg80211_bitrate_mask mask;
6101         int rem, i;
6102         struct net_device *dev = info->user_ptr[1];
6103         struct nlattr *tx_rates;
6104         struct ieee80211_supported_band *sband;
6105
6106         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
6107                 return -EINVAL;
6108
6109         if (!rdev->ops->set_bitrate_mask)
6110                 return -EOPNOTSUPP;
6111
6112         memset(&mask, 0, sizeof(mask));
6113         /* Default to all rates enabled */
6114         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
6115                 sband = rdev->wiphy.bands[i];
6116                 mask.control[i].legacy =
6117                         sband ? (1 << sband->n_bitrates) - 1 : 0;
6118                 if (sband)
6119                         memcpy(mask.control[i].mcs,
6120                                sband->ht_cap.mcs.rx_mask,
6121                                sizeof(mask.control[i].mcs));
6122                 else
6123                         memset(mask.control[i].mcs, 0,
6124                                sizeof(mask.control[i].mcs));
6125         }
6126
6127         /*
6128          * The nested attribute uses enum nl80211_band as the index. This maps
6129          * directly to the enum ieee80211_band values used in cfg80211.
6130          */
6131         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
6132         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
6133         {
6134                 enum ieee80211_band band = nla_type(tx_rates);
6135                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
6136                         return -EINVAL;
6137                 sband = rdev->wiphy.bands[band];
6138                 if (sband == NULL)
6139                         return -EINVAL;
6140                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
6141                           nla_len(tx_rates), nl80211_txattr_policy);
6142                 if (tb[NL80211_TXRATE_LEGACY]) {
6143                         mask.control[band].legacy = rateset_to_mask(
6144                                 sband,
6145                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
6146                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
6147                         if ((mask.control[band].legacy == 0) &&
6148                             nla_len(tb[NL80211_TXRATE_LEGACY]))
6149                                 return -EINVAL;
6150                 }
6151                 if (tb[NL80211_TXRATE_MCS]) {
6152                         if (!ht_rateset_to_mask(
6153                                         sband,
6154                                         nla_data(tb[NL80211_TXRATE_MCS]),
6155                                         nla_len(tb[NL80211_TXRATE_MCS]),
6156                                         mask.control[band].mcs))
6157                                 return -EINVAL;
6158                 }
6159
6160                 if (mask.control[band].legacy == 0) {
6161                         /* don't allow empty legacy rates if HT
6162                          * is not even supported. */
6163                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
6164                                 return -EINVAL;
6165
6166                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
6167                                 if (mask.control[band].mcs[i])
6168                                         break;
6169
6170                         /* legacy and mcs rates may not be both empty */
6171                         if (i == IEEE80211_HT_MCS_MASK_LEN)
6172                                 return -EINVAL;
6173                 }
6174         }
6175
6176         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
6177 }
6178
6179 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
6180 {
6181         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6182         struct wireless_dev *wdev = info->user_ptr[1];
6183         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
6184
6185         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
6186                 return -EINVAL;
6187
6188         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
6189                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
6190
6191         switch (wdev->iftype) {
6192         case NL80211_IFTYPE_STATION:
6193         case NL80211_IFTYPE_ADHOC:
6194         case NL80211_IFTYPE_P2P_CLIENT:
6195         case NL80211_IFTYPE_AP:
6196         case NL80211_IFTYPE_AP_VLAN:
6197         case NL80211_IFTYPE_MESH_POINT:
6198         case NL80211_IFTYPE_P2P_GO:
6199         case NL80211_IFTYPE_P2P_DEVICE:
6200                 break;
6201         default:
6202                 return -EOPNOTSUPP;
6203         }
6204
6205         /* not much point in registering if we can't reply */
6206         if (!rdev->ops->mgmt_tx)
6207                 return -EOPNOTSUPP;
6208
6209         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
6210                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
6211                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
6212 }
6213
6214 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
6215 {
6216         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6217         struct wireless_dev *wdev = info->user_ptr[1];
6218         struct ieee80211_channel *chan;
6219         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
6220         bool channel_type_valid = false;
6221         u32 freq;
6222         int err;
6223         void *hdr = NULL;
6224         u64 cookie;
6225         struct sk_buff *msg = NULL;
6226         unsigned int wait = 0;
6227         bool offchan, no_cck, dont_wait_for_ack;
6228
6229         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
6230
6231         if (!info->attrs[NL80211_ATTR_FRAME] ||
6232             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6233                 return -EINVAL;
6234
6235         if (!rdev->ops->mgmt_tx)
6236                 return -EOPNOTSUPP;
6237
6238         switch (wdev->iftype) {
6239         case NL80211_IFTYPE_STATION:
6240         case NL80211_IFTYPE_ADHOC:
6241         case NL80211_IFTYPE_P2P_CLIENT:
6242         case NL80211_IFTYPE_AP:
6243         case NL80211_IFTYPE_AP_VLAN:
6244         case NL80211_IFTYPE_MESH_POINT:
6245         case NL80211_IFTYPE_P2P_GO:
6246         case NL80211_IFTYPE_P2P_DEVICE:
6247                 break;
6248         default:
6249                 return -EOPNOTSUPP;
6250         }
6251
6252         if (info->attrs[NL80211_ATTR_DURATION]) {
6253                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6254                         return -EINVAL;
6255                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6256
6257                 /*
6258                  * We should wait on the channel for at least a minimum amount
6259                  * of time (10ms) but no longer than the driver supports.
6260                  */
6261                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6262                     wait > rdev->wiphy.max_remain_on_channel_duration)
6263                         return -EINVAL;
6264
6265         }
6266
6267         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
6268                 if (!nl80211_valid_channel_type(info, &channel_type))
6269                         return -EINVAL;
6270                 channel_type_valid = true;
6271         }
6272
6273         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
6274
6275         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6276                 return -EINVAL;
6277
6278         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6279
6280         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6281         chan = rdev_freq_to_chan(rdev, freq, channel_type);
6282         if (chan == NULL)
6283                 return -EINVAL;
6284
6285         if (!dont_wait_for_ack) {
6286                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6287                 if (!msg)
6288                         return -ENOMEM;
6289
6290                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6291                                      NL80211_CMD_FRAME);
6292
6293                 if (IS_ERR(hdr)) {
6294                         err = PTR_ERR(hdr);
6295                         goto free_msg;
6296                 }
6297         }
6298
6299         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chan, offchan, channel_type,
6300                                     channel_type_valid, wait,
6301                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
6302                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
6303                                     no_cck, dont_wait_for_ack, &cookie);
6304         if (err)
6305                 goto free_msg;
6306
6307         if (msg) {
6308                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6309                         goto nla_put_failure;
6310
6311                 genlmsg_end(msg, hdr);
6312                 return genlmsg_reply(msg, info);
6313         }
6314
6315         return 0;
6316
6317  nla_put_failure:
6318         err = -ENOBUFS;
6319  free_msg:
6320         nlmsg_free(msg);
6321         return err;
6322 }
6323
6324 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
6325 {
6326         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6327         struct wireless_dev *wdev = info->user_ptr[1];
6328         u64 cookie;
6329
6330         if (!info->attrs[NL80211_ATTR_COOKIE])
6331                 return -EINVAL;
6332
6333         if (!rdev->ops->mgmt_tx_cancel_wait)
6334                 return -EOPNOTSUPP;
6335
6336         switch (wdev->iftype) {
6337         case NL80211_IFTYPE_STATION:
6338         case NL80211_IFTYPE_ADHOC:
6339         case NL80211_IFTYPE_P2P_CLIENT:
6340         case NL80211_IFTYPE_AP:
6341         case NL80211_IFTYPE_AP_VLAN:
6342         case NL80211_IFTYPE_P2P_GO:
6343         case NL80211_IFTYPE_P2P_DEVICE:
6344                 break;
6345         default:
6346                 return -EOPNOTSUPP;
6347         }
6348
6349         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6350
6351         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
6352 }
6353
6354 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
6355 {
6356         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6357         struct wireless_dev *wdev;
6358         struct net_device *dev = info->user_ptr[1];
6359         u8 ps_state;
6360         bool state;
6361         int err;
6362
6363         if (!info->attrs[NL80211_ATTR_PS_STATE])
6364                 return -EINVAL;
6365
6366         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
6367
6368         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
6369                 return -EINVAL;
6370
6371         wdev = dev->ieee80211_ptr;
6372
6373         if (!rdev->ops->set_power_mgmt)
6374                 return -EOPNOTSUPP;
6375
6376         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
6377
6378         if (state == wdev->ps)
6379                 return 0;
6380
6381         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
6382         if (!err)
6383                 wdev->ps = state;
6384         return err;
6385 }
6386
6387 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
6388 {
6389         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6390         enum nl80211_ps_state ps_state;
6391         struct wireless_dev *wdev;
6392         struct net_device *dev = info->user_ptr[1];
6393         struct sk_buff *msg;
6394         void *hdr;
6395         int err;
6396
6397         wdev = dev->ieee80211_ptr;
6398
6399         if (!rdev->ops->set_power_mgmt)
6400                 return -EOPNOTSUPP;
6401
6402         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6403         if (!msg)
6404                 return -ENOMEM;
6405
6406         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6407                              NL80211_CMD_GET_POWER_SAVE);
6408         if (!hdr) {
6409                 err = -ENOBUFS;
6410                 goto free_msg;
6411         }
6412
6413         if (wdev->ps)
6414                 ps_state = NL80211_PS_ENABLED;
6415         else
6416                 ps_state = NL80211_PS_DISABLED;
6417
6418         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
6419                 goto nla_put_failure;
6420
6421         genlmsg_end(msg, hdr);
6422         return genlmsg_reply(msg, info);
6423
6424  nla_put_failure:
6425         err = -ENOBUFS;
6426  free_msg:
6427         nlmsg_free(msg);
6428         return err;
6429 }
6430
6431 static struct nla_policy
6432 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
6433         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
6434         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
6435         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
6436         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
6437         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
6438         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
6439 };
6440
6441 static int nl80211_set_cqm_txe(struct genl_info *info,
6442                                 u32 rate, u32 pkts, u32 intvl)
6443 {
6444         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6445         struct wireless_dev *wdev;
6446         struct net_device *dev = info->user_ptr[1];
6447
6448         if ((rate < 0 || rate > 100) ||
6449             (intvl < 0 || intvl > NL80211_CQM_TXE_MAX_INTVL))
6450                 return -EINVAL;
6451
6452         wdev = dev->ieee80211_ptr;
6453
6454         if (!rdev->ops->set_cqm_txe_config)
6455                 return -EOPNOTSUPP;
6456
6457         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6458             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6459                 return -EOPNOTSUPP;
6460
6461         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
6462 }
6463
6464 static int nl80211_set_cqm_rssi(struct genl_info *info,
6465                                 s32 threshold, u32 hysteresis)
6466 {
6467         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6468         struct wireless_dev *wdev;
6469         struct net_device *dev = info->user_ptr[1];
6470
6471         if (threshold > 0)
6472                 return -EINVAL;
6473
6474         wdev = dev->ieee80211_ptr;
6475
6476         if (!rdev->ops->set_cqm_rssi_config)
6477                 return -EOPNOTSUPP;
6478
6479         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6480             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6481                 return -EOPNOTSUPP;
6482
6483         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
6484 }
6485
