net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25 #include "rdev-ops.h"
  26
  27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  28                                    struct genl_info *info,
  29                                    struct cfg80211_crypto_settings *settings,
  30                                    int cipher_limit);
  31
  32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  33                             struct genl_info *info);
  34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  35                               struct genl_info *info);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam = {
  39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  40         .name = "nl80211",      /* have users key off the name instead */
  41         .hdrsize = 0,           /* no private header */
  42         .version = 1,           /* no particular meaning now */
  43         .maxattr = NL80211_ATTR_MAX,
  44         .netnsok = true,
  45         .pre_doit = nl80211_pre_doit,
  46         .post_doit = nl80211_post_doit,
  47 };
  48
  49 /* returns ERR_PTR values */
  50 static struct wireless_dev *
  51 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  52 {
  53         struct cfg80211_registered_device *rdev;
  54         struct wireless_dev *result = NULL;
  55         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  56         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  57         u64 wdev_id;
  58         int wiphy_idx = -1;
  59         int ifidx = -1;
  60
  61         assert_cfg80211_lock();
  62
  63         if (!have_ifidx && !have_wdev_id)
  64                 return ERR_PTR(-EINVAL);
  65
  66         if (have_ifidx)
  67                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  68         if (have_wdev_id) {
  69                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  70                 wiphy_idx = wdev_id >> 32;
  71         }
  72
  73         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  74                 struct wireless_dev *wdev;
  75
  76                 if (wiphy_net(&rdev->wiphy) != netns)
  77                         continue;
  78
  79                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  80                         continue;
  81
  82                 mutex_lock(&rdev->devlist_mtx);
  83                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  84                         if (have_ifidx && wdev->netdev &&
  85                             wdev->netdev->ifindex == ifidx) {
  86                                 result = wdev;
  87                                 break;
  88                         }
  89                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  90                                 result = wdev;
  91                                 break;
  92                         }
  93                 }
  94                 mutex_unlock(&rdev->devlist_mtx);
  95
  96                 if (result)
  97                         break;
  98         }
  99
 100         if (result)
 101                 return result;
 102         return ERR_PTR(-ENODEV);
 103 }
 104
 105 static struct cfg80211_registered_device *
 106 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 107 {
 108         struct cfg80211_registered_device *rdev = NULL, *tmp;
 109         struct net_device *netdev;
 110
 111         assert_cfg80211_lock();
 112
 113         if (!attrs[NL80211_ATTR_WIPHY] &&
 114             !attrs[NL80211_ATTR_IFINDEX] &&
 115             !attrs[NL80211_ATTR_WDEV])
 116                 return ERR_PTR(-EINVAL);
 117
 118         if (attrs[NL80211_ATTR_WIPHY])
 119                 rdev = cfg80211_rdev_by_wiphy_idx(
 120                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 121
 122         if (attrs[NL80211_ATTR_WDEV]) {
 123                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 124                 struct wireless_dev *wdev;
 125                 bool found = false;
 126
 127                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 128                 if (tmp) {
 129                         /* make sure wdev exists */
 130                         mutex_lock(&tmp->devlist_mtx);
 131                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 132                                 if (wdev->identifier != (u32)wdev_id)
 133                                         continue;
 134                                 found = true;
 135                                 break;
 136                         }
 137                         mutex_unlock(&tmp->devlist_mtx);
 138
 139                         if (!found)
 140                                 tmp = NULL;
 141
 142                         if (rdev && tmp != rdev)
 143                                 return ERR_PTR(-EINVAL);
 144                         rdev = tmp;
 145                 }
 146         }
 147
 148         if (attrs[NL80211_ATTR_IFINDEX]) {
 149                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 150                 netdev = dev_get_by_index(netns, ifindex);
 151                 if (netdev) {
 152                         if (netdev->ieee80211_ptr)
 153                                 tmp = wiphy_to_dev(
 154                                                 netdev->ieee80211_ptr->wiphy);
 155                         else
 156                                 tmp = NULL;
 157
 158                         dev_put(netdev);
 159
 160                         /* not wireless device -- return error */
 161                         if (!tmp)
 162                                 return ERR_PTR(-EINVAL);
 163
 164                         /* mismatch -- return error */
 165                         if (rdev && tmp != rdev)
 166                                 return ERR_PTR(-EINVAL);
 167
 168                         rdev = tmp;
 169                 }
 170         }
 171
 172         if (!rdev)
 173                 return ERR_PTR(-ENODEV);
 174
 175         if (netns != wiphy_net(&rdev->wiphy))
 176                 return ERR_PTR(-ENODEV);
 177
 178         return rdev;
 179 }
 180
 181 /*
 182  * This function returns a pointer to the driver
 183  * that the genl_info item that is passed refers to.
 184  * If successful, it returns non-NULL and also locks
 185  * the driver's mutex!
 186  *
 187  * This means that you need to call cfg80211_unlock_rdev()
 188  * before being allowed to acquire &cfg80211_mutex!
 189  *
 190  * This is necessary because we need to lock the global
 191  * mutex to get an item off the list safely, and then
 192  * we lock the rdev mutex so it doesn't go away under us.
 193  *
 194  * We don't want to keep cfg80211_mutex locked
 195  * for all the time in order to allow requests on
 196  * other interfaces to go through at the same time.
 197  *
 198  * The result of this can be a PTR_ERR and hence must
 199  * be checked with IS_ERR() for errors.
 200  */
 201 static struct cfg80211_registered_device *
 202 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 203 {
 204         struct cfg80211_registered_device *rdev;
 205
 206         mutex_lock(&cfg80211_mutex);
 207         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 208
 209         /* if it is not an error we grab the lock on
 210          * it to assure it won't be going away while
 211          * we operate on it */
 212         if (!IS_ERR(rdev))
 213                 mutex_lock(&rdev->mtx);
 214
 215         mutex_unlock(&cfg80211_mutex);
 216
 217         return rdev;
 218 }
 219
 220 /* policy for the attributes */
 221 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 222         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 223         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 224                                       .len = 20-1 },
 225         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 226         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 229         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 230         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 231         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 232         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 233
 234         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 235         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 236         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 237
 238         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 239         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 240
 241         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 242         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 243                                     .len = WLAN_MAX_KEY_LEN },
 244         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 245         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 246         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 247         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 248         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 249
 250         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 251         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 252         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 253                                        .len = IEEE80211_MAX_DATA_LEN },
 254         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 255                                        .len = IEEE80211_MAX_DATA_LEN },
 256         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 257         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 258         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 259         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 260                                                .len = NL80211_MAX_SUPP_RATES },
 261         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 262         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 263         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 264         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 265                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 266         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 267
 268         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 269         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 270
 271         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 272         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 273         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 274         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 275                                            .len = NL80211_MAX_SUPP_RATES },
 276         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 277
 278         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 279         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 280
 281         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 282
 283         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 284         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 285                               .len = IEEE80211_MAX_DATA_LEN },
 286         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 287         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 288
 289         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 290                                 .len = IEEE80211_MAX_SSID_LEN },
 291         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 292         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 293         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 294         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 295         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 296         [NL80211_ATTR_STA_FLAGS2] = {
 297                 .len = sizeof(struct nl80211_sta_flag_update),
 298         },
 299         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 301         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 302         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 303         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 304         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 305         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 306         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 307         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 308                                  .len = WLAN_PMKID_LEN },
 309         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 310         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 311         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 312         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 313                                  .len = IEEE80211_MAX_DATA_LEN },
 314         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 315         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 316         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 317         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 318         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 319         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 320         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 321         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 322         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 323         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 324         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 325         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 326         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 327         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 329         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 330         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 331         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 332         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 333         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 334                                          .len = IEEE80211_MAX_DATA_LEN },
 335         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 336                                          .len = IEEE80211_MAX_DATA_LEN },
 337         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 338         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 339         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 341         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 342         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 343         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 347                                       .len = IEEE80211_MAX_DATA_LEN },
 348         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 351                 .len = NL80211_HT_CAPABILITY_LEN
 352         },
 353         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 354         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 355         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 356         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 357         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 358         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 359         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 360         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 361 };
 362
 363 /* policy for the key attributes */