6486 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
6487 {
6488         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
6489         struct nlattr *cqm;
6490         int err;
6491
6492         cqm = info->attrs[NL80211_ATTR_CQM];
6493         if (!cqm) {
6494                 err = -EINVAL;
6495                 goto out;
6496         }
6497
6498         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
6499                                nl80211_attr_cqm_policy);
6500         if (err)
6501                 goto out;
6502
6503         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
6504             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
6505                 s32 threshold;
6506                 u32 hysteresis;
6507                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
6508                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
6509                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
6510         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
6511                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
6512                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
6513                 u32 rate, pkts, intvl;
6514                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
6515                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
6516                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
6517                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
6518         } else
6519                 err = -EINVAL;
6520
6521 out:
6522         return err;
6523 }
6524
6525 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
6526 {
6527         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6528         struct net_device *dev = info->user_ptr[1];
6529         struct mesh_config cfg;
6530         struct mesh_setup setup;
6531         int err;
6532
6533         /* start with default */
6534         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
6535         memcpy(&setup, &default_mesh_setup, sizeof(setup));
6536
6537         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
6538                 /* and parse parameters if given */
6539                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
6540                 if (err)
6541                         return err;
6542         }
6543
6544         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
6545             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
6546                 return -EINVAL;
6547
6548         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
6549         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
6550
6551         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6552             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
6553                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6554                         return -EINVAL;
6555
6556         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
6557                 /* parse additional setup parameters if given */
6558                 err = nl80211_parse_mesh_setup(info, &setup);
6559                 if (err)
6560                         return err;
6561         }
6562
6563         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6564                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
6565
6566                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
6567                     !nl80211_valid_channel_type(info, &channel_type))
6568                         return -EINVAL;
6569
6570                 setup.channel = rdev_freq_to_chan(rdev,
6571                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
6572                         channel_type);
6573                 if (!setup.channel)
6574                         return -EINVAL;
6575                 setup.channel_type = channel_type;
6576         } else {
6577                 /* cfg80211_join_mesh() will sort it out */
6578                 setup.channel = NULL;
6579         }
6580
6581         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
6582 }
6583
6584 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
6585 {
6586         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6587         struct net_device *dev = info->user_ptr[1];
6588
6589         return cfg80211_leave_mesh(rdev, dev);
6590 }
6591
6592 #ifdef CONFIG_PM
6593 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
6594 {
6595         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6596         struct sk_buff *msg;
6597         void *hdr;
6598
6599         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6600                 return -EOPNOTSUPP;
6601
6602         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6603         if (!msg)
6604                 return -ENOMEM;
6605
6606         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6607                              NL80211_CMD_GET_WOWLAN);
6608         if (!hdr)
6609                 goto nla_put_failure;
6610
6611         if (rdev->wowlan) {
6612                 struct nlattr *nl_wowlan;
6613
6614                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
6615                 if (!nl_wowlan)
6616                         goto nla_put_failure;
6617
6618                 if ((rdev->wowlan->any &&
6619                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
6620                     (rdev->wowlan->disconnect &&
6621                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
6622                     (rdev->wowlan->magic_pkt &&
6623                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
6624                     (rdev->wowlan->gtk_rekey_failure &&
6625                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
6626                     (rdev->wowlan->eap_identity_req &&
6627                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
6628                     (rdev->wowlan->four_way_handshake &&
6629                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
6630                     (rdev->wowlan->rfkill_release &&
6631                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
6632                         goto nla_put_failure;
6633                 if (rdev->wowlan->n_patterns) {
6634                         struct nlattr *nl_pats, *nl_pat;
6635                         int i, pat_len;
6636
6637                         nl_pats = nla_nest_start(msg,
6638                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
6639                         if (!nl_pats)
6640                                 goto nla_put_failure;
6641
6642                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
6643                                 nl_pat = nla_nest_start(msg, i + 1);
6644                                 if (!nl_pat)
6645                                         goto nla_put_failure;
6646                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
6647                                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
6648                                             DIV_ROUND_UP(pat_len, 8),
6649                                             rdev->wowlan->patterns[i].mask) ||
6650                                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
6651                                             pat_len,
6652                                             rdev->wowlan->patterns[i].pattern))
6653                                         goto nla_put_failure;
6654                                 nla_nest_end(msg, nl_pat);
6655                         }
6656                         nla_nest_end(msg, nl_pats);
6657                 }
6658
6659                 nla_nest_end(msg, nl_wowlan);
6660         }
6661
6662         genlmsg_end(msg, hdr);
6663         return genlmsg_reply(msg, info);
6664
6665 nla_put_failure:
6666         nlmsg_free(msg);
6667         return -ENOBUFS;
6668 }
6669
6670 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
6671 {
6672         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6673         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
6674         struct cfg80211_wowlan new_triggers = {};
6675         struct cfg80211_wowlan *ntrig;
6676         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
6677         int err, i;
6678         bool prev_enabled = rdev->wowlan;
6679
6680         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6681                 return -EOPNOTSUPP;
6682
6683         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
6684                 cfg80211_rdev_free_wowlan(rdev);
6685                 rdev->wowlan = NULL;
6686                 goto set_wakeup;
6687         }
6688
6689         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
6690                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6691                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6692                         nl80211_wowlan_policy);
6693         if (err)
6694                 return err;
6695
6696         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
6697                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
6698                         return -EINVAL;
6699                 new_triggers.any = true;
6700         }
6701
6702         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
6703                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
6704                         return -EINVAL;
6705                 new_triggers.disconnect = true;
6706         }
6707
6708         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
6709                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
6710                         return -EINVAL;
6711                 new_triggers.magic_pkt = true;
6712         }
6713
6714         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
6715                 return -EINVAL;
6716
6717         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
6718                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
6719                         return -EINVAL;
6720                 new_triggers.gtk_rekey_failure = true;
6721         }
6722
6723         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
6724                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
6725                         return -EINVAL;
6726                 new_triggers.eap_identity_req = true;
6727         }
6728
6729         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
6730                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
6731                         return -EINVAL;
6732                 new_triggers.four_way_handshake = true;
6733         }
6734
6735         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
6736                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
6737                         return -EINVAL;
6738                 new_triggers.rfkill_release = true;
6739         }
6740
6741         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
6742                 struct nlattr *pat;
6743                 int n_patterns = 0;
6744                 int rem, pat_len, mask_len;
6745                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
6746
6747                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6748                                     rem)
6749                         n_patterns++;
6750                 if (n_patterns > wowlan->n_patterns)
6751                         return -EINVAL;
6752
6753                 new_triggers.patterns = kcalloc(n_patterns,
6754                                                 sizeof(new_triggers.patterns[0]),
6755                                                 GFP_KERNEL);
6756                 if (!new_triggers.patterns)
6757                         return -ENOMEM;
6758
6759                 new_triggers.n_patterns = n_patterns;
6760                 i = 0;
6761
6762                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6763                                     rem) {
6764                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
6765                                   nla_data(pat), nla_len(pat), NULL);
6766                         err = -EINVAL;
6767                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
6768                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
6769                                 goto error;
6770                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
6771                         mask_len = DIV_ROUND_UP(pat_len, 8);
6772                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
6773                             mask_len)
6774                                 goto error;
6775                         if (pat_len > wowlan->pattern_max_len ||
6776                             pat_len < wowlan->pattern_min_len)
6777                                 goto error;
6778
6779                         new_triggers.patterns[i].mask =
6780                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
6781                         if (!new_triggers.patterns[i].mask) {
6782                                 err = -ENOMEM;
6783                                 goto error;
6784                         }
6785                         new_triggers.patterns[i].pattern =
6786                                 new_triggers.patterns[i].mask + mask_len;
6787                         memcpy(new_triggers.patterns[i].mask,
6788                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
6789                                mask_len);
6790                         new_triggers.patterns[i].pattern_len = pat_len;
6791                         memcpy(new_triggers.patterns[i].pattern,
6792                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
6793                                pat_len);
6794                         i++;
6795                 }
6796         }
6797
6798         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
6799         if (!ntrig) {
6800                 err = -ENOMEM;
6801                 goto error;
6802         }
6803         cfg80211_rdev_free_wowlan(rdev);
6804         rdev->wowlan = ntrig;
6805
6806  set_wakeup:
6807         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
6808                 rdev_set_wakeup(rdev, rdev->wowlan);
6809
6810         return 0;
6811  error:
6812         for (i = 0; i < new_triggers.n_patterns; i++)
6813                 kfree(new_triggers.patterns[i].mask);
6814         kfree(new_triggers.patterns);
6815         return err;
6816 }
6817 #endif
6818
6819 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
6820 {
6821         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6822         struct net_device *dev = info->user_ptr[1];
6823         struct wireless_dev *wdev = dev->ieee80211_ptr;
6824         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
6825         struct cfg80211_gtk_rekey_data rekey_data;
6826         int err;
6827
6828         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
6829                 return -EINVAL;
6830
6831         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
6832                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
6833                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
6834                         nl80211_rekey_policy);
6835         if (err)
6836                 return err;
6837
6838         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
6839                 return -ERANGE;
6840         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
6841                 return -ERANGE;
6842         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
6843                 return -ERANGE;
6844
6845         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
6846                NL80211_KEK_LEN);
6847         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
6848                NL80211_KCK_LEN);
6849         memcpy(rekey_data.replay_ctr,
6850                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
6851                NL80211_REPLAY_CTR_LEN);
6852
6853         wdev_lock(wdev);
6854         if (!wdev->current_bss) {
6855                 err = -ENOTCONN;
6856                 goto out;
6857         }
6858
6859         if (!rdev->ops->set_rekey_data) {
6860                 err = -EOPNOTSUPP;
6861                 goto out;
6862         }
6863
6864         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
6865  out:
6866         wdev_unlock(wdev);
6867         return err;
6868 }
6869
6870 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
6871                                              struct genl_info *info)
6872 {
6873         struct net_device *dev = info->user_ptr[1];
6874         struct wireless_dev *wdev = dev->ieee80211_ptr;
6875
6876         if (wdev->iftype != NL80211_IFTYPE_AP &&
6877             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6878                 return -EINVAL;
6879
6880         if (wdev->ap_unexpected_nlportid)
6881                 return -EBUSY;
6882
6883         wdev->ap_unexpected_nlportid = info->snd_portid;
6884         return 0;
6885 }
6886
6887 static int nl80211_probe_client(struct sk_buff *skb,
6888                                 struct genl_info *info)
6889 {
6890         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6891         struct net_device *dev = info->user_ptr[1];
6892         struct wireless_dev *wdev = dev->ieee80211_ptr;
6893         struct sk_buff *msg;
6894         void *hdr;
6895         const u8 *addr;
6896         u64 cookie;
6897         int err;
6898
6899         if (wdev->iftype != NL80211_IFTYPE_AP &&
6900             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6901                 return -EOPNOTSUPP;
6902
6903         if (!info->attrs[NL80211_ATTR_MAC])
6904                 return -EINVAL;
6905
6906         if (!rdev->ops->probe_client)
6907                 return -EOPNOTSUPP;
6908
6909         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6910         if (!msg)
6911                 return -ENOMEM;
6912
6913         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6914                              NL80211_CMD_PROBE_CLIENT);
6915
6916         if (IS_ERR(hdr)) {
6917                 err = PTR_ERR(hdr);
6918                 goto free_msg;
6919         }
6920
6921         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6922
6923         err = rdev_probe_client(rdev, dev, addr, &cookie);
6924         if (err)
6925                 goto free_msg;
6926
6927         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6928                 goto nla_put_failure;
6929
6930         genlmsg_end(msg, hdr);
6931
6932         return genlmsg_reply(msg, info);
6933
6934  nla_put_failure:
6935         err = -ENOBUFS;
6936  free_msg:
6937         nlmsg_free(msg);
6938         return err;
6939 }
6940
6941 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
6942 {
6943         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6944         struct cfg80211_beacon_registration *reg, *nreg;
6945         int rv;
6946
6947         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
6948                 return -EOPNOTSUPP;
6949
6950         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
6951         if (!nreg)
6952                 return -ENOMEM;
6953
6954         /* First, check if already registered. */
6955         spin_lock_bh(&rdev->beacon_registrations_lock);
6956         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
6957                 if (reg->nlportid == info->snd_portid) {
6958                         rv = -EALREADY;
6959                         goto out_err;
6960                 }
6961         }
6962         /* Add it to the list */
6963         nreg->nlportid = info->snd_portid;
6964         list_add(&nreg->list, &rdev->beacon_registrations);
6965
6966         spin_unlock_bh(&rdev->beacon_registrations_lock);
6967
6968         return 0;
6969 out_err:
6970         spin_unlock_bh(&rdev->beacon_registrations_lock);
6971         kfree(nreg);
6972         return rv;
6973 }
6974
6975 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
6976 {
6977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6978         struct wireless_dev *wdev = info->user_ptr[1];
6979         int err;
6980
6981         if (!rdev->ops->start_p2p_device)
6982                 return -EOPNOTSUPP;
6983
6984         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
6985                 return -EOPNOTSUPP;
6986
6987         if (wdev->p2p_started)
6988                 return 0;
6989
6990         mutex_lock(&rdev->devlist_mtx);
6991         err = cfg80211_can_add_interface(rdev, wdev->iftype);
6992         mutex_unlock(&rdev->devlist_mtx);
6993         if (err)
6994                 return err;
6995
6996         err = rdev_start_p2p_device(rdev, wdev);
6997         if (err)
6998                 return err;
6999
7000         wdev->p2p_started = true;
7001         mutex_lock(&rdev->devlist_mtx);
7002         rdev->opencount++;
7003         mutex_unlock(&rdev->devlist_mtx);
7004
7005         return 0;
7006 }
7007
7008 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
7009 {
7010         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7011         struct wireless_dev *wdev = info->user_ptr[1];
7012
7013         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
7014                 return -EOPNOTSUPP;
7015
7016         if (!rdev->ops->stop_p2p_device)
7017                 return -EOPNOTSUPP;
7018
7019         if (!wdev->p2p_started)
7020                 return 0;
7021
7022         rdev_stop_p2p_device(rdev, wdev);
7023         wdev->p2p_started = false;
7024
7025         mutex_lock(&rdev->devlist_mtx);
7026         rdev->opencount--;
7027         mutex_unlock(&rdev->devlist_mtx);
7028
7029         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
7030                 rdev->scan_req->aborted = true;
7031                 ___cfg80211_scan_done(rdev, true);
7032         }
7033
7034         return 0;
7035 }
7036
7037 #define NL80211_FLAG_NEED_WIPHY         0x01
7038 #define NL80211_FLAG_NEED_NETDEV        0x02
7039 #define NL80211_FLAG_NEED_RTNL          0x04
7040 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
7041 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
7042                                          NL80211_FLAG_CHECK_NETDEV_UP)
7043 #define NL80211_FLAG_NEED_WDEV          0x10
7044 /* If a netdev is associated, it must be UP, P2P must be started */
7045 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
7046                                          NL80211_FLAG_CHECK_NETDEV_UP)
7047
7048 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
7049                             struct genl_info *info)
7050 {
7051         struct cfg80211_registered_device *rdev;
7052         struct wireless_dev *wdev;
7053         struct net_device *dev;
7054         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
7055
7056         if (rtnl)
7057                 rtnl_lock();
7058
7059         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
7060                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7061                 if (IS_ERR(rdev)) {
7062                         if (rtnl)
7063                                 rtnl_unlock();
7064                         return PTR_ERR(rdev);
7065                 }
7066                 info->user_ptr[0] = rdev;
7067         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
7068                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7069                 mutex_lock(&cfg80211_mutex);
7070                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
7071                                                   info->attrs);
7072                 if (IS_ERR(wdev)) {
7073                         mutex_unlock(&cfg80211_mutex);
7074                         if (rtnl)
7075                                 rtnl_unlock();
7076                         return PTR_ERR(wdev);
7077                 }
7078
7079                 dev = wdev->netdev;
7080                 rdev = wiphy_to_dev(wdev->wiphy);
7081
7082                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
7083                         if (!dev) {
7084                                 mutex_unlock(&cfg80211_mutex);
7085                                 if (rtnl)
7086                                         rtnl_unlock();
7087                                 return -EINVAL;
7088                         }
7089
7090                         info->user_ptr[1] = dev;
7091                 } else {
7092                         info->user_ptr[1] = wdev;
7093                 }
7094
7095                 if (dev) {
7096                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
7097                             !netif_running(dev)) {
7098                                 mutex_unlock(&cfg80211_mutex);
7099                                 if (rtnl)
7100                                         rtnl_unlock();
7101                                 return -ENETDOWN;
7102                         }
7103
7104                         dev_hold(dev);
7105                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
7106                         if (!wdev->p2p_started) {
7107                                 mutex_unlock(&cfg80211_mutex);
7108                                 if (rtnl)
7109                                         rtnl_unlock();
7110                                 return -ENETDOWN;
7111                         }
7112                 }
7113
7114                 cfg80211_lock_rdev(rdev);
7115
7116                 mutex_unlock(&cfg80211_mutex);
7117
7118                 info->user_ptr[0] = rdev;
7119         }
7120
7121         return 0;
7122 }
7123
7124 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
7125                               struct genl_info *info)
7126 {
7127         if (info->user_ptr[0])
7128                 cfg80211_unlock_rdev(info->user_ptr[0]);
7129         if (info->user_ptr[1]) {
7130                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7131                         struct wireless_dev *wdev = info->user_ptr[1];
7132
7133                         if (wdev->netdev)
7134                                 dev_put(wdev->netdev);
7135                 } else {
7136                         dev_put(info->user_ptr[1]);
7137                 }
7138         }
7139         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
7140                 rtnl_unlock();
7141 }
7142
7143 static struct genl_ops nl80211_ops[] = {
7144         {
7145                 .cmd = NL80211_CMD_GET_WIPHY,
7146                 .doit = nl80211_get_wiphy,
7147                 .dumpit = nl80211_dump_wiphy,
7148                 .policy = nl80211_policy,
7149                 /* can be retrieved by unprivileged users */
7150                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
7151         },
7152         {
7153                 .cmd = NL80211_CMD_SET_WIPHY,
7154                 .doit = nl80211_set_wiphy,
7155                 .policy = nl80211_policy,
7156                 .flags = GENL_ADMIN_PERM,
7157                 .internal_flags = NL80211_FLAG_NEED_RTNL,
7158         },
7159         {
7160                 .cmd = NL80211_CMD_GET_INTERFACE,
7161                 .doit = nl80211_get_interface,
7162                 .dumpit = nl80211_dump_interface,
7163                 .policy = nl80211_policy,
7164                 /* can be retrieved by unprivileged users */
7165                 .internal_flags = NL80211_FLAG_NEED_WDEV,
7166         },
7167         {
7168                 .cmd = NL80211_CMD_SET_INTERFACE,
7169                 .doit = nl80211_set_interface,
7170                 .policy = nl80211_policy,
7171                 .flags = GENL_ADMIN_PERM,
7172                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7173                                   NL80211_FLAG_NEED_RTNL,
7174         },
7175         {
7176                 .cmd = NL80211_CMD_NEW_INTERFACE,
7177                 .doit = nl80211_new_interface,
7178                 .policy = nl80211_policy,
7179                 .flags = GENL_ADMIN_PERM,
7180                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7181                                   NL80211_FLAG_NEED_RTNL,
7182         },
7183         {
7184                 .cmd = NL80211_CMD_DEL_INTERFACE,
7185                 .doit = nl80211_del_interface,
7186                 .policy = nl80211_policy,
7187                 .flags = GENL_ADMIN_PERM,
7188                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7189                                   NL80211_FLAG_NEED_RTNL,
7190         },
7191         {
7192                 .cmd = NL80211_CMD_GET_KEY,
7193                 .doit = nl80211_get_key,
7194                 .policy = nl80211_policy,
7195                 .flags = GENL_ADMIN_PERM,
7196                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7197                                   NL80211_FLAG_NEED_RTNL,
7198         },
7199         {
7200                 .cmd = NL80211_CMD_SET_KEY,
7201                 .doit = nl80211_set_key,
7202                 .policy = nl80211_policy,
7203                 .flags = GENL_ADMIN_PERM,
7204                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7205                                   NL80211_FLAG_NEED_RTNL,
7206         },
7207         {
7208                 .cmd = NL80211_CMD_NEW_KEY,
7209                 .doit = nl80211_new_key,
7210                 .policy = nl80211_policy,
7211                 .flags = GENL_ADMIN_PERM,