 364 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 365         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 366         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 367         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 368         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 369         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 370         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 371         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 372         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 373 };
 374
 375 /* policy for the key default flags */
 376 static const struct nla_policy
 377 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 378         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 379         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 380 };
 381
 382 /* policy for WoWLAN attributes */
 383 static const struct nla_policy
 384 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 385         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 386         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 387         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 388         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 389         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 390         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 391         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 392         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 393 };
 394
 395 /* policy for GTK rekey offload attributes */
 396 static const struct nla_policy
 397 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 398         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 399         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 400         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 401 };
 402
 403 static const struct nla_policy
 404 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 405         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 406                                                  .len = IEEE80211_MAX_SSID_LEN },
 407         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 408 };
 409
 410 /* ifidx get helper */
 411 static int nl80211_get_ifidx(struct netlink_callback *cb)
 412 {
 413         int res;
 414
 415         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 416                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 417                           nl80211_policy);
 418         if (res)
 419                 return res;
 420
 421         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 422                 return -EINVAL;
 423
 424         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 425         if (!res)
 426                 return -EINVAL;
 427         return res;
 428 }
 429
 430 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 431                                        struct netlink_callback *cb,
 432                                        struct cfg80211_registered_device **rdev,
 433                                        struct net_device **dev)
 434 {
 435         int ifidx = cb->args[0];
 436         int err;
 437
 438         if (!ifidx)
 439                 ifidx = nl80211_get_ifidx(cb);
 440         if (ifidx < 0)
 441                 return ifidx;
 442
 443         cb->args[0] = ifidx;
 444
 445         rtnl_lock();
 446
 447         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 448         if (!*dev) {
 449                 err = -ENODEV;
 450                 goto out_rtnl;
 451         }
 452
 453         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 454         if (IS_ERR(*rdev)) {
 455                 err = PTR_ERR(*rdev);
 456                 goto out_rtnl;
 457         }
 458
 459         return 0;
 460  out_rtnl:
 461         rtnl_unlock();
 462         return err;
 463 }
 464
 465 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 466 {
 467         cfg80211_unlock_rdev(rdev);
 468         rtnl_unlock();
 469 }
 470
 471 /* IE validation */
 472 static bool is_valid_ie_attr(const struct nlattr *attr)
 473 {
 474         const u8 *pos;
 475         int len;
 476
 477         if (!attr)
 478                 return true;
 479
 480         pos = nla_data(attr);
 481         len = nla_len(attr);
 482
 483         while (len) {
 484                 u8 elemlen;
 485
 486                 if (len < 2)
 487                         return false;
 488                 len -= 2;
 489
 490                 elemlen = pos[1];
 491                 if (elemlen > len)
 492                         return false;
 493
 494                 len -= elemlen;
 495                 pos += 2 + elemlen;
 496         }
 497
 498         return true;
 499 }
 500
 501 /* message building helper */
 502 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 503                                    int flags, u8 cmd)
 504 {
 505         /* since there is no private header just add the generic one */
 506         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 507 }
 508
 509 static int nl80211_msg_put_channel(struct sk_buff *msg,
 510                                    struct ieee80211_channel *chan)
 511 {
 512         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 513                         chan->center_freq))
 514                 goto nla_put_failure;
 515
 516         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 517             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 518                 goto nla_put_failure;
 519         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 520             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 521                 goto nla_put_failure;
 522         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 523             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 524                 goto nla_put_failure;
 525         if ((chan->flags & IEEE80211_CHAN_RADAR) &&
 526             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 527                 goto nla_put_failure;
 528
 529         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 530                         DBM_TO_MBM(chan->max_power)))
 531                 goto nla_put_failure;
 532
 533         return 0;
 534
 535  nla_put_failure:
 536         return -ENOBUFS;
 537 }
 538
 539 /* netlink command implementations */
 540
 541 struct key_parse {
 542         struct key_params p;
 543         int idx;
 544         int type;
 545         bool def, defmgmt;
 546         bool def_uni, def_multi;
 547 };
 548
 549 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 550 {
 551         struct nlattr *tb[NL80211_KEY_MAX + 1];
 552         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 553                                    nl80211_key_policy);
 554         if (err)
 555                 return err;
 556
 557         k->def = !!tb[NL80211_KEY_DEFAULT];
 558         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 559
 560         if (k->def) {
 561                 k->def_uni = true;
 562                 k->def_multi = true;
 563         }
 564         if (k->defmgmt)
 565                 k->def_multi = true;
 566
 567         if (tb[NL80211_KEY_IDX])
 568                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 569
 570         if (tb[NL80211_KEY_DATA]) {
 571                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 572                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 573         }
 574
 575         if (tb[NL80211_KEY_SEQ]) {
 576                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 577                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 578         }
 579
 580         if (tb[NL80211_KEY_CIPHER])
 581                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 582
 583         if (tb[NL80211_KEY_TYPE]) {
 584                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 585                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 586                         return -EINVAL;
 587         }
 588
 589         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 590                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 591                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 592                                        tb[NL80211_KEY_DEFAULT_TYPES],
 593                                        nl80211_key_default_policy);
 594                 if (err)
 595                         return err;
 596
 597                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 598                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 599         }
 600
 601         return 0;
 602 }
 603
 604 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 605 {
 606         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 607                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 608                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 609         }
 610
 611         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 612                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 613                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 614         }
 615
 616         if (info->attrs[NL80211_ATTR_KEY_IDX])
 617                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 618
 619         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 620                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 621
 622         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 623         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 624
 625         if (k->def) {
 626                 k->def_uni = true;
 627                 k->def_multi = true;
 628         }
 629         if (k->defmgmt)
 630                 k->def_multi = true;
 631
 632         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 633                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 634                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 635                         return -EINVAL;
 636         }
 637
 638         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 639                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 640                 int err = nla_parse_nested(
 641                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 642                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 643                                 nl80211_key_default_policy);
 644                 if (err)
 645                         return err;
 646
 647                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 648                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 649         }
 650
 651         return 0;
 652 }
 653
 654 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 655 {
 656         int err;
 657
 658         memset(k, 0, sizeof(*k));
 659         k->idx = -1;
 660         k->type = -1;
 661
 662         if (info->attrs[NL80211_ATTR_KEY])
 663                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 664         else
 665                 err = nl80211_parse_key_old(info, k);
 666
 667         if (err)
 668                 return err;
 669
 670         if (k->def && k->defmgmt)
 671                 return -EINVAL;
 672
 673         if (k->defmgmt) {
 674                 if (k->def_uni || !k->def_multi)
 675                         return -EINVAL;
 676         }
 677
 678         if (k->idx != -1) {
 679                 if (k->defmgmt) {
 680                         if (k->idx < 4 || k->idx > 5)
 681                                 return -EINVAL;
 682                 } else if (k->def) {
 683                         if (k->idx < 0 || k->idx > 3)
 684                                 return -EINVAL;
 685                 } else {
 686                         if (k->idx < 0 || k->idx > 5)
 687                                 return -EINVAL;
 688                 }
 689         }
 690
 691         return 0;
 692 }
 693
 694 static struct cfg80211_cached_keys *
 695 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 696                        struct nlattr *keys, bool *no_ht)
 697 {
 698         struct key_parse parse;
 699         struct nlattr *key;
 700         struct cfg80211_cached_keys *result;
 701         int rem, err, def = 0;
 702
 703         result = kzalloc(sizeof(*result), GFP_KERNEL);
 704         if (!result)
 705                 return ERR_PTR(-ENOMEM);
 706
 707         result->def = -1;
 708         result->defmgmt = -1;
 709
 710         nla_for_each_nested(key, keys, rem) {
 711                 memset(&parse, 0, sizeof(parse));
 712                 parse.idx = -1;
 713
 714                 err = nl80211_parse_key_new(key, &parse);
 715                 if (err)
 716                         goto error;
 717                 err = -EINVAL;
 718                 if (!parse.p.key)
 719                         goto error;
 720                 if (parse.idx < 0 || parse.idx > 4)
 721                         goto error;
 722                 if (parse.def) {
 723                         if (def)
 724                                 goto error;
 725                         def = 1;
 726                         result->def = parse.idx;
 727                         if (!parse.def_uni || !parse.def_multi)
 728                                 goto error;
 729                 } else if (parse.defmgmt)
 730                         goto error;
 731                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 732                                                      parse.idx, false, NULL);
 733                 if (err)
 734                         goto error;
 735                 result->params[parse.idx].cipher = parse.p.cipher;
 736                 result->params[parse.idx].key_len = parse.p.key_len;
 737                 result->params[parse.idx].key = result->data[parse.idx];
 738                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 739
 740                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 741                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 742                         if (no_ht)
 743                                 *no_ht = true;
 744                 }
 745         }
 746
 747         return result;
 748  error:
 749         kfree(result);
 750         return ERR_PTR(err);
 751 }
 752
 753 static int nl80211_key_allowed(struct wireless_dev *wdev)
 754 {
 755         ASSERT_WDEV_LOCK(wdev);
 756
 757         switch (wdev->iftype) {
 758         case NL80211_IFTYPE_AP:
 759         case NL80211_IFTYPE_AP_VLAN:
 760         case NL80211_IFTYPE_P2P_GO:
 761         case NL80211_IFTYPE_MESH_POINT:
 762                 break;
 763         case NL80211_IFTYPE_ADHOC:
 764                 if (!wdev->current_bss)
 765                         return -ENOLINK;
 766                 break;
 767         case NL80211_IFTYPE_STATION:
 768         case NL80211_IFTYPE_P2P_CLIENT:
 769                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 770                         return -ENOLINK;
 771                 break;
 772         default:
 773                 return -EINVAL;
 774         }
 775
 776         return 0;
 777 }
 778
 779 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 780 {
 781         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 782         int i;
 783
 784         if (!nl_modes)
 785                 goto nla_put_failure;
 786
 787         i = 0;
 788         while (ifmodes) {
 789                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 790                         goto nla_put_failure;