7212                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7213                                   NL80211_FLAG_NEED_RTNL,
7214         },
7215         {
7216                 .cmd = NL80211_CMD_DEL_KEY,
7217                 .doit = nl80211_del_key,
7218                 .policy = nl80211_policy,
7219                 .flags = GENL_ADMIN_PERM,
7220                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7221                                   NL80211_FLAG_NEED_RTNL,
7222         },
7223         {
7224                 .cmd = NL80211_CMD_SET_BEACON,
7225                 .policy = nl80211_policy,
7226                 .flags = GENL_ADMIN_PERM,
7227                 .doit = nl80211_set_beacon,
7228                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7229                                   NL80211_FLAG_NEED_RTNL,
7230         },
7231         {
7232                 .cmd = NL80211_CMD_START_AP,
7233                 .policy = nl80211_policy,
7234                 .flags = GENL_ADMIN_PERM,
7235                 .doit = nl80211_start_ap,
7236                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7237                                   NL80211_FLAG_NEED_RTNL,
7238         },
7239         {
7240                 .cmd = NL80211_CMD_STOP_AP,
7241                 .policy = nl80211_policy,
7242                 .flags = GENL_ADMIN_PERM,
7243                 .doit = nl80211_stop_ap,
7244                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7245                                   NL80211_FLAG_NEED_RTNL,
7246         },
7247         {
7248                 .cmd = NL80211_CMD_GET_STATION,
7249                 .doit = nl80211_get_station,
7250                 .dumpit = nl80211_dump_station,
7251                 .policy = nl80211_policy,
7252                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7253                                   NL80211_FLAG_NEED_RTNL,
7254         },
7255         {
7256                 .cmd = NL80211_CMD_SET_STATION,
7257                 .doit = nl80211_set_station,
7258                 .policy = nl80211_policy,
7259                 .flags = GENL_ADMIN_PERM,
7260                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7261                                   NL80211_FLAG_NEED_RTNL,
7262         },
7263         {
7264                 .cmd = NL80211_CMD_NEW_STATION,
7265                 .doit = nl80211_new_station,
7266                 .policy = nl80211_policy,
7267                 .flags = GENL_ADMIN_PERM,
7268                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7269                                   NL80211_FLAG_NEED_RTNL,
7270         },
7271         {
7272                 .cmd = NL80211_CMD_DEL_STATION,
7273                 .doit = nl80211_del_station,
7274                 .policy = nl80211_policy,
7275                 .flags = GENL_ADMIN_PERM,
7276                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7277                                   NL80211_FLAG_NEED_RTNL,
7278         },
7279         {
7280                 .cmd = NL80211_CMD_GET_MPATH,
7281                 .doit = nl80211_get_mpath,
7282                 .dumpit = nl80211_dump_mpath,
7283                 .policy = nl80211_policy,
7284                 .flags = GENL_ADMIN_PERM,
7285                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7286                                   NL80211_FLAG_NEED_RTNL,
7287         },
7288         {
7289                 .cmd = NL80211_CMD_SET_MPATH,
7290                 .doit = nl80211_set_mpath,
7291                 .policy = nl80211_policy,
7292                 .flags = GENL_ADMIN_PERM,
7293                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7294                                   NL80211_FLAG_NEED_RTNL,
7295         },
7296         {
7297                 .cmd = NL80211_CMD_NEW_MPATH,
7298                 .doit = nl80211_new_mpath,
7299                 .policy = nl80211_policy,
7300                 .flags = GENL_ADMIN_PERM,
7301                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7302                                   NL80211_FLAG_NEED_RTNL,
7303         },
7304         {
7305                 .cmd = NL80211_CMD_DEL_MPATH,
7306                 .doit = nl80211_del_mpath,
7307                 .policy = nl80211_policy,
7308                 .flags = GENL_ADMIN_PERM,
7309                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7310                                   NL80211_FLAG_NEED_RTNL,
7311         },
7312         {
7313                 .cmd = NL80211_CMD_SET_BSS,
7314                 .doit = nl80211_set_bss,
7315                 .policy = nl80211_policy,
7316                 .flags = GENL_ADMIN_PERM,
7317                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7318                                   NL80211_FLAG_NEED_RTNL,
7319         },
7320         {
7321                 .cmd = NL80211_CMD_GET_REG,
7322                 .doit = nl80211_get_reg,
7323                 .policy = nl80211_policy,
7324                 /* can be retrieved by unprivileged users */
7325         },
7326         {
7327                 .cmd = NL80211_CMD_SET_REG,
7328                 .doit = nl80211_set_reg,
7329                 .policy = nl80211_policy,
7330                 .flags = GENL_ADMIN_PERM,
7331         },
7332         {
7333                 .cmd = NL80211_CMD_REQ_SET_REG,
7334                 .doit = nl80211_req_set_reg,
7335                 .policy = nl80211_policy,
7336                 .flags = GENL_ADMIN_PERM,
7337         },
7338         {
7339                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
7340                 .doit = nl80211_get_mesh_config,
7341                 .policy = nl80211_policy,
7342                 /* can be retrieved by unprivileged users */
7343                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7344                                   NL80211_FLAG_NEED_RTNL,
7345         },
7346         {
7347                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
7348                 .doit = nl80211_update_mesh_config,
7349                 .policy = nl80211_policy,
7350                 .flags = GENL_ADMIN_PERM,
7351                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7352                                   NL80211_FLAG_NEED_RTNL,
7353         },
7354         {
7355                 .cmd = NL80211_CMD_TRIGGER_SCAN,
7356                 .doit = nl80211_trigger_scan,
7357                 .policy = nl80211_policy,
7358                 .flags = GENL_ADMIN_PERM,
7359                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7360                                   NL80211_FLAG_NEED_RTNL,
7361         },
7362         {
7363                 .cmd = NL80211_CMD_GET_SCAN,
7364                 .policy = nl80211_policy,
7365                 .dumpit = nl80211_dump_scan,
7366         },
7367         {
7368                 .cmd = NL80211_CMD_START_SCHED_SCAN,
7369                 .doit = nl80211_start_sched_scan,
7370                 .policy = nl80211_policy,
7371                 .flags = GENL_ADMIN_PERM,
7372                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7373                                   NL80211_FLAG_NEED_RTNL,
7374         },
7375         {
7376                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
7377                 .doit = nl80211_stop_sched_scan,
7378                 .policy = nl80211_policy,
7379                 .flags = GENL_ADMIN_PERM,
7380                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7381                                   NL80211_FLAG_NEED_RTNL,
7382         },
7383         {
7384                 .cmd = NL80211_CMD_AUTHENTICATE,
7385                 .doit = nl80211_authenticate,
7386                 .policy = nl80211_policy,
7387                 .flags = GENL_ADMIN_PERM,
7388                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7389                                   NL80211_FLAG_NEED_RTNL,
7390         },
7391         {
7392                 .cmd = NL80211_CMD_ASSOCIATE,
7393                 .doit = nl80211_associate,
7394                 .policy = nl80211_policy,
7395                 .flags = GENL_ADMIN_PERM,
7396                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7397                                   NL80211_FLAG_NEED_RTNL,
7398         },
7399         {
7400                 .cmd = NL80211_CMD_DEAUTHENTICATE,
7401                 .doit = nl80211_deauthenticate,
7402                 .policy = nl80211_policy,
7403                 .flags = GENL_ADMIN_PERM,
7404                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7405                                   NL80211_FLAG_NEED_RTNL,
7406         },
7407         {
7408                 .cmd = NL80211_CMD_DISASSOCIATE,
7409                 .doit = nl80211_disassociate,
7410                 .policy = nl80211_policy,
7411                 .flags = GENL_ADMIN_PERM,
7412                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7413                                   NL80211_FLAG_NEED_RTNL,
7414         },
7415         {
7416                 .cmd = NL80211_CMD_JOIN_IBSS,
7417                 .doit = nl80211_join_ibss,
7418                 .policy = nl80211_policy,
7419                 .flags = GENL_ADMIN_PERM,
7420                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7421                                   NL80211_FLAG_NEED_RTNL,
7422         },
7423         {
7424                 .cmd = NL80211_CMD_LEAVE_IBSS,
7425                 .doit = nl80211_leave_ibss,
7426                 .policy = nl80211_policy,
7427                 .flags = GENL_ADMIN_PERM,
7428                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7429                                   NL80211_FLAG_NEED_RTNL,
7430         },
7431 #ifdef CONFIG_NL80211_TESTMODE
7432         {
7433                 .cmd = NL80211_CMD_TESTMODE,
7434                 .doit = nl80211_testmode_do,
7435                 .dumpit = nl80211_testmode_dump,
7436                 .policy = nl80211_policy,
7437                 .flags = GENL_ADMIN_PERM,
7438                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7439                                   NL80211_FLAG_NEED_RTNL,
7440         },
7441 #endif
7442         {
7443                 .cmd = NL80211_CMD_CONNECT,
7444                 .doit = nl80211_connect,
7445                 .policy = nl80211_policy,
7446                 .flags = GENL_ADMIN_PERM,
7447                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7448                                   NL80211_FLAG_NEED_RTNL,
7449         },
7450         {
7451                 .cmd = NL80211_CMD_DISCONNECT,
7452                 .doit = nl80211_disconnect,
7453                 .policy = nl80211_policy,
7454                 .flags = GENL_ADMIN_PERM,
7455                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7456                                   NL80211_FLAG_NEED_RTNL,
7457         },
7458         {
7459                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
7460                 .doit = nl80211_wiphy_netns,
7461                 .policy = nl80211_policy,
7462                 .flags = GENL_ADMIN_PERM,
7463                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7464                                   NL80211_FLAG_NEED_RTNL,
7465         },
7466         {
7467                 .cmd = NL80211_CMD_GET_SURVEY,
7468                 .policy = nl80211_policy,
7469                 .dumpit = nl80211_dump_survey,
7470         },
7471         {
7472                 .cmd = NL80211_CMD_SET_PMKSA,
7473                 .doit = nl80211_setdel_pmksa,
7474                 .policy = nl80211_policy,
7475                 .flags = GENL_ADMIN_PERM,
7476                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7477                                   NL80211_FLAG_NEED_RTNL,
7478         },
7479         {
7480                 .cmd = NL80211_CMD_DEL_PMKSA,
7481                 .doit = nl80211_setdel_pmksa,
7482                 .policy = nl80211_policy,
7483                 .flags = GENL_ADMIN_PERM,
7484                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7485                                   NL80211_FLAG_NEED_RTNL,
7486         },
7487         {
7488                 .cmd = NL80211_CMD_FLUSH_PMKSA,
7489                 .doit = nl80211_flush_pmksa,
7490                 .policy = nl80211_policy,
7491                 .flags = GENL_ADMIN_PERM,
7492                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7493                                   NL80211_FLAG_NEED_RTNL,
7494         },
7495         {
7496                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
7497                 .doit = nl80211_remain_on_channel,
7498                 .policy = nl80211_policy,
7499                 .flags = GENL_ADMIN_PERM,
7500                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7501                                   NL80211_FLAG_NEED_RTNL,
7502         },
7503         {
7504                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
7505                 .doit = nl80211_cancel_remain_on_channel,
7506                 .policy = nl80211_policy,
7507                 .flags = GENL_ADMIN_PERM,
7508                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7509                                   NL80211_FLAG_NEED_RTNL,
7510         },
7511         {
7512                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
7513                 .doit = nl80211_set_tx_bitrate_mask,
7514                 .policy = nl80211_policy,
7515                 .flags = GENL_ADMIN_PERM,
7516                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7517                                   NL80211_FLAG_NEED_RTNL,
7518         },
7519         {
7520                 .cmd = NL80211_CMD_REGISTER_FRAME,
7521                 .doit = nl80211_register_mgmt,
7522                 .policy = nl80211_policy,
7523                 .flags = GENL_ADMIN_PERM,
7524                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7525                                   NL80211_FLAG_NEED_RTNL,
7526         },
7527         {
7528                 .cmd = NL80211_CMD_FRAME,
7529                 .doit = nl80211_tx_mgmt,
7530                 .policy = nl80211_policy,
7531                 .flags = GENL_ADMIN_PERM,
7532                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7533                                   NL80211_FLAG_NEED_RTNL,
7534         },
7535         {
7536                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
7537                 .doit = nl80211_tx_mgmt_cancel_wait,
7538                 .policy = nl80211_policy,
7539                 .flags = GENL_ADMIN_PERM,
7540                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7541                                   NL80211_FLAG_NEED_RTNL,
7542         },
7543         {
7544                 .cmd = NL80211_CMD_SET_POWER_SAVE,
7545                 .doit = nl80211_set_power_save,
7546                 .policy = nl80211_policy,
7547                 .flags = GENL_ADMIN_PERM,
7548                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7549                                   NL80211_FLAG_NEED_RTNL,
7550         },
7551         {
7552                 .cmd = NL80211_CMD_GET_POWER_SAVE,
7553                 .doit = nl80211_get_power_save,
7554                 .policy = nl80211_policy,
7555                 /* can be retrieved by unprivileged users */
7556                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7557                                   NL80211_FLAG_NEED_RTNL,
7558         },
7559         {
7560                 .cmd = NL80211_CMD_SET_CQM,
7561                 .doit = nl80211_set_cqm,
7562                 .policy = nl80211_policy,
7563                 .flags = GENL_ADMIN_PERM,
7564                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7565                                   NL80211_FLAG_NEED_RTNL,
7566         },
7567         {
7568                 .cmd = NL80211_CMD_SET_CHANNEL,
7569                 .doit = nl80211_set_channel,
7570                 .policy = nl80211_policy,
7571                 .flags = GENL_ADMIN_PERM,
7572                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7573                                   NL80211_FLAG_NEED_RTNL,
7574         },
7575         {
7576                 .cmd = NL80211_CMD_SET_WDS_PEER,
7577                 .doit = nl80211_set_wds_peer,
7578                 .policy = nl80211_policy,
7579                 .flags = GENL_ADMIN_PERM,
7580                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7581                                   NL80211_FLAG_NEED_RTNL,
7582         },
7583         {
7584                 .cmd = NL80211_CMD_JOIN_MESH,
7585                 .doit = nl80211_join_mesh,
7586                 .policy = nl80211_policy,
7587                 .flags = GENL_ADMIN_PERM,
7588                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7589                                   NL80211_FLAG_NEED_RTNL,
7590         },
7591         {
7592                 .cmd = NL80211_CMD_LEAVE_MESH,
7593                 .doit = nl80211_leave_mesh,
7594                 .policy = nl80211_policy,
7595                 .flags = GENL_ADMIN_PERM,
7596                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7597                                   NL80211_FLAG_NEED_RTNL,
7598         },
7599 #ifdef CONFIG_PM
7600         {
7601                 .cmd = NL80211_CMD_GET_WOWLAN,
7602                 .doit = nl80211_get_wowlan,
7603                 .policy = nl80211_policy,
7604                 /* can be retrieved by unprivileged users */
7605                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7606                                   NL80211_FLAG_NEED_RTNL,
7607         },
7608         {
7609                 .cmd = NL80211_CMD_SET_WOWLAN,
7610                 .doit = nl80211_set_wowlan,
7611                 .policy = nl80211_policy,
7612                 .flags = GENL_ADMIN_PERM,
7613                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7614                                   NL80211_FLAG_NEED_RTNL,
7615         },
7616 #endif
7617         {
7618                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
7619                 .doit = nl80211_set_rekey_data,
7620                 .policy = nl80211_policy,
7621                 .flags = GENL_ADMIN_PERM,
7622                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7623                                   NL80211_FLAG_NEED_RTNL,
7624         },
7625         {
7626                 .cmd = NL80211_CMD_TDLS_MGMT,
7627                 .doit = nl80211_tdls_mgmt,
7628                 .policy = nl80211_policy,
7629                 .flags = GENL_ADMIN_PERM,
7630                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7631                                   NL80211_FLAG_NEED_RTNL,
7632         },
7633         {
7634                 .cmd = NL80211_CMD_TDLS_OPER,
7635                 .doit = nl80211_tdls_oper,
7636                 .policy = nl80211_policy,
7637                 .flags = GENL_ADMIN_PERM,
7638                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7639                                   NL80211_FLAG_NEED_RTNL,
7640         },
7641         {
7642                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
7643                 .doit = nl80211_register_unexpected_frame,
7644                 .policy = nl80211_policy,
7645                 .flags = GENL_ADMIN_PERM,
7646                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7647                                   NL80211_FLAG_NEED_RTNL,
7648         },
7649         {
7650                 .cmd = NL80211_CMD_PROBE_CLIENT,
7651                 .doit = nl80211_probe_client,
7652                 .policy = nl80211_policy,
7653                 .flags = GENL_ADMIN_PERM,
7654                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7655                                   NL80211_FLAG_NEED_RTNL,
7656         },
7657         {
7658                 .cmd = NL80211_CMD_REGISTER_BEACONS,
7659                 .doit = nl80211_register_beacons,
7660                 .policy = nl80211_policy,
7661                 .flags = GENL_ADMIN_PERM,
7662                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7663                                   NL80211_FLAG_NEED_RTNL,
7664         },
7665         {
7666                 .cmd = NL80211_CMD_SET_NOACK_MAP,
7667                 .doit = nl80211_set_noack_map,
7668                 .policy = nl80211_policy,
7669                 .flags = GENL_ADMIN_PERM,
7670                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7671                                   NL80211_FLAG_NEED_RTNL,
7672         },
7673         {
7674                 .cmd = NL80211_CMD_START_P2P_DEVICE,
7675                 .doit = nl80211_start_p2p_device,
7676                 .policy = nl80211_policy,
7677                 .flags = GENL_ADMIN_PERM,
7678                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7679                                   NL80211_FLAG_NEED_RTNL,
7680         },
7681         {
7682                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
7683                 .doit = nl80211_stop_p2p_device,
7684                 .policy = nl80211_policy,
7685                 .flags = GENL_ADMIN_PERM,
7686                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7687                                   NL80211_FLAG_NEED_RTNL,
7688         },
7689         {
7690                 .cmd = NL80211_CMD_SET_MCAST_RATE,
7691                 .doit = nl80211_set_mcast_rate,
7692                 .policy = nl80211_policy,
7693                 .flags = GENL_ADMIN_PERM,
7694                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7695                                   NL80211_FLAG_NEED_RTNL,
7696         },
7697 };
7698
7699 static struct genl_multicast_group nl80211_mlme_mcgrp = {
7700         .name = "mlme",
7701 };
7702
7703 /* multicast groups */
7704 static struct genl_multicast_group nl80211_config_mcgrp = {
7705         .name = "config",
7706 };
7707 static struct genl_multicast_group nl80211_scan_mcgrp = {
7708         .name = "scan",
7709 };
7710 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
7711         .name = "regulatory",
7712 };
7713
7714 /* notification functions */
7715
7716 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
7717 {
7718         struct sk_buff *msg;
7719
7720         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7721         if (!msg)
7722                 return;
7723
7724         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
7725                 nlmsg_free(msg);
7726                 return;
7727         }
7728
7729         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7730                                 nl80211_config_mcgrp.id, GFP_KERNEL);
7731 }
7732
7733 static int nl80211_add_scan_req(struct sk_buff *msg,
7734                                 struct cfg80211_registered_device *rdev)
7735 {
7736         struct cfg80211_scan_request *req = rdev->scan_req;
7737         struct nlattr *nest;
7738         int i;
7739
7740         ASSERT_RDEV_LOCK(rdev);
7741
7742         if (WARN_ON(!req))
7743                 return 0;
7744
7745         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
7746         if (!nest)
7747                 goto nla_put_failure;
7748         for (i = 0; i < req->n_ssids; i++) {
7749                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
7750                         goto nla_put_failure;
7751         }
7752         nla_nest_end(msg, nest);
7753
7754         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
7755         if (!nest)
7756                 goto nla_put_failure;
7757         for (i = 0; i < req->n_channels; i++) {
7758                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
7759                         goto nla_put_failure;
7760         }
7761         nla_nest_end(msg, nest);
7762
7763         if (req->ie &&
7764             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
7765                 goto nla_put_failure;
7766
7767         if (req->flags)
7768                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
7769
7770         return 0;
7771  nla_put_failure:
7772         return -ENOBUFS;
7773 }
7774
7775 static int nl80211_send_scan_msg(struct sk_buff *msg,
7776                                  struct cfg80211_registered_device *rdev,
7777                                  struct wireless_dev *wdev,
7778                                  u32 portid, u32 seq, int flags,
7779                                  u32 cmd)
7780 {
7781         void *hdr;
7782
7783         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7784         if (!hdr)
7785                 return -1;
7786
7787         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7788             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
7789                                          wdev->netdev->ifindex)) ||
7790             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
7791                 goto nla_put_failure;
7792
7793         /* ignore errors and send incomplete event anyway */
7794         nl80211_add_scan_req(msg, rdev);
7795
7796         return genlmsg_end(msg, hdr);
7797
7798  nla_put_failure:
7799         genlmsg_cancel(msg, hdr);
7800         return -EMSGSIZE;
7801 }
7802
7803 static int
7804 nl80211_send_sched_scan_msg(struct sk_buff *msg,
7805                             struct cfg80211_registered_device *rdev,
7806                             struct net_device *netdev,
7807                             u32 portid, u32 seq, int flags, u32 cmd)
7808 {
7809         void *hdr;
7810
7811         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7812         if (!hdr)
7813                 return -1;
7814
7815         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7816             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
7817                 goto nla_put_failure;
7818
7819         return genlmsg_end(msg, hdr);
7820
7821  nla_put_failure:
7822         genlmsg_cancel(msg, hdr);
7823         return -EMSGSIZE;
7824 }
7825
7826 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
7827                              struct wireless_dev *wdev)
7828 {
7829         struct sk_buff *msg;
7830
7831         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7832         if (!msg)
7833                 return;
7834
7835         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7836                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
7837                 nlmsg_free(msg);
7838                 return;
7839         }
7840
7841         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7842                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7843 }
7844
7845 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
7846                             struct wireless_dev *wdev)
7847 {
7848         struct sk_buff *msg;
7849
7850         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7851         if (!msg)
7852                 return;
7853
7854         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7855                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
7856                 nlmsg_free(msg);
7857                 return;
7858         }
7859
7860         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7861                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7862 }
7863
7864 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
7865                                struct wireless_dev *wdev)
7866 {
7867         struct sk_buff *msg;
7868
7869         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7870         if (!msg)
7871                 return;
7872
7873         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7874                                   NL80211_CMD_SCAN_ABORTED) < 0) {
7875                 nlmsg_free(msg);
7876                 return;
7877         }
7878
7879         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7880                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7881 }
7882
7883 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
7884                                      struct net_device *netdev)
7885 {
7886         struct sk_buff *msg;
7887
7888         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7889         if (!msg)
7890                 return;
7891
7892         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
7893                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
7894                 nlmsg_free(msg);
7895                 return;
7896         }
7897
7898         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7899                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7900 }
7901
7902 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
7903                              struct net_device *netdev, u32 cmd)
7904 {
7905         struct sk_buff *msg;
7906
7907         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7908         if (!msg)
7909                 return;
7910
7911         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
7912                 nlmsg_free(msg);
7913                 return;
7914         }
7915
7916         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7917                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7918 }
7919
7920 /*
7921  * This can happen on global regulatory changes or device specific settings
7922  * based on custom world regulatory domains.