 791                 ifmodes >>= 1;
 792                 i++;
 793         }
 794
 795         nla_nest_end(msg, nl_modes);
 796         return 0;
 797
 798 nla_put_failure:
 799         return -ENOBUFS;
 800 }
 801
 802 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 803                                           struct sk_buff *msg)
 804 {
 805         struct nlattr *nl_combis;
 806         int i, j;
 807
 808         nl_combis = nla_nest_start(msg,
 809                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 810         if (!nl_combis)
 811                 goto nla_put_failure;
 812
 813         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 814                 const struct ieee80211_iface_combination *c;
 815                 struct nlattr *nl_combi, *nl_limits;
 816
 817                 c = &wiphy->iface_combinations[i];
 818
 819                 nl_combi = nla_nest_start(msg, i + 1);
 820                 if (!nl_combi)
 821                         goto nla_put_failure;
 822
 823                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 824                 if (!nl_limits)
 825                         goto nla_put_failure;
 826
 827                 for (j = 0; j < c->n_limits; j++) {
 828                         struct nlattr *nl_limit;
 829
 830                         nl_limit = nla_nest_start(msg, j + 1);
 831                         if (!nl_limit)
 832                                 goto nla_put_failure;
 833                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 834                                         c->limits[j].max))
 835                                 goto nla_put_failure;
 836                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 837                                                 c->limits[j].types))
 838                                 goto nla_put_failure;
 839                         nla_nest_end(msg, nl_limit);
 840                 }
 841
 842                 nla_nest_end(msg, nl_limits);
 843
 844                 if (c->beacon_int_infra_match &&
 845                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 846                         goto nla_put_failure;
 847                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 848                                 c->num_different_channels) ||
 849                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 850                                 c->max_interfaces))
 851                         goto nla_put_failure;
 852
 853                 nla_nest_end(msg, nl_combi);
 854         }
 855
 856         nla_nest_end(msg, nl_combis);
 857
 858         return 0;
 859 nla_put_failure:
 860         return -ENOBUFS;
 861 }
 862
 863 static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
 864                               struct cfg80211_registered_device *dev)
 865 {
 866         void *hdr;
 867         struct nlattr *nl_bands, *nl_band;
 868         struct nlattr *nl_freqs, *nl_freq;
 869         struct nlattr *nl_rates, *nl_rate;
 870         struct nlattr *nl_cmds;
 871         enum ieee80211_band band;
 872         struct ieee80211_channel *chan;
 873         struct ieee80211_rate *rate;
 874         int i;
 875         const struct ieee80211_txrx_stypes *mgmt_stypes =
 876                                 dev->wiphy.mgmt_stypes;
 877
 878         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
 879         if (!hdr)
 880                 return -1;
 881
 882         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
 883             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
 884             nla_put_u32(msg, NL80211_ATTR_GENERATION,
 885                         cfg80211_rdev_list_generation) ||
 886             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 887                        dev->wiphy.retry_short) ||
 888             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 889                        dev->wiphy.retry_long) ||
 890             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 891                         dev->wiphy.frag_threshold) ||
 892             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 893                         dev->wiphy.rts_threshold) ||
 894             nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 895                        dev->wiphy.coverage_class) ||
 896             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 897                        dev->wiphy.max_scan_ssids) ||
 898             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 899                        dev->wiphy.max_sched_scan_ssids) ||
 900             nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 901                         dev->wiphy.max_scan_ie_len) ||
 902             nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 903                         dev->wiphy.max_sched_scan_ie_len) ||
 904             nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 905                        dev->wiphy.max_match_sets))
 906                 goto nla_put_failure;
 907
 908         if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
 909             nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
 910                 goto nla_put_failure;
 911         if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
 912             nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
 913                 goto nla_put_failure;
 914         if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
 915             nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
 916                 goto nla_put_failure;
 917         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
 918             nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
 919                 goto nla_put_failure;
 920         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
 921             nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
 922                 goto nla_put_failure;
 923         if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
 924             nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
 925                 goto nla_put_failure;
 926
 927         if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
 928                     sizeof(u32) * dev->wiphy.n_cipher_suites,
 929                     dev->wiphy.cipher_suites))
 930                 goto nla_put_failure;
 931
 932         if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 933                        dev->wiphy.max_num_pmkids))
 934                 goto nla_put_failure;
 935
 936         if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
 937             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
 938                 goto nla_put_failure;
 939
 940         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 941                         dev->wiphy.available_antennas_tx) ||
 942             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 943                         dev->wiphy.available_antennas_rx))
 944                 goto nla_put_failure;
 945
 946         if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
 947             nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
 948                         dev->wiphy.probe_resp_offload))
 949                 goto nla_put_failure;
 950
 951         if ((dev->wiphy.available_antennas_tx ||
 952              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 953                 u32 tx_ant = 0, rx_ant = 0;
 954                 int res;
 955                 res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
 956                 if (!res) {
 957                         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
 958                                         tx_ant) ||
 959                             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
 960                                         rx_ant))
 961                                 goto nla_put_failure;
 962                 }
 963         }
 964
 965         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 966                                 dev->wiphy.interface_modes))
 967                 goto nla_put_failure;
 968
 969         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 970         if (!nl_bands)
 971                 goto nla_put_failure;
 972
 973         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 974                 if (!dev->wiphy.bands[band])
 975                         continue;
 976
 977                 nl_band = nla_nest_start(msg, band);
 978                 if (!nl_band)
 979                         goto nla_put_failure;
 980
 981                 /* add HT info */
 982                 if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
 983                     (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 984                              sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 985                              &dev->wiphy.bands[band]->ht_cap.mcs) ||
 986                      nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
 987                                  dev->wiphy.bands[band]->ht_cap.cap) ||
 988                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 989                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
 990                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 991                                 dev->wiphy.bands[band]->ht_cap.ampdu_density)))
 992                         goto nla_put_failure;
 993
 994                 /* add VHT info */
 995                 if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
 996                     (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
 997                              sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
 998                              &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
 999                      nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1000                                  dev->wiphy.bands[band]->vht_cap.cap)))
1001                         goto nla_put_failure;
1002
1003                 /* add frequencies */
1004                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
1005                 if (!nl_freqs)
1006                         goto nla_put_failure;
1007
1008                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
1009                         nl_freq = nla_nest_start(msg, i);
1010                         if (!nl_freq)
1011                                 goto nla_put_failure;
1012
1013                         chan = &dev->wiphy.bands[band]->channels[i];
1014
1015                         if (nl80211_msg_put_channel(msg, chan))
1016                                 goto nla_put_failure;
1017
1018                         nla_nest_end(msg, nl_freq);
1019                 }
1020
1021                 nla_nest_end(msg, nl_freqs);
1022
1023                 /* add bitrates */
1024                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1025                 if (!nl_rates)
1026                         goto nla_put_failure;
1027
1028                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
1029                         nl_rate = nla_nest_start(msg, i);
1030                         if (!nl_rate)
1031                                 goto nla_put_failure;
1032
1033                         rate = &dev->wiphy.bands[band]->bitrates[i];
1034                         if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1035                                         rate->bitrate))
1036                                 goto nla_put_failure;
1037                         if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1038                             nla_put_flag(msg,
1039                                          NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1040                                 goto nla_put_failure;
1041
1042                         nla_nest_end(msg, nl_rate);
1043                 }
1044
1045                 nla_nest_end(msg, nl_rates);
1046
1047                 nla_nest_end(msg, nl_band);
1048         }
1049         nla_nest_end(msg, nl_bands);
1050
1051         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1052         if (!nl_cmds)
1053                 goto nla_put_failure;
1054
1055         i = 0;
1056 #define CMD(op, n)                                              \
1057          do {                                                   \
1058                 if (dev->ops->op) {                             \
1059                         i++;                                    \
1060                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1061                                 goto nla_put_failure;           \
1062                 }                                               \
1063         } while (0)
1064
1065         CMD(add_virtual_intf, NEW_INTERFACE);
1066         CMD(change_virtual_intf, SET_INTERFACE);
1067         CMD(add_key, NEW_KEY);
1068         CMD(start_ap, START_AP);
1069         CMD(add_station, NEW_STATION);
1070         CMD(add_mpath, NEW_MPATH);
1071         CMD(update_mesh_config, SET_MESH_CONFIG);
1072         CMD(change_bss, SET_BSS);
1073         CMD(auth, AUTHENTICATE);
1074         CMD(assoc, ASSOCIATE);
1075         CMD(deauth, DEAUTHENTICATE);
1076         CMD(disassoc, DISASSOCIATE);
1077         CMD(join_ibss, JOIN_IBSS);
1078         CMD(join_mesh, JOIN_MESH);
1079         CMD(set_pmksa, SET_PMKSA);
1080         CMD(del_pmksa, DEL_PMKSA);
1081         CMD(flush_pmksa, FLUSH_PMKSA);
1082         if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1083                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1084         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1085         CMD(mgmt_tx, FRAME);
1086         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1087         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1088                 i++;
1089                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1090                         goto nla_put_failure;
1091         }
1092         if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1093             dev->ops->join_mesh) {
1094                 i++;
1095                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1096                         goto nla_put_failure;
1097         }
1098         CMD(set_wds_peer, SET_WDS_PEER);
1099         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1100                 CMD(tdls_mgmt, TDLS_MGMT);
1101                 CMD(tdls_oper, TDLS_OPER);
1102         }
1103         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1104                 CMD(sched_scan_start, START_SCHED_SCAN);
1105         CMD(probe_client, PROBE_CLIENT);
1106         CMD(set_noack_map, SET_NOACK_MAP);
1107         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1108                 i++;
1109                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1110                         goto nla_put_failure;
1111         }
1112         CMD(start_p2p_device, START_P2P_DEVICE);
1113         CMD(set_mcast_rate, SET_MCAST_RATE);
1114
1115 #ifdef CONFIG_NL80211_TESTMODE
1116         CMD(testmode_cmd, TESTMODE);
1117 #endif
1118
1119 #undef CMD
1120
1121         if (dev->ops->connect || dev->ops->auth) {
1122                 i++;
1123                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1124                         goto nla_put_failure;
1125         }
1126
1127         if (dev->ops->disconnect || dev->ops->deauth) {
1128                 i++;
1129                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1130                         goto nla_put_failure;
1131         }
1132
1133         nla_nest_end(msg, nl_cmds);
1134
1135         if (dev->ops->remain_on_channel &&
1136             (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1137             nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1138                         dev->wiphy.max_remain_on_channel_duration))
1139                 goto nla_put_failure;
1140
1141         if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1142             nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1143                 goto nla_put_failure;
1144
1145         if (mgmt_stypes) {
1146                 u16 stypes;
1147                 struct nlattr *nl_ftypes, *nl_ifs;
1148                 enum nl80211_iftype ift;
1149
1150                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1151                 if (!nl_ifs)
1152                         goto nla_put_failure;
1153
1154                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1155                         nl_ftypes = nla_nest_start(msg, ift);
1156                         if (!nl_ftypes)
1157                                 goto nla_put_failure;
1158                         i = 0;
1159                         stypes = mgmt_stypes[ift].tx;
1160                         while (stypes) {
1161                                 if ((stypes & 1) &&
1162                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1163                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1164                                         goto nla_put_failure;
1165                                 stypes >>= 1;
1166                                 i++;
1167                         }
1168                         nla_nest_end(msg, nl_ftypes);
1169                 }
1170
1171                 nla_nest_end(msg, nl_ifs);
1172
1173                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1174                 if (!nl_ifs)
1175                         goto nla_put_failure;
1176
1177                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1178                         nl_ftypes = nla_nest_start(msg, ift);
1179                         if (!nl_ftypes)
1180                                 goto nla_put_failure;
1181                         i = 0;
1182                         stypes = mgmt_stypes[ift].rx;
1183                         while (stypes) {
1184                                 if ((stypes & 1) &&
1185                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1186                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1187                                         goto nla_put_failure;
1188                                 stypes >>= 1;
1189                                 i++;
1190                         }
1191                         nla_nest_end(msg, nl_ftypes);
1192                 }
1193                 nla_nest_end(msg, nl_ifs);
1194         }
1195
1196 #ifdef CONFIG_PM
1197         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
1198                 struct nlattr *nl_wowlan;
1199
1200                 nl_wowlan = nla_nest_start(msg,
1201                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1202                 if (!nl_wowlan)
1203                         goto nla_put_failure;
1204
1205                 if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1206                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1207                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1208                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1209                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1210                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1211                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1212                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1213                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1214                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1215                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1216                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1217                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1218                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1219                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1220                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1221                     goto nla_put_failure;
1222                 if (dev->wiphy.wowlan.n_patterns) {
1223                         struct nl80211_wowlan_pattern_support pat = {
1224                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
1225                                 .min_pattern_len =
1226                                         dev->wiphy.wowlan.pattern_min_len,
1227                                 .max_pattern_len =
1228                                         dev->wiphy.wowlan.pattern_max_len,
1229                         };
1230                         if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1231                                     sizeof(pat), &pat))
1232                                 goto nla_put_failure;
1233                 }
1234
1235                 nla_nest_end(msg, nl_wowlan);
1236         }
1237 #endif
1238
1239         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1240                                 dev->wiphy.software_iftypes))
1241                 goto nla_put_failure;
1242
1243         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1244                 goto nla_put_failure;
1245
1246         if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1247             nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1248                         dev->wiphy.ap_sme_capa))
1249                 goto nla_put_failure;
1250
1251         if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
1252                         dev->wiphy.features))
1253                 goto nla_put_failure;
1254
1255         if (dev->wiphy.ht_capa_mod_mask &&
1256             nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1257                     sizeof(*dev->wiphy.ht_capa_mod_mask),
1258                     dev->wiphy.ht_capa_mod_mask))
1259                 goto nla_put_failure;
1260
1261         return genlmsg_end(msg, hdr);
1262
1263  nla_put_failure:
1264         genlmsg_cancel(msg, hdr);
1265         return -EMSGSIZE;
1266 }
1267
1268 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1269 {
1270         int idx = 0;
1271         int start = cb->args[0];
1272         struct cfg80211_registered_device *dev;
1273
1274         mutex_lock(&cfg80211_mutex);
1275         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1276                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1277                         continue;
1278                 if (++idx <= start)
1279                         continue;
1280                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).portid,
1281                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1282                                        dev) < 0) {
1283                         idx--;
1284                         break;
1285                 }
1286         }
1287         mutex_unlock(&cfg80211_mutex);
1288
1289         cb->args[0] = idx;
1290
1291         return skb->len;
1292 }
1293
1294 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1295 {
1296         struct sk_buff *msg;
1297         struct cfg80211_registered_device *dev = info->user_ptr[0];
1298
1299         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1300         if (!msg)
1301                 return -ENOMEM;
1302
1303         if (nl80211_send_wiphy(msg, info->snd_portid, info->snd_seq, 0, dev) < 0) {
1304                 nlmsg_free(msg);
1305                 return -ENOBUFS;
1306         }
1307
1308         return genlmsg_reply(msg, info);
1309 }
1310
1311 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1312         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1313         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1314         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1315         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1316         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1317 };
1318
1319 static int parse_txq_params(struct nlattr *tb[],
1320                             struct ieee80211_txq_params *txq_params)
1321 {
1322         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1323             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1324             !tb[NL80211_TXQ_ATTR_AIFS])
1325                 return -EINVAL;
1326
1327         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1328         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1329         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1330         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1331         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1332
1333         if (txq_params->ac >= NL80211_NUM_ACS)
1334                 return -EINVAL;
1335
1336         return 0;
1337 }
1338
1339 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1340 {
1341         /*
1342          * You can only set the channel explicitly for WDS interfaces,
1343          * all others have their channel managed via their respective
1344          * "establish a connection" command (connect, join, ...)
1345          *
1346          * For AP/GO and mesh mode, the channel can be set with the
1347          * channel userspace API, but is only stored and passed to the
1348          * low-level driver when the AP starts or the mesh is joined.
1349          * This is for backward compatibility, userspace can also give
1350          * the channel in the start-ap or join-mesh commands instead.
1351          *
1352          * Monitors are special as they are normally slaved to
1353          * whatever else is going on, so they have their own special
1354          * operation to set the monitor channel if possible.
1355          */
1356         return !wdev ||
1357                 wdev->iftype == NL80211_IFTYPE_AP ||
1358                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1359                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1360                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1361 }
1362
1363 static bool nl80211_valid_channel_type(struct genl_info *info,
1364                                        enum nl80211_channel_type *channel_type)
1365 {
1366         enum nl80211_channel_type tmp;
1367
1368         if (!info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1369                 return false;
1370
1371         tmp = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1372         if (tmp != NL80211_CHAN_NO_HT &&
1373             tmp != NL80211_CHAN_HT20 &&
1374             tmp != NL80211_CHAN_HT40PLUS &&
1375             tmp != NL80211_CHAN_HT40MINUS)
1376                 return false;
1377
1378         if (channel_type)
1379                 *channel_type = tmp;
1380
1381         return true;
1382 }
1383
1384 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1385                                  struct wireless_dev *wdev,
1386                                  struct genl_info *info)
1387 {
1388         struct ieee80211_channel *channel;
1389         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1390         u32 freq;
1391         int result;
1392         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1393
1394         if (wdev)
1395                 iftype = wdev->iftype;
1396
1397         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1398                 return -EINVAL;
1399
1400         if (!nl80211_can_set_dev_channel(wdev))
1401                 return -EOPNOTSUPP;
1402
1403         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
1404             !nl80211_valid_channel_type(info, &channel_type))
1405                 return -EINVAL;
1406
1407         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1408
1409         mutex_lock(&rdev->devlist_mtx);
1410         switch (iftype) {
1411         case NL80211_IFTYPE_AP:
1412         case NL80211_IFTYPE_P2P_GO:
1413                 if (wdev->beacon_interval) {
1414                         result = -EBUSY;
1415                         break;
1416                 }
1417                 channel = rdev_freq_to_chan(rdev, freq, channel_type);
1418                 if (!channel || !cfg80211_can_beacon_sec_chan(&rdev->wiphy,
1419                                                               channel,
1420                                                               channel_type)) {
1421                         result = -EINVAL;
1422                         break;
1423                 }
1424                 wdev->preset_chan = channel;
1425                 wdev->preset_chantype = channel_type;
1426                 result = 0;
1427                 break;
1428         case NL80211_IFTYPE_MESH_POINT:
1429                 result = cfg80211_set_mesh_freq(rdev, wdev, freq, channel_type);
1430                 break;
1431         case NL80211_IFTYPE_MONITOR:
1432                 result = cfg80211_set_monitor_channel(rdev, freq, channel_type);
1433                 break;
1434         default:
1435                 result = -EINVAL;
1436         }
1437         mutex_unlock(&rdev->devlist_mtx);
1438
1439         return result;
1440 }
1441
1442 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1443 {
1444         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1445         struct net_device *netdev = info->user_ptr[1];
1446
1447         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1448 }
1449
1450 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1451 {
1452         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1453         struct net_device *dev = info->user_ptr[1];
1454         struct wireless_dev *wdev = dev->ieee80211_ptr;
1455         const u8 *bssid;
1456
1457         if (!info->attrs[NL80211_ATTR_MAC])
1458                 return -EINVAL;
1459
1460         if (netif_running(dev))
1461                 return -EBUSY;
1462
1463         if (!rdev->ops->set_wds_peer)
1464                 return -EOPNOTSUPP;
1465
1466         if (wdev->iftype != NL80211_IFTYPE_WDS)
1467                 return -EOPNOTSUPP;
1468
1469         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1470         return rdev_set_wds_peer(rdev, dev, bssid);
1471 }
1472
1473
1474 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1475 {
1476         struct cfg80211_registered_device *rdev;
1477         struct net_device *netdev = NULL;
1478         struct wireless_dev *wdev;
1479         int result = 0, rem_txq_params = 0;
1480         struct nlattr *nl_txq_params;
1481         u32 changed;
1482         u8 retry_short = 0, retry_long = 0;
1483         u32 frag_threshold = 0, rts_threshold = 0;
1484         u8 coverage_class = 0;
1485
1486         /*
1487          * Try to find the wiphy and netdev. Normally this
1488          * function shouldn't need the netdev, but this is
1489          * done for backward compatibility -- previously
1490          * setting the channel was done per wiphy, but now
1491          * it is per netdev. Previous userland like hostapd
1492          * also passed a netdev to set_wiphy, so that it is
1493          * possible to let that go to the right netdev!