7923  */
7924 void nl80211_send_reg_change_event(struct regulatory_request *request)
7925 {
7926         struct sk_buff *msg;
7927         void *hdr;
7928
7929         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7930         if (!msg)
7931                 return;
7932
7933         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
7934         if (!hdr) {
7935                 nlmsg_free(msg);
7936                 return;
7937         }
7938
7939         /* Userspace can always count this one always being set */
7940         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
7941                 goto nla_put_failure;
7942
7943         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
7944                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7945                                NL80211_REGDOM_TYPE_WORLD))
7946                         goto nla_put_failure;
7947         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
7948                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7949                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
7950                         goto nla_put_failure;
7951         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
7952                    request->intersect) {
7953                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7954                                NL80211_REGDOM_TYPE_INTERSECTION))
7955                         goto nla_put_failure;
7956         } else {
7957                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7958                                NL80211_REGDOM_TYPE_COUNTRY) ||
7959                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
7960                                    request->alpha2))
7961                         goto nla_put_failure;
7962         }
7963
7964         if (wiphy_idx_valid(request->wiphy_idx) &&
7965             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
7966                 goto nla_put_failure;
7967
7968         genlmsg_end(msg, hdr);
7969
7970         rcu_read_lock();
7971         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
7972                                 GFP_ATOMIC);
7973         rcu_read_unlock();
7974
7975         return;
7976
7977 nla_put_failure:
7978         genlmsg_cancel(msg, hdr);
7979         nlmsg_free(msg);
7980 }
7981
7982 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
7983                                     struct net_device *netdev,
7984                                     const u8 *buf, size_t len,
7985                                     enum nl80211_commands cmd, gfp_t gfp)
7986 {
7987         struct sk_buff *msg;
7988         void *hdr;
7989
7990         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7991         if (!msg)
7992                 return;
7993
7994         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7995         if (!hdr) {
7996                 nlmsg_free(msg);
7997                 return;
7998         }
7999
8000         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8001             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8002             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
8003                 goto nla_put_failure;
8004
8005         genlmsg_end(msg, hdr);
8006
8007         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8008                                 nl80211_mlme_mcgrp.id, gfp);
8009         return;
8010
8011  nla_put_failure:
8012         genlmsg_cancel(msg, hdr);
8013         nlmsg_free(msg);
8014 }
8015
8016 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
8017                           struct net_device *netdev, const u8 *buf,
8018                           size_t len, gfp_t gfp)
8019 {
8020         nl80211_send_mlme_event(rdev, netdev, buf, len,
8021                                 NL80211_CMD_AUTHENTICATE, gfp);
8022 }
8023
8024 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
8025                            struct net_device *netdev, const u8 *buf,
8026                            size_t len, gfp_t gfp)
8027 {
8028         nl80211_send_mlme_event(rdev, netdev, buf, len,
8029                                 NL80211_CMD_ASSOCIATE, gfp);
8030 }
8031
8032 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
8033                          struct net_device *netdev, const u8 *buf,
8034                          size_t len, gfp_t gfp)
8035 {
8036         nl80211_send_mlme_event(rdev, netdev, buf, len,
8037                                 NL80211_CMD_DEAUTHENTICATE, gfp);
8038 }
8039
8040 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
8041                            struct net_device *netdev, const u8 *buf,
8042                            size_t len, gfp_t gfp)
8043 {
8044         nl80211_send_mlme_event(rdev, netdev, buf, len,
8045                                 NL80211_CMD_DISASSOCIATE, gfp);
8046 }
8047
8048 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
8049                                 struct net_device *netdev, const u8 *buf,
8050                                 size_t len, gfp_t gfp)
8051 {
8052         nl80211_send_mlme_event(rdev, netdev, buf, len,
8053                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
8054 }
8055
8056 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
8057                                   struct net_device *netdev, const u8 *buf,
8058                                   size_t len, gfp_t gfp)
8059 {
8060         nl80211_send_mlme_event(rdev, netdev, buf, len,
8061                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
8062 }
8063
8064 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
8065                                       struct net_device *netdev, int cmd,
8066                                       const u8 *addr, gfp_t gfp)
8067 {
8068         struct sk_buff *msg;
8069         void *hdr;
8070
8071         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8072         if (!msg)
8073                 return;
8074
8075         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8076         if (!hdr) {
8077                 nlmsg_free(msg);
8078                 return;
8079         }
8080
8081         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8082             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8083             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
8084             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8085                 goto nla_put_failure;
8086
8087         genlmsg_end(msg, hdr);
8088
8089         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8090                                 nl80211_mlme_mcgrp.id, gfp);
8091         return;
8092
8093  nla_put_failure:
8094         genlmsg_cancel(msg, hdr);
8095         nlmsg_free(msg);
8096 }
8097
8098 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
8099                                struct net_device *netdev, const u8 *addr,
8100                                gfp_t gfp)
8101 {
8102         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
8103                                   addr, gfp);
8104 }
8105
8106 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
8107                                 struct net_device *netdev, const u8 *addr,
8108                                 gfp_t gfp)
8109 {
8110         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
8111                                   addr, gfp);
8112 }
8113
8114 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
8115                                  struct net_device *netdev, const u8 *bssid,
8116                                  const u8 *req_ie, size_t req_ie_len,
8117                                  const u8 *resp_ie, size_t resp_ie_len,
8118                                  u16 status, gfp_t gfp)
8119 {
8120         struct sk_buff *msg;
8121         void *hdr;
8122
8123         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8124         if (!msg)
8125                 return;
8126
8127         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
8128         if (!hdr) {
8129                 nlmsg_free(msg);
8130                 return;
8131         }
8132
8133         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8134             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8135             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
8136             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
8137             (req_ie &&
8138              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8139             (resp_ie &&
8140              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8141                 goto nla_put_failure;
8142
8143         genlmsg_end(msg, hdr);
8144
8145         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8146                                 nl80211_mlme_mcgrp.id, gfp);
8147         return;
8148
8149  nla_put_failure:
8150         genlmsg_cancel(msg, hdr);
8151         nlmsg_free(msg);
8152
8153 }
8154
8155 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
8156                          struct net_device *netdev, const u8 *bssid,
8157                          const u8 *req_ie, size_t req_ie_len,
8158                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
8159 {
8160         struct sk_buff *msg;
8161         void *hdr;
8162
8163         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8164         if (!msg)
8165                 return;
8166
8167         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
8168         if (!hdr) {
8169                 nlmsg_free(msg);
8170                 return;
8171         }
8172
8173         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8174             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8175             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
8176             (req_ie &&
8177              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8178             (resp_ie &&
8179              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8180                 goto nla_put_failure;
8181
8182         genlmsg_end(msg, hdr);
8183
8184         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8185                                 nl80211_mlme_mcgrp.id, gfp);
8186         return;
8187
8188  nla_put_failure:
8189         genlmsg_cancel(msg, hdr);
8190         nlmsg_free(msg);
8191
8192 }
8193
8194 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
8195                                struct net_device *netdev, u16 reason,
8196                                const u8 *ie, size_t ie_len, bool from_ap)
8197 {
8198         struct sk_buff *msg;
8199         void *hdr;
8200
8201         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8202         if (!msg)
8203                 return;
8204
8205         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
8206         if (!hdr) {
8207                 nlmsg_free(msg);
8208                 return;
8209         }
8210
8211         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8212             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8213             (from_ap && reason &&
8214              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
8215             (from_ap &&
8216              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
8217             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
8218                 goto nla_put_failure;
8219
8220         genlmsg_end(msg, hdr);
8221
8222         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8223                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
8224         return;
8225
8226  nla_put_failure:
8227         genlmsg_cancel(msg, hdr);
8228         nlmsg_free(msg);
8229
8230 }
8231
8232 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
8233                              struct net_device *netdev, const u8 *bssid,
8234                              gfp_t gfp)
8235 {
8236         struct sk_buff *msg;
8237         void *hdr;
8238
8239         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8240         if (!msg)
8241                 return;
8242
8243         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
8244         if (!hdr) {
8245                 nlmsg_free(msg);
8246                 return;
8247         }
8248
8249         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8250             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8251             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8252                 goto nla_put_failure;
8253
8254         genlmsg_end(msg, hdr);
8255
8256         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8257                                 nl80211_mlme_mcgrp.id, gfp);
8258         return;
8259
8260  nla_put_failure:
8261         genlmsg_cancel(msg, hdr);
8262         nlmsg_free(msg);
8263 }
8264
8265 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
8266                 struct net_device *netdev,
8267                 const u8 *macaddr, const u8* ie, u8 ie_len,
8268                 gfp_t gfp)
8269 {
8270         struct sk_buff *msg;
8271         void *hdr;
8272
8273         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8274         if (!msg)
8275                 return;
8276
8277         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
8278         if (!hdr) {
8279                 nlmsg_free(msg);
8280                 return;
8281         }
8282
8283         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8284             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8285             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
8286             (ie_len && ie &&
8287              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
8288                 goto nla_put_failure;
8289
8290         genlmsg_end(msg, hdr);
8291
8292         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8293                                 nl80211_mlme_mcgrp.id, gfp);
8294         return;
8295
8296  nla_put_failure:
8297         genlmsg_cancel(msg, hdr);
8298         nlmsg_free(msg);
8299 }
8300
8301 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
8302                                  struct net_device *netdev, const u8 *addr,
8303                                  enum nl80211_key_type key_type, int key_id,
8304                                  const u8 *tsc, gfp_t gfp)
8305 {
8306         struct sk_buff *msg;
8307         void *hdr;