1494          */
1495         mutex_lock(&cfg80211_mutex);
1496
1497         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1498                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1499
1500                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1501                 if (netdev && netdev->ieee80211_ptr) {
1502                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1503                         mutex_lock(&rdev->mtx);
1504                 } else
1505                         netdev = NULL;
1506         }
1507
1508         if (!netdev) {
1509                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1510                                                   info->attrs);
1511                 if (IS_ERR(rdev)) {
1512                         mutex_unlock(&cfg80211_mutex);
1513                         return PTR_ERR(rdev);
1514                 }
1515                 wdev = NULL;
1516                 netdev = NULL;
1517                 result = 0;
1518
1519                 mutex_lock(&rdev->mtx);
1520         } else
1521                 wdev = netdev->ieee80211_ptr;
1522
1523         /*
1524          * end workaround code, by now the rdev is available
1525          * and locked, and wdev may or may not be NULL.
1526          */
1527
1528         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1529                 result = cfg80211_dev_rename(
1530                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1531
1532         mutex_unlock(&cfg80211_mutex);
1533
1534         if (result)
1535                 goto bad_res;
1536
1537         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1538                 struct ieee80211_txq_params txq_params;
1539                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1540
1541                 if (!rdev->ops->set_txq_params) {
1542                         result = -EOPNOTSUPP;
1543                         goto bad_res;
1544                 }
1545
1546                 if (!netdev) {
1547                         result = -EINVAL;
1548                         goto bad_res;
1549                 }
1550
1551                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1552                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1553                         result = -EINVAL;
1554                         goto bad_res;
1555                 }
1556
1557                 if (!netif_running(netdev)) {
1558                         result = -ENETDOWN;
1559                         goto bad_res;
1560                 }
1561
1562                 nla_for_each_nested(nl_txq_params,
1563                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1564                                     rem_txq_params) {
1565                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1566                                   nla_data(nl_txq_params),
1567                                   nla_len(nl_txq_params),
1568                                   txq_params_policy);
1569                         result = parse_txq_params(tb, &txq_params);
1570                         if (result)
1571                                 goto bad_res;
1572
1573                         result = rdev_set_txq_params(rdev, netdev,
1574                                                      &txq_params);
1575                         if (result)
1576                                 goto bad_res;
1577                 }
1578         }
1579
1580         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1581                 result = __nl80211_set_channel(rdev,
1582                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1583                                 info);
1584                 if (result)
1585                         goto bad_res;
1586         }
1587
1588         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1589                 struct wireless_dev *txp_wdev = wdev;
1590                 enum nl80211_tx_power_setting type;
1591                 int idx, mbm = 0;
1592
1593                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1594                         txp_wdev = NULL;
1595
1596                 if (!rdev->ops->set_tx_power) {
1597                         result = -EOPNOTSUPP;
1598                         goto bad_res;
1599                 }
1600
1601                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1602                 type = nla_get_u32(info->attrs[idx]);
1603
1604                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1605                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1606                         result = -EINVAL;
1607                         goto bad_res;
1608                 }
1609
1610                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1611                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1612                         mbm = nla_get_u32(info->attrs[idx]);
1613                 }
1614
1615                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1616                 if (result)
1617                         goto bad_res;
1618         }
1619
1620         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1621             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1622                 u32 tx_ant, rx_ant;
1623                 if ((!rdev->wiphy.available_antennas_tx &&
1624                      !rdev->wiphy.available_antennas_rx) ||
1625                     !rdev->ops->set_antenna) {
1626                         result = -EOPNOTSUPP;
1627                         goto bad_res;
1628                 }
1629
1630                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1631                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1632
1633                 /* reject antenna configurations which don't match the
1634                  * available antenna masks, except for the "all" mask */
1635                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1636                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1637                         result = -EINVAL;
1638                         goto bad_res;
1639                 }
1640
1641                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1642                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1643
1644                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
1645                 if (result)
1646                         goto bad_res;
1647         }
1648
1649         changed = 0;
1650
1651         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1652                 retry_short = nla_get_u8(
1653                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1654                 if (retry_short == 0) {
1655                         result = -EINVAL;
1656                         goto bad_res;
1657                 }
1658                 changed |= WIPHY_PARAM_RETRY_SHORT;
1659         }
1660
1661         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1662                 retry_long = nla_get_u8(
1663                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1664                 if (retry_long == 0) {
1665                         result = -EINVAL;
1666                         goto bad_res;
1667                 }
1668                 changed |= WIPHY_PARAM_RETRY_LONG;
1669         }
1670
1671         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1672                 frag_threshold = nla_get_u32(
1673                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1674                 if (frag_threshold < 256) {
1675                         result = -EINVAL;
1676                         goto bad_res;
1677                 }
1678                 if (frag_threshold != (u32) -1) {
1679                         /*
1680                          * Fragments (apart from the last one) are required to
1681                          * have even length. Make the fragmentation code
1682                          * simpler by stripping LSB should someone try to use
1683                          * odd threshold value.
1684                          */
1685                         frag_threshold &= ~0x1;
1686                 }
1687                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1688         }
1689
1690         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1691                 rts_threshold = nla_get_u32(
1692                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1693                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1694         }
1695
1696         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1697                 coverage_class = nla_get_u8(
1698                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1699                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1700         }
1701
1702         if (changed) {
1703                 u8 old_retry_short, old_retry_long;
1704                 u32 old_frag_threshold, old_rts_threshold;
1705                 u8 old_coverage_class;
1706
1707                 if (!rdev->ops->set_wiphy_params) {
1708                         result = -EOPNOTSUPP;
1709                         goto bad_res;
1710                 }
1711
1712                 old_retry_short = rdev->wiphy.retry_short;
1713                 old_retry_long = rdev->wiphy.retry_long;
1714                 old_frag_threshold = rdev->wiphy.frag_threshold;
1715                 old_rts_threshold = rdev->wiphy.rts_threshold;
1716                 old_coverage_class = rdev->wiphy.coverage_class;
1717
1718                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1719                         rdev->wiphy.retry_short = retry_short;
1720                 if (changed & WIPHY_PARAM_RETRY_LONG)
1721                         rdev->wiphy.retry_long = retry_long;
1722                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1723                         rdev->wiphy.frag_threshold = frag_threshold;
1724                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1725                         rdev->wiphy.rts_threshold = rts_threshold;
1726                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1727                         rdev->wiphy.coverage_class = coverage_class;
1728
1729                 result = rdev_set_wiphy_params(rdev, changed);
1730                 if (result) {
1731                         rdev->wiphy.retry_short = old_retry_short;
1732                         rdev->wiphy.retry_long = old_retry_long;
1733                         rdev->wiphy.frag_threshold = old_frag_threshold;
1734                         rdev->wiphy.rts_threshold = old_rts_threshold;
1735                         rdev->wiphy.coverage_class = old_coverage_class;
1736                 }
1737         }
1738
1739  bad_res:
1740         mutex_unlock(&rdev->mtx);
1741         if (netdev)
1742                 dev_put(netdev);
1743         return result;
1744 }
1745
1746 static inline u64 wdev_id(struct wireless_dev *wdev)
1747 {
1748         return (u64)wdev->identifier |
1749                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
1750 }
1751
1752 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
1753                               struct cfg80211_registered_device *rdev,
1754                               struct wireless_dev *wdev)
1755 {
1756         struct net_device *dev = wdev->netdev;
1757         void *hdr;
1758
1759         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1760         if (!hdr)
1761                 return -1;
1762
1763         if (dev &&
1764             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
1765              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
1766                 goto nla_put_failure;
1767
1768         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1769             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
1770             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
1771             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
1772             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1773                         rdev->devlist_generation ^
1774                         (cfg80211_rdev_list_generation << 2)))
1775                 goto nla_put_failure;
1776
1777         if (rdev->ops->get_channel) {
1778                 struct ieee80211_channel *chan;
1779                 enum nl80211_channel_type channel_type;
1780
1781                 chan = rdev_get_channel(rdev, wdev, &channel_type);
1782                 if (chan &&
1783                     (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
1784                                  chan->center_freq) ||
1785                      nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
1786                                  channel_type)))
1787                         goto nla_put_failure;
1788         }
1789
1790         if (wdev->ssid_len) {
1791                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
1792                         goto nla_put_failure;
1793         }
1794
1795         return genlmsg_end(msg, hdr);
1796
1797  nla_put_failure:
1798         genlmsg_cancel(msg, hdr);
1799         return -EMSGSIZE;
1800 }
1801
1802 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1803 {
1804         int wp_idx = 0;
1805         int if_idx = 0;
1806         int wp_start = cb->args[0];
1807         int if_start = cb->args[1];
1808         struct cfg80211_registered_device *rdev;
1809         struct wireless_dev *wdev;
1810
1811         mutex_lock(&cfg80211_mutex);
1812         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1813                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1814                         continue;
1815                 if (wp_idx < wp_start) {
1816                         wp_idx++;
1817                         continue;
1818                 }
1819                 if_idx = 0;
1820
1821                 mutex_lock(&rdev->devlist_mtx);
1822                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
1823                         if (if_idx < if_start) {
1824                                 if_idx++;
1825                                 continue;
1826                         }
1827                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
1828                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1829                                                rdev, wdev) < 0) {
1830                                 mutex_unlock(&rdev->devlist_mtx);
1831                                 goto out;
1832                         }
1833                         if_idx++;
1834                 }
1835                 mutex_unlock(&rdev->devlist_mtx);
1836
1837                 wp_idx++;
1838         }
1839  out:
1840         mutex_unlock(&cfg80211_mutex);
1841
1842         cb->args[0] = wp_idx;
1843         cb->args[1] = if_idx;
1844
1845         return skb->len;
1846 }
1847
1848 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1849 {
1850         struct sk_buff *msg;
1851         struct cfg80211_registered_device *dev = info->user_ptr[0];
1852         struct wireless_dev *wdev = info->user_ptr[1];
1853
1854         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1855         if (!msg)
1856                 return -ENOMEM;
1857
1858         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
1859                                dev, wdev) < 0) {
1860                 nlmsg_free(msg);
1861                 return -ENOBUFS;
1862         }
1863
1864         return genlmsg_reply(msg, info);
1865 }
1866
1867 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1868         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1869         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1870         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1871         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1872         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1873 };
1874
1875 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1876 {
1877         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1878         int flag;
1879
1880         *mntrflags = 0;
1881
1882         if (!nla)
1883                 return -EINVAL;
1884
1885         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1886                              nla, mntr_flags_policy))
1887                 return -EINVAL;
1888
1889         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1890                 if (flags[flag])
1891                         *mntrflags |= (1<<flag);
1892
1893         return 0;
1894 }
1895
1896 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1897                                struct net_device *netdev, u8 use_4addr,
1898                                enum nl80211_iftype iftype)
1899 {
1900         if (!use_4addr) {
1901                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1902                         return -EBUSY;
1903                 return 0;
1904         }
1905
1906         switch (iftype) {
1907         case NL80211_IFTYPE_AP_VLAN:
1908                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1909                         return 0;
1910                 break;
1911         case NL80211_IFTYPE_STATION:
1912                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1913                         return 0;
1914                 break;
1915         default:
1916                 break;
1917         }
1918
1919         return -EOPNOTSUPP;
1920 }
1921
1922 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1923 {
1924         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1925         struct vif_params params;
1926         int err;
1927         enum nl80211_iftype otype, ntype;
1928         struct net_device *dev = info->user_ptr[1];
1929         u32 _flags, *flags = NULL;
1930         bool change = false;
1931
1932         memset(&params, 0, sizeof(params));
1933
1934         otype = ntype = dev->ieee80211_ptr->iftype;
1935
1936         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1937                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1938                 if (otype != ntype)
1939                         change = true;
1940                 if (ntype > NL80211_IFTYPE_MAX)
1941                         return -EINVAL;
1942         }
1943
1944         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1945                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1946
1947                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1948                         return -EINVAL;
1949                 if (netif_running(dev))
1950                         return -EBUSY;
1951
1952                 wdev_lock(wdev);
1953                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1954                              IEEE80211_MAX_MESH_ID_LEN);
1955                 wdev->mesh_id_up_len =
1956                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1957                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1958                        wdev->mesh_id_up_len);
1959                 wdev_unlock(wdev);
1960         }
1961
1962         if (info->attrs[NL80211_ATTR_4ADDR]) {
1963                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1964                 change = true;
1965                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1966                 if (err)
1967                         return err;
1968         } else {
1969                 params.use_4addr = -1;
1970         }
1971
1972         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1973                 if (ntype != NL80211_IFTYPE_MONITOR)
1974                         return -EINVAL;
1975                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1976                                           &_flags);
1977                 if (err)
1978                         return err;
1979
1980                 flags = &_flags;
1981                 change = true;
1982         }
1983
1984         if (change)
1985                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1986         else
1987                 err = 0;
1988
1989         if (!err && params.use_4addr != -1)
1990                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1991
1992         return err;
1993 }
1994
1995 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1996 {
1997         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1998         struct vif_params params;
1999         struct wireless_dev *wdev;
2000         struct sk_buff *msg;
2001         int err;
2002         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2003         u32 flags;
2004
2005         memset(&params, 0, sizeof(params));
2006
2007         if (!info->attrs[NL80211_ATTR_IFNAME])
2008                 return -EINVAL;
2009
2010         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2011                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2012                 if (type > NL80211_IFTYPE_MAX)
2013                         return -EINVAL;
2014         }
2015
2016         if (!rdev->ops->add_virtual_intf ||
2017             !(rdev->wiphy.interface_modes & (1 << type)))
2018                 return -EOPNOTSUPP;
2019
2020         if (info->attrs[NL80211_ATTR_4ADDR]) {
2021                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2022                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2023                 if (err)
2024                         return err;
2025         }
2026
2027         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2028         if (!msg)
2029                 return -ENOMEM;
2030
2031         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2032                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2033                                   &flags);
2034         wdev = rdev_add_virtual_intf(rdev,
2035                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2036                                 type, err ? NULL : &flags, &params);
2037         if (IS_ERR(wdev)) {
2038                 nlmsg_free(msg);
2039                 return PTR_ERR(wdev);
2040         }
2041
2042         switch (type) {
2043         case NL80211_IFTYPE_MESH_POINT:
2044                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2045                         break;
2046                 wdev_lock(wdev);
2047                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2048                              IEEE80211_MAX_MESH_ID_LEN);
2049                 wdev->mesh_id_up_len =
2050                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2051                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2052                        wdev->mesh_id_up_len);
2053                 wdev_unlock(wdev);
2054                 break;
2055         case NL80211_IFTYPE_P2P_DEVICE:
2056                 /*
2057                  * P2P Device doesn't have a netdev, so doesn't go
2058                  * through the netdev notifier and must be added here
2059                  */
2060                 mutex_init(&wdev->mtx);
2061                 INIT_LIST_HEAD(&wdev->event_list);
2062                 spin_lock_init(&wdev->event_lock);
2063                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2064                 spin_lock_init(&wdev->mgmt_registrations_lock);
2065
2066                 mutex_lock(&rdev->devlist_mtx);
2067                 wdev->identifier = ++rdev->wdev_id;
2068                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2069                 rdev->devlist_generation++;
2070                 mutex_unlock(&rdev->devlist_mtx);
2071                 break;
2072         default:
2073                 break;
2074         }
2075
2076         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2077                                rdev, wdev) < 0) {
2078                 nlmsg_free(msg);
2079                 return -ENOBUFS;
2080         }
2081
2082         return genlmsg_reply(msg, info);
2083 }
2084
2085 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2086 {
2087         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2088         struct wireless_dev *wdev = info->user_ptr[1];
2089
2090         if (!rdev->ops->del_virtual_intf)
2091                 return -EOPNOTSUPP;
2092
2093         /*
2094          * If we remove a wireless device without a netdev then clear
2095          * user_ptr[1] so that nl80211_post_doit won't dereference it
2096          * to check if it needs to do dev_put(). Otherwise it crashes
2097          * since the wdev has been freed, unlike with a netdev where
2098          * we need the dev_put() for the netdev to really be freed.