8308
8309         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8310         if (!msg)
8311                 return;
8312
8313         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
8314         if (!hdr) {
8315                 nlmsg_free(msg);
8316                 return;
8317         }
8318
8319         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8320             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8321             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
8322             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
8323             (key_id != -1 &&
8324              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
8325             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
8326                 goto nla_put_failure;
8327
8328         genlmsg_end(msg, hdr);
8329
8330         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8331                                 nl80211_mlme_mcgrp.id, gfp);
8332         return;
8333
8334  nla_put_failure:
8335         genlmsg_cancel(msg, hdr);
8336         nlmsg_free(msg);
8337 }
8338
8339 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
8340                                     struct ieee80211_channel *channel_before,
8341                                     struct ieee80211_channel *channel_after)
8342 {
8343         struct sk_buff *msg;
8344         void *hdr;
8345         struct nlattr *nl_freq;
8346
8347         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
8348         if (!msg)
8349                 return;
8350
8351         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
8352         if (!hdr) {
8353                 nlmsg_free(msg);
8354                 return;
8355         }
8356
8357         /*
8358          * Since we are applying the beacon hint to a wiphy we know its
8359          * wiphy_idx is valid
8360          */
8361         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8362                 goto nla_put_failure;
8363
8364         /* Before */
8365         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
8366         if (!nl_freq)
8367                 goto nla_put_failure;
8368         if (nl80211_msg_put_channel(msg, channel_before))
8369                 goto nla_put_failure;
8370         nla_nest_end(msg, nl_freq);
8371
8372         /* After */
8373         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
8374         if (!nl_freq)
8375                 goto nla_put_failure;
8376         if (nl80211_msg_put_channel(msg, channel_after))
8377                 goto nla_put_failure;
8378         nla_nest_end(msg, nl_freq);
8379
8380         genlmsg_end(msg, hdr);
8381
8382         rcu_read_lock();
8383         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
8384                                 GFP_ATOMIC);
8385         rcu_read_unlock();
8386
8387         return;
8388
8389 nla_put_failure:
8390         genlmsg_cancel(msg, hdr);
8391         nlmsg_free(msg);
8392 }
8393
8394 static void nl80211_send_remain_on_chan_event(
8395         int cmd, struct cfg80211_registered_device *rdev,
8396         struct wireless_dev *wdev, u64 cookie,
8397         struct ieee80211_channel *chan,
8398         enum nl80211_channel_type channel_type,
8399         unsigned int duration, gfp_t gfp)
8400 {
8401         struct sk_buff *msg;
8402         void *hdr;
8403
8404         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8405         if (!msg)
8406                 return;
8407
8408         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8409         if (!hdr) {
8410                 nlmsg_free(msg);
8411                 return;
8412         }
8413
8414         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8415             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8416                                          wdev->netdev->ifindex)) ||
8417             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
8418             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
8419             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type) ||
8420             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8421                 goto nla_put_failure;
8422
8423         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
8424             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
8425                 goto nla_put_failure;
8426
8427         genlmsg_end(msg, hdr);
8428
8429         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8430                                 nl80211_mlme_mcgrp.id, gfp);
8431         return;
8432
8433  nla_put_failure:
8434         genlmsg_cancel(msg, hdr);
8435         nlmsg_free(msg);
8436 }
8437
8438 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
8439                                     struct wireless_dev *wdev, u64 cookie,
8440                                     struct ieee80211_channel *chan,
8441                                     enum nl80211_channel_type channel_type,
8442                                     unsigned int duration, gfp_t gfp)
8443 {
8444         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
8445                                           rdev, wdev, cookie, chan,
8446                                           channel_type, duration, gfp);
8447 }
8448
8449 void nl80211_send_remain_on_channel_cancel(
8450         struct cfg80211_registered_device *rdev,
8451         struct wireless_dev *wdev,
8452         u64 cookie, struct ieee80211_channel *chan,
8453         enum nl80211_channel_type channel_type, gfp_t gfp)
8454 {
8455         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8456                                           rdev, wdev, cookie, chan,
8457                                           channel_type, 0, gfp);
8458 }
8459
8460 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
8461                             struct net_device *dev, const u8 *mac_addr,
8462                             struct station_info *sinfo, gfp_t gfp)
8463 {
8464         struct sk_buff *msg;
8465
8466         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8467         if (!msg)
8468                 return;
8469
8470         if (nl80211_send_station(msg, 0, 0, 0,
8471                                  rdev, dev, mac_addr, sinfo) < 0) {
8472                 nlmsg_free(msg);
8473                 return;
8474         }
8475
8476         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8477                                 nl80211_mlme_mcgrp.id, gfp);
8478 }
8479
8480 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
8481                                 struct net_device *dev, const u8 *mac_addr,
8482                                 gfp_t gfp)
8483 {
8484         struct sk_buff *msg;
8485         void *hdr;
8486
8487         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8488         if (!msg)
8489                 return;
8490
8491         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
8492         if (!hdr) {
8493                 nlmsg_free(msg);
8494                 return;
8495         }
8496
8497         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8498             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
8499                 goto nla_put_failure;
8500
8501         genlmsg_end(msg, hdr);
8502
8503         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8504                                 nl80211_mlme_mcgrp.id, gfp);
8505         return;
8506
8507  nla_put_failure:
8508         genlmsg_cancel(msg, hdr);
8509         nlmsg_free(msg);
8510 }
8511
8512 void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
8513                                     struct net_device *dev, const u8 *mac_addr,
8514                                     enum nl80211_connect_failed_reason reason,
8515                                     gfp_t gfp)
8516 {
8517         struct sk_buff *msg;
8518         void *hdr;
8519
8520         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8521         if (!msg)
8522                 return;
8523
8524         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
8525         if (!hdr) {
8526                 nlmsg_free(msg);
8527                 return;
8528         }
8529
8530         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8531             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
8532             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
8533                 goto nla_put_failure;
8534
8535         genlmsg_end(msg, hdr);
8536
8537         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8538                                 nl80211_mlme_mcgrp.id, gfp);
8539         return;
8540
8541  nla_put_failure:
8542         genlmsg_cancel(msg, hdr);
8543         nlmsg_free(msg);
8544 }
8545
8546 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
8547                                        const u8 *addr, gfp_t gfp)
8548 {
8549         struct wireless_dev *wdev = dev->ieee80211_ptr;
8550         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8551         struct sk_buff *msg;
8552         void *hdr;
8553         int err;
8554         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
8555
8556         if (!nlportid)
8557                 return false;
8558
8559         msg = nlmsg_new(100, gfp);
8560         if (!msg)
8561                 return true;
8562
8563         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8564         if (!hdr) {
8565                 nlmsg_free(msg);
8566                 return true;
8567         }
8568
8569         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8570             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8571             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8572                 goto nla_put_failure;
8573
8574         err = genlmsg_end(msg, hdr);
8575         if (err < 0) {
8576                 nlmsg_free(msg);
8577                 return true;
8578         }
8579
8580         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8581         return true;
8582
8583  nla_put_failure:
8584         genlmsg_cancel(msg, hdr);
8585         nlmsg_free(msg);
8586         return true;
8587 }
8588
8589 bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
8590 {
8591         return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
8592                                           addr, gfp);
8593 }
8594
8595 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
8596                                     const u8 *addr, gfp_t gfp)
8597 {
8598         return __nl80211_unexpected_frame(dev,
8599                                           NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
8600                                           addr, gfp);
8601 }
8602
8603 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
8604                       struct wireless_dev *wdev, u32 nlportid,
8605                       int freq, int sig_dbm,
8606                       const u8 *buf, size_t len, gfp_t gfp)
8607 {
8608         struct net_device *netdev = wdev->netdev;
8609         struct sk_buff *msg;
8610         void *hdr;
8611
8612         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8613         if (!msg)
8614                 return -ENOMEM;
8615
8616         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
8617         if (!hdr) {
8618                 nlmsg_free(msg);
8619                 return -ENOMEM;
8620         }
8621
8622         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8623             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8624                                         netdev->ifindex)) ||
8625             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
8626             (sig_dbm &&
8627              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
8628             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
8629                 goto nla_put_failure;
8630
8631         genlmsg_end(msg, hdr);
8632
8633         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8634
8635  nla_put_failure:
8636         genlmsg_cancel(msg, hdr);
8637         nlmsg_free(msg);
8638         return -ENOBUFS;
8639 }
8640
8641 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
8642                                  struct wireless_dev *wdev, u64 cookie,
8643                                  const u8 *buf, size_t len, bool ack,
8644                                  gfp_t gfp)
8645 {
8646         struct net_device *netdev = wdev->netdev;
8647         struct sk_buff *msg;
8648         void *hdr;
8649
8650         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8651         if (!msg)
8652                 return;
8653
8654         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
8655         if (!hdr) {
8656                 nlmsg_free(msg);
8657                 return;
8658         }
8659
8660         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8661             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8662                                    netdev->ifindex)) ||
8663             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
8664             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8665             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
8666                 goto nla_put_failure;
8667
8668         genlmsg_end(msg, hdr);
8669
8670         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
8671         return;
8672
8673  nla_put_failure:
8674         genlmsg_cancel(msg, hdr);
8675         nlmsg_free(msg);
8676 }
8677
8678 void
8679 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
8680                              struct net_device *netdev,
8681                              enum nl80211_cqm_rssi_threshold_event rssi_event,
8682                              gfp_t gfp)
8683 {
8684         struct sk_buff *msg;
8685         struct nlattr *pinfoattr;
8686         void *hdr;
8687
8688         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8689         if (!msg)
8690                 return;
8691
8692         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8693         if (!hdr) {
8694                 nlmsg_free(msg);
8695                 return;
8696         }
8697
8698         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8699             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8700                 goto nla_put_failure;
8701
8702         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8703         if (!pinfoattr)
8704                 goto nla_put_failure;
8705
8706         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
8707                         rssi_event))
8708                 goto nla_put_failure;
8709
8710         nla_nest_end(msg, pinfoattr);
8711
8712         genlmsg_end(msg, hdr);
8713
8714         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8715                                 nl80211_mlme_mcgrp.id, gfp);
8716         return;
8717
8718  nla_put_failure:
8719         genlmsg_cancel(msg, hdr);
8720         nlmsg_free(msg);
8721 }
8722
8723 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
8724                               struct net_device *netdev, const u8 *bssid,
8725                               const u8 *replay_ctr, gfp_t gfp)
8726 {
8727         struct sk_buff *msg;
8728         struct nlattr *rekey_attr;
8729         void *hdr;
8730
8731         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8732         if (!msg)
8733                 return;
8734
8735         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
8736         if (!hdr) {
8737                 nlmsg_free(msg);
8738                 return;
8739         }
8740
8741         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8742             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8743             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8744                 goto nla_put_failure;
8745
8746         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
8747         if (!rekey_attr)
8748                 goto nla_put_failure;
8749
8750         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
8751                     NL80211_REPLAY_CTR_LEN, replay_ctr))
8752                 goto nla_put_failure;
8753
8754         nla_nest_end(msg, rekey_attr);
8755
8756         genlmsg_end(msg, hdr);
8757
8758         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8759                                 nl80211_mlme_mcgrp.id, gfp);
8760         return;
8761
8762  nla_put_failure:
8763         genlmsg_cancel(msg, hdr);
8764         nlmsg_free(msg);
8765 }
8766
8767 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
8768                                     struct net_device *netdev, int index,
8769                                     const u8 *bssid, bool preauth, gfp_t gfp)
8770 {
8771         struct sk_buff *msg;
8772         struct nlattr *attr;
8773         void *hdr;
8774
8775         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8776         if (!msg)
8777                 return;
8778
8779         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
8780         if (!hdr) {
8781                 nlmsg_free(msg);
8782                 return;
8783         }
8784
8785         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8786             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8787                 goto nla_put_failure;
8788
8789         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
8790         if (!attr)
8791                 goto nla_put_failure;
8792
8793         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
8794             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
8795             (preauth &&
8796              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
8797                 goto nla_put_failure;
8798
8799         nla_nest_end(msg, attr);
8800
8801         genlmsg_end(msg, hdr);
8802
8803         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8804                                 nl80211_mlme_mcgrp.id, gfp);
8805         return;
8806
8807  nla_put_failure:
8808         genlmsg_cancel(msg, hdr);
8809         nlmsg_free(msg);
8810 }
8811
8812 void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
8813                               struct net_device *netdev, int freq,
8814                               enum nl80211_channel_type type, gfp_t gfp)
8815 {
8816         struct sk_buff *msg;
8817         void *hdr;
8818
8819         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8820         if (!msg)
8821                 return;
8822
8823         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
8824         if (!hdr) {
8825                 nlmsg_free(msg);
8826                 return;
8827         }
8828
8829         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8830             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
8831             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, type))
8832                 goto nla_put_failure;
8833
8834         genlmsg_end(msg, hdr);
8835
8836         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8837                                 nl80211_mlme_mcgrp.id, gfp);
8838         return;
8839
8840  nla_put_failure:
8841         genlmsg_cancel(msg, hdr);
8842         nlmsg_free(msg);
8843 }
8844
8845 void
8846 nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
8847                             struct net_device *netdev, const u8 *peer,
8848                             u32 num_packets, u32 rate, u32 intvl, gfp_t gfp)
8849 {
8850         struct sk_buff *msg;
8851         struct nlattr *pinfoattr;
8852         void *hdr;
8853
8854         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8855         if (!msg)
8856                 return;
8857
8858         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8859         if (!hdr) {
8860                 nlmsg_free(msg);
8861                 return;
8862         }
8863
8864         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8865             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8866             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
8867                 goto nla_put_failure;
8868
8869         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8870         if (!pinfoattr)
8871                 goto nla_put_failure;
8872
8873         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
8874                 goto nla_put_failure;
8875
8876         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
8877                 goto nla_put_failure;
8878
8879         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
8880                 goto nla_put_failure;
8881
8882         nla_nest_end(msg, pinfoattr);
8883
8884         genlmsg_end(msg, hdr);
8885
8886         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8887                                 nl80211_mlme_mcgrp.id, gfp);
8888         return;
8889
8890  nla_put_failure:
8891         genlmsg_cancel(msg, hdr);
8892         nlmsg_free(msg);
8893 }
8894
8895 void
8896 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
8897                                 struct net_device *netdev, const u8 *peer,
8898                                 u32 num_packets, gfp_t gfp)
8899 {
8900         struct sk_buff *msg;
8901         struct nlattr *pinfoattr;
8902         void *hdr;
8903
8904         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8905         if (!msg)
8906                 return;
8907
8908         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8909         if (!hdr) {
8910                 nlmsg_free(msg);
8911                 return;
8912         }
8913
8914         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8915             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8916             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
8917                 goto nla_put_failure;
8918
8919         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8920         if (!pinfoattr)
8921                 goto nla_put_failure;
8922
8923         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
8924                 goto nla_put_failure;
8925
8926         nla_nest_end(msg, pinfoattr);
8927
8928         genlmsg_end(msg, hdr);
8929
8930         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8931                                 nl80211_mlme_mcgrp.id, gfp);
8932         return;
8933
8934  nla_put_failure:
8935         genlmsg_cancel(msg, hdr);
8936         nlmsg_free(msg);
8937 }
8938
8939 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
8940                            u64 cookie, bool acked, gfp_t gfp)
8941 {
8942         struct wireless_dev *wdev = dev->ieee80211_ptr;
8943         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8944         struct sk_buff *msg;
8945         void *hdr;
8946         int err;
8947
8948         trace_cfg80211_probe_status(dev, addr, cookie, acked);
8949
8950         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8951
8952         if (!msg)
8953                 return;
8954
8955         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
8956         if (!hdr) {
8957                 nlmsg_free(msg);
8958                 return;
8959         }
8960
8961         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8962             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8963             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
8964             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8965             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
8966                 goto nla_put_failure;
8967
8968         err = genlmsg_end(msg, hdr);
8969         if (err < 0) {
8970                 nlmsg_free(msg);
8971                 return;
8972         }
8973
8974         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8975                                 nl80211_mlme_mcgrp.id, gfp);
8976         return;
8977
8978  nla_put_failure:
8979         genlmsg_cancel(msg, hdr);
8980         nlmsg_free(msg);
8981 }
8982 EXPORT_SYMBOL(cfg80211_probe_status);
8983
8984 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
8985                                  const u8 *frame, size_t len,
8986                                  int freq, int sig_dbm)
8987 {
8988         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
8989         struct sk_buff *msg;
8990         void *hdr;
8991         struct cfg80211_beacon_registration *reg;
8992
8993         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
8994
8995         spin_lock_bh(&rdev->beacon_registrations_lock);
8996         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8997                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
8998                 if (!msg) {
8999                         spin_unlock_bh(&rdev->beacon_registrations_lock);
9000                         return;
9001                 }
9002
9003                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
9004                 if (!hdr)
9005                         goto nla_put_failure;
9006
9007                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9008                     (freq &&
9009                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
9010                     (sig_dbm &&
9011                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9012                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
9013                         goto nla_put_failure;
9014
9015                 genlmsg_end(msg, hdr);
9016
9017                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
9018         }
9019         spin_unlock_bh(&rdev->beacon_registrations_lock);
9020         return;
9021
9022  nla_put_failure:
9023         spin_unlock_bh(&rdev->beacon_registrations_lock);
9024         if (hdr)
9025                 genlmsg_cancel(msg, hdr);
9026         nlmsg_free(msg);
9027 }
9028 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
9029
9030 static int nl80211_netlink_notify(struct notifier_block * nb,
9031                                   unsigned long state,
9032                                   void *_notify)
9033 {
9034         struct netlink_notify *notify = _notify;
9035         struct cfg80211_registered_device *rdev;
9036         struct wireless_dev *wdev;
9037         struct cfg80211_beacon_registration *reg, *tmp;
9038
9039         if (state != NETLINK_URELEASE)
9040                 return NOTIFY_DONE;
9041
9042         rcu_read_lock();
9043
9044         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
9045                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
9046                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
9047
9048                 spin_lock_bh(&rdev->beacon_registrations_lock);
9049                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
9050                                          list) {
9051                         if (reg->nlportid == notify->portid) {
9052                                 list_del(&reg->list);
9053                                 kfree(reg);
9054                                 break;
9055                         }
9056                 }
9057                 spin_unlock_bh(&rdev->beacon_registrations_lock);
9058         }
9059
9060         rcu_read_unlock();
9061
9062         return NOTIFY_DONE;
9063 }
9064
9065 static struct notifier_block nl80211_netlink_notifier = {
9066         .notifier_call = nl80211_netlink_notify,
9067 };
9068
9069 /* initialisation/exit functions */
9070
9071 int nl80211_init(void)
9072 {
9073         int err;
9074
9075         err = genl_register_family_with_ops(&nl80211_fam,
9076                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
9077         if (err)
9078                 return err;
9079
9080         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
9081         if (err)
9082                 goto err_out;
9083
9084         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
9085         if (err)
9086                 goto err_out;
9087
9088         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
9089         if (err)
9090                 goto err_out;
9091
9092         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
9093         if (err)
9094                 goto err_out;
9095
9096 #ifdef CONFIG_NL80211_TESTMODE
9097         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
9098         if (err)
9099                 goto err_out;
9100 #endif
9101
9102         err = netlink_register_notifier(&nl80211_netlink_notifier);
9103         if (err)
9104                 goto err_out;
9105
9106         return 0;
9107  err_out:
9108         genl_unregister_family(&nl80211_fam);
9109         return err;
9110 }
9111
9112 void nl80211_exit(void)
9113 {
9114         netlink_unregister_notifier(&nl80211_netlink_notifier);
9115         genl_unregister_family(&nl80211_fam);
9116 }