2099          */
2100         if (!wdev->netdev)
2101                 info->user_ptr[1] = NULL;
2102
2103         return rdev_del_virtual_intf(rdev, wdev);
2104 }
2105
2106 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2107 {
2108         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2109         struct net_device *dev = info->user_ptr[1];
2110         u16 noack_map;
2111
2112         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2113                 return -EINVAL;
2114
2115         if (!rdev->ops->set_noack_map)
2116                 return -EOPNOTSUPP;
2117
2118         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2119
2120         return rdev_set_noack_map(rdev, dev, noack_map);
2121 }
2122
2123 struct get_key_cookie {
2124         struct sk_buff *msg;
2125         int error;
2126         int idx;
2127 };
2128
2129 static void get_key_callback(void *c, struct key_params *params)
2130 {
2131         struct nlattr *key;
2132         struct get_key_cookie *cookie = c;
2133
2134         if ((params->key &&
2135              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2136                      params->key_len, params->key)) ||
2137             (params->seq &&
2138              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2139                      params->seq_len, params->seq)) ||
2140             (params->cipher &&
2141              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2142                          params->cipher)))
2143                 goto nla_put_failure;
2144
2145         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2146         if (!key)
2147                 goto nla_put_failure;
2148
2149         if ((params->key &&
2150              nla_put(cookie->msg, NL80211_KEY_DATA,
2151                      params->key_len, params->key)) ||
2152             (params->seq &&
2153              nla_put(cookie->msg, NL80211_KEY_SEQ,
2154                      params->seq_len, params->seq)) ||
2155             (params->cipher &&
2156              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2157                          params->cipher)))
2158                 goto nla_put_failure;
2159
2160         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2161                 goto nla_put_failure;
2162
2163         nla_nest_end(cookie->msg, key);
2164
2165         return;
2166  nla_put_failure:
2167         cookie->error = 1;
2168 }
2169
2170 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2171 {
2172         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2173         int err;
2174         struct net_device *dev = info->user_ptr[1];
2175         u8 key_idx = 0;
2176         const u8 *mac_addr = NULL;
2177         bool pairwise;
2178         struct get_key_cookie cookie = {
2179                 .error = 0,
2180         };
2181         void *hdr;
2182         struct sk_buff *msg;
2183
2184         if (info->attrs[NL80211_ATTR_KEY_IDX])
2185                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2186
2187         if (key_idx > 5)
2188                 return -EINVAL;
2189
2190         if (info->attrs[NL80211_ATTR_MAC])
2191                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2192
2193         pairwise = !!mac_addr;
2194         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2195                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2196                 if (kt >= NUM_NL80211_KEYTYPES)
2197                         return -EINVAL;
2198                 if (kt != NL80211_KEYTYPE_GROUP &&
2199                     kt != NL80211_KEYTYPE_PAIRWISE)
2200                         return -EINVAL;
2201                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2202         }
2203
2204         if (!rdev->ops->get_key)
2205                 return -EOPNOTSUPP;
2206
2207         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2208         if (!msg)
2209                 return -ENOMEM;
2210
2211         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2212                              NL80211_CMD_NEW_KEY);
2213         if (IS_ERR(hdr))
2214                 return PTR_ERR(hdr);
2215
2216         cookie.msg = msg;
2217         cookie.idx = key_idx;
2218
2219         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2220             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2221                 goto nla_put_failure;
2222         if (mac_addr &&
2223             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2224                 goto nla_put_failure;
2225
2226         if (pairwise && mac_addr &&
2227             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2228                 return -ENOENT;
2229
2230         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2231                            get_key_callback);
2232
2233         if (err)
2234                 goto free_msg;
2235
2236         if (cookie.error)
2237                 goto nla_put_failure;
2238
2239         genlmsg_end(msg, hdr);
2240         return genlmsg_reply(msg, info);
2241
2242  nla_put_failure:
2243         err = -ENOBUFS;
2244  free_msg:
2245         nlmsg_free(msg);
2246         return err;
2247 }
2248
2249 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2250 {
2251         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2252         struct key_parse key;
2253         int err;
2254         struct net_device *dev = info->user_ptr[1];
2255
2256         err = nl80211_parse_key(info, &key);
2257         if (err)
2258                 return err;
2259
2260         if (key.idx < 0)
2261                 return -EINVAL;
2262
2263         /* only support setting default key */
2264         if (!key.def && !key.defmgmt)
2265                 return -EINVAL;
2266
2267         wdev_lock(dev->ieee80211_ptr);
2268
2269         if (key.def) {
2270                 if (!rdev->ops->set_default_key) {
2271                         err = -EOPNOTSUPP;
2272                         goto out;
2273                 }
2274
2275                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2276                 if (err)
2277                         goto out;
2278
2279                 err = rdev_set_default_key(rdev, dev, key.idx,
2280                                                  key.def_uni, key.def_multi);
2281
2282                 if (err)
2283                         goto out;
2284
2285 #ifdef CONFIG_CFG80211_WEXT
2286                 dev->ieee80211_ptr->wext.default_key = key.idx;
2287 #endif
2288         } else {
2289                 if (key.def_uni || !key.def_multi) {
2290                         err = -EINVAL;
2291                         goto out;
2292                 }
2293
2294                 if (!rdev->ops->set_default_mgmt_key) {
2295                         err = -EOPNOTSUPP;
2296                         goto out;
2297                 }
2298
2299                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2300                 if (err)
2301                         goto out;
2302
2303                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2304                 if (err)
2305                         goto out;
2306
2307 #ifdef CONFIG_CFG80211_WEXT
2308                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2309 #endif
2310         }
2311
2312  out:
2313         wdev_unlock(dev->ieee80211_ptr);
2314
2315         return err;
2316 }
2317
2318 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2319 {
2320         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2321         int err;
2322         struct net_device *dev = info->user_ptr[1];
2323         struct key_parse key;
2324         const u8 *mac_addr = NULL;
2325
2326         err = nl80211_parse_key(info, &key);
2327         if (err)
2328                 return err;
2329
2330         if (!key.p.key)
2331                 return -EINVAL;
2332
2333         if (info->attrs[NL80211_ATTR_MAC])
2334                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2335
2336         if (key.type == -1) {
2337                 if (mac_addr)
2338                         key.type = NL80211_KEYTYPE_PAIRWISE;
2339                 else
2340                         key.type = NL80211_KEYTYPE_GROUP;
2341         }
2342
2343         /* for now */
2344         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2345             key.type != NL80211_KEYTYPE_GROUP)
2346                 return -EINVAL;
2347
2348         if (!rdev->ops->add_key)
2349                 return -EOPNOTSUPP;
2350
2351         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2352                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2353                                            mac_addr))
2354                 return -EINVAL;
2355
2356         wdev_lock(dev->ieee80211_ptr);
2357         err = nl80211_key_allowed(dev->ieee80211_ptr);
2358         if (!err)
2359                 err = rdev_add_key(rdev, dev, key.idx,
2360                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2361                                     mac_addr, &key.p);
2362         wdev_unlock(dev->ieee80211_ptr);
2363
2364         return err;
2365 }
2366
2367 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2368 {
2369         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2370         int err;
2371         struct net_device *dev = info->user_ptr[1];
2372         u8 *mac_addr = NULL;
2373         struct key_parse key;
2374
2375         err = nl80211_parse_key(info, &key);
2376         if (err)
2377                 return err;
2378
2379         if (info->attrs[NL80211_ATTR_MAC])
2380                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2381
2382         if (key.type == -1) {
2383                 if (mac_addr)
2384                         key.type = NL80211_KEYTYPE_PAIRWISE;
2385                 else
2386                         key.type = NL80211_KEYTYPE_GROUP;
2387         }
2388
2389         /* for now */
2390         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2391             key.type != NL80211_KEYTYPE_GROUP)
2392                 return -EINVAL;
2393
2394         if (!rdev->ops->del_key)
2395                 return -EOPNOTSUPP;
2396
2397         wdev_lock(dev->ieee80211_ptr);
2398         err = nl80211_key_allowed(dev->ieee80211_ptr);
2399
2400         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2401             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2402                 err = -ENOENT;
2403
2404         if (!err)
2405                 err = rdev_del_key(rdev, dev, key.idx,
2406                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2407                                    mac_addr);
2408
2409 #ifdef CONFIG_CFG80211_WEXT
2410         if (!err) {
2411                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2412                         dev->ieee80211_ptr->wext.default_key = -1;
2413                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2414                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2415         }
2416 #endif
2417         wdev_unlock(dev->ieee80211_ptr);
2418
2419         return err;
2420 }
2421
2422 static int nl80211_parse_beacon(struct genl_info *info,
2423                                 struct cfg80211_beacon_data *bcn)
2424 {
2425         bool haveinfo = false;
2426
2427         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2428             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2429             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2430             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2431                 return -EINVAL;
2432
2433         memset(bcn, 0, sizeof(*bcn));
2434
2435         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2436                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2437                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2438                 if (!bcn->head_len)
2439                         return -EINVAL;
2440                 haveinfo = true;
2441         }
2442
2443         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2444                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2445                 bcn->tail_len =
2446                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2447                 haveinfo = true;
2448         }
2449
2450         if (!haveinfo)
2451                 return -EINVAL;
2452
2453         if (info->attrs[NL80211_ATTR_IE]) {
2454                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2455                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2456         }
2457
2458         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2459                 bcn->proberesp_ies =
2460                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2461                 bcn->proberesp_ies_len =
2462                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2463         }
2464
2465         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2466                 bcn->assocresp_ies =
2467                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2468                 bcn->assocresp_ies_len =
2469                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2470         }
2471
2472         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2473                 bcn->probe_resp =
2474                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2475                 bcn->probe_resp_len =
2476                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2477         }
2478
2479         return 0;
2480 }
2481
2482 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2483                                    struct cfg80211_ap_settings *params)
2484 {
2485         struct wireless_dev *wdev;
2486         bool ret = false;
2487
2488         mutex_lock(&rdev->devlist_mtx);
2489
2490         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2491                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2492                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2493                         continue;
2494
2495                 if (!wdev->preset_chan)
2496                         continue;
2497
2498                 params->channel = wdev->preset_chan;
2499                 params->channel_type = wdev->preset_chantype;
2500                 ret = true;
2501                 break;
2502         }
2503
2504         mutex_unlock(&rdev->devlist_mtx);
2505
2506         return ret;
2507 }
2508
2509 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
2510                                     enum nl80211_auth_type auth_type,
2511                                     enum nl80211_commands cmd)
2512 {
2513         if (auth_type > NL80211_AUTHTYPE_MAX)
2514                 return false;
2515
2516         switch (cmd) {
2517         case NL80211_CMD_AUTHENTICATE:
2518                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
2519                     auth_type == NL80211_AUTHTYPE_SAE)
2520                         return false;
2521                 return true;
2522         case NL80211_CMD_CONNECT:
2523         case NL80211_CMD_START_AP:
2524                 /* SAE not supported yet */
2525                 if (auth_type == NL80211_AUTHTYPE_SAE)
2526                         return false;
2527                 return true;
2528         default:
2529                 return false;
2530         }
2531 }
2532
2533 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2534 {
2535         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2536         struct net_device *dev = info->user_ptr[1];
2537         struct wireless_dev *wdev = dev->ieee80211_ptr;
2538         struct cfg80211_ap_settings params;
2539         int err;
2540
2541         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2542             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2543                 return -EOPNOTSUPP;
2544
2545         if (!rdev->ops->start_ap)
2546                 return -EOPNOTSUPP;
2547
2548         if (wdev->beacon_interval)
2549                 return -EALREADY;
2550
2551         memset(&params, 0, sizeof(params));
2552
2553         /* these are required for START_AP */
2554         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2555             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2556             !info->attrs[NL80211_ATTR_BEACON_HEAD])
2557                 return -EINVAL;
2558
2559         err = nl80211_parse_beacon(info, &params.beacon);
2560         if (err)
2561                 return err;
2562
2563         params.beacon_interval =
2564                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2565         params.dtim_period =
2566                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2567
2568         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
2569         if (err)
2570                 return err;
2571
2572         /*
2573          * In theory, some of these attributes should be required here
2574          * but since they were not used when the command was originally
2575          * added, keep them optional for old user space programs to let
2576          * them continue to work with drivers that do not need the
2577          * additional information -- drivers must check!
2578          */
2579         if (info->attrs[NL80211_ATTR_SSID]) {
2580                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2581                 params.ssid_len =
2582                         nla_len(info->attrs[NL80211_ATTR_SSID]);
2583                 if (params.ssid_len == 0 ||
2584                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
2585                         return -EINVAL;
2586         }
2587
2588         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2589                 params.hidden_ssid = nla_get_u32(
2590                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2591                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
2592                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
2593                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2594                         return -EINVAL;
2595         }
2596
2597         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2598
2599         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2600                 params.auth_type = nla_get_u32(
2601                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
2602                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
2603                                              NL80211_CMD_START_AP))
2604                         return -EINVAL;
2605         } else
2606                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2607
2608         err = nl80211_crypto_settings(rdev, info, &params.crypto,
2609                                       NL80211_MAX_NR_CIPHER_SUITES);
2610         if (err)
2611                 return err;
2612
2613         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
2614                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
2615                         return -EOPNOTSUPP;
2616                 params.inactivity_timeout = nla_get_u16(
2617                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
2618         }
2619
2620         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2621                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
2622
2623                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
2624                     !nl80211_valid_channel_type(info, &channel_type))
2625                         return -EINVAL;
2626
2627                 params.channel = rdev_freq_to_chan(rdev,
2628                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
2629                         channel_type);
2630                 if (!params.channel)
2631                         return -EINVAL;
2632                 params.channel_type = channel_type;
2633         } else if (wdev->preset_chan) {
2634                 params.channel = wdev->preset_chan;
2635                 params.channel_type = wdev->preset_chantype;
2636         } else if (!nl80211_get_ap_channel(rdev, &params))
2637                 return -EINVAL;
2638
2639         if (!cfg80211_can_beacon_sec_chan(&rdev->wiphy, params.channel,
2640                                           params.channel_type))
2641                 return -EINVAL;
2642
2643         mutex_lock(&rdev->devlist_mtx);
2644         err = cfg80211_can_use_chan(rdev, wdev, params.channel,
2645                                     CHAN_MODE_SHARED);
2646         mutex_unlock(&rdev->devlist_mtx);
2647
2648         if (err)
2649                 return err;
2650
2651         err = rdev_start_ap(rdev, dev, &params);
2652         if (!err) {
2653                 wdev->preset_chan = params.channel;
2654                 wdev->preset_chantype = params.channel_type;
2655                 wdev->beacon_interval = params.beacon_interval;
2656                 wdev->channel = params.channel;
2657                 wdev->ssid_len = params.ssid_len;
2658                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
2659         }
2660         return err;
2661 }
2662
2663 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
2664 {
2665         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2666         struct net_device *dev = info->user_ptr[1];
2667         struct wireless_dev *wdev = dev->ieee80211_ptr;
2668         struct cfg80211_beacon_data params;
2669         int err;
2670
2671         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2672             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2673                 return -EOPNOTSUPP;
2674
2675         if (!rdev->ops->change_beacon)
2676                 return -EOPNOTSUPP;
2677
2678         if (!wdev->beacon_interval)
2679                 return -EINVAL;
2680
2681         err = nl80211_parse_beacon(info, &params);
2682         if (err)
2683                 return err;
2684
2685         return rdev_change_beacon(rdev, dev, &params);
2686 }
2687
2688 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
2689 {
2690         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2691         struct net_device *dev = info->user_ptr[1];
2692
2693         return cfg80211_stop_ap(rdev, dev);
2694 }
2695
2696 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2697         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2698         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2699         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2700         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2701         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2702         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2703 };
2704
2705 static int parse_station_flags(struct genl_info *info,
2706                                enum nl80211_iftype iftype,
2707                                struct station_parameters *params)
2708 {
2709         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2710         struct nlattr *nla;
2711         int flag;
2712
2713         /*
2714          * Try parsing the new attribute first so userspace
2715          * can specify both for older kernels.
2716          */
2717         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2718         if (nla) {
2719                 struct nl80211_sta_flag_update *sta_flags;
2720
2721                 sta_flags = nla_data(nla);
2722                 params->sta_flags_mask = sta_flags->mask;
2723                 params->sta_flags_set = sta_flags->set;
2724                 if ((params->sta_flags_mask |
2725                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2726                         return -EINVAL;
2727                 return 0;
2728         }
2729
2730         /* if present, parse the old attribute */
2731
2732         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2733         if (!nla)
2734                 return 0;
2735
2736         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2737                              nla, sta_flags_policy))
2738                 return -EINVAL;
2739
2740         /*
2741          * Only allow certain flags for interface types so that
2742          * other attributes are silently ignored. Remember that
2743          * this is backward compatibility code with old userspace
2744          * and shouldn't be hit in other cases anyway.
2745          */
2746         switch (iftype) {
2747         case NL80211_IFTYPE_AP:
2748         case NL80211_IFTYPE_AP_VLAN:
2749         case NL80211_IFTYPE_P2P_GO:
2750                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2751                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2752                                          BIT(NL80211_STA_FLAG_WME) |
2753                                          BIT(NL80211_STA_FLAG_MFP);
2754                 break;
2755         case NL80211_IFTYPE_P2P_CLIENT:
2756         case NL80211_IFTYPE_STATION:
2757                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2758                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
2759                 break;
2760         case NL80211_IFTYPE_MESH_POINT:
2761                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2762                                          BIT(NL80211_STA_FLAG_MFP) |
2763                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
2764         default:
2765                 return -EINVAL;
2766         }
2767
2768         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
2769                 if (flags[flag]) {
2770                         params->sta_flags_set |= (1<<flag);
2771
2772                         /* no longer support new API additions in old API */
2773                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
2774                                 return -EINVAL;
2775                 }
2776         }
2777
2778         return 0;
2779 }
2780
2781 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2782                                  int attr)
2783 {
2784         struct nlattr *rate;
2785         u32 bitrate;
2786         u16 bitrate_compat;
2787
2788         rate = nla_nest_start(msg, attr);
2789         if (!rate)
2790                 goto nla_put_failure;
2791
2792         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2793         bitrate = cfg80211_calculate_bitrate(info);
2794         /* report 16-bit bitrate only if we can */
2795         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
2796         if ((bitrate > 0 &&
2797              nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) ||
2798             (bitrate_compat > 0 &&
2799              nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) ||
2800             ((info->flags & RATE_INFO_FLAGS_MCS) &&
2801              nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) ||
2802             ((info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) &&
2803              nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH)) ||
2804             ((info->flags & RATE_INFO_FLAGS_SHORT_GI) &&
2805              nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)))
2806                 goto nla_put_failure;
2807
2808         nla_nest_end(msg, rate);
2809         return true;
2810
2811 nla_put_failure:
2812         return false;
2813 }
2814
2815 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
2816                                 int flags,
2817                                 struct cfg80211_registered_device *rdev,
2818                                 struct net_device *dev,
2819                                 const u8 *mac_addr, struct station_info *sinfo)
2820 {
2821         void *hdr;
2822         struct nlattr *sinfoattr, *bss_param;
2823
2824         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
2825         if (!hdr)
2826                 return -1;
2827
2828         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2829             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
2830             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
2831                 goto nla_put_failure;
2832
2833         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2834         if (!sinfoattr)
2835                 goto nla_put_failure;
2836         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
2837             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2838                         sinfo->connected_time))
2839                 goto nla_put_failure;
2840         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
2841             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2842                         sinfo->inactive_time))
2843                 goto nla_put_failure;
2844         if ((sinfo->filled & STATION_INFO_RX_BYTES) &&
2845             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
2846                         sinfo->rx_bytes))
2847                 goto nla_put_failure;
2848         if ((sinfo->filled & STATION_INFO_TX_BYTES) &&
2849             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
2850                         sinfo->tx_bytes))
2851                 goto nla_put_failure;
2852         if ((sinfo->filled & STATION_INFO_LLID) &&
2853             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
2854                 goto nla_put_failure;
2855         if ((sinfo->filled & STATION_INFO_PLID) &&
2856             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
2857                 goto nla_put_failure;
2858         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
2859             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
2860                        sinfo->plink_state))
2861                 goto nla_put_failure;
2862         switch (rdev->wiphy.signal_type) {
2863         case CFG80211_SIGNAL_TYPE_MBM:
2864                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
2865                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
2866                                sinfo->signal))
2867                         goto nla_put_failure;
2868                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
2869                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2870                                sinfo->signal_avg))
2871                         goto nla_put_failure;
2872                 break;
2873         default:
2874                 break;
2875         }
2876         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2877                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2878                                           NL80211_STA_INFO_TX_BITRATE))
2879                         goto nla_put_failure;
2880         }
2881         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2882                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2883                                           NL80211_STA_INFO_RX_BITRATE))
2884                         goto nla_put_failure;
2885         }
2886         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
2887             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
2888                         sinfo->rx_packets))
2889                 goto nla_put_failure;
2890         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
2891             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
2892                         sinfo->tx_packets))
2893                 goto nla_put_failure;
2894         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
2895             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
2896                         sinfo->tx_retries))
2897                 goto nla_put_failure;
2898         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
2899             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
2900                         sinfo->tx_failed))
2901                 goto nla_put_failure;
2902         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
2903             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
2904                         sinfo->beacon_loss_count))
2905                 goto nla_put_failure;
2906         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2907                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2908                 if (!bss_param)
2909                         goto nla_put_failure;
2910
2911                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
2912                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
2913                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
2914                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
2915                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
2916                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
2917                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2918                                sinfo->bss_param.dtim_period) ||
2919                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2920                                 sinfo->bss_param.beacon_interval))
2921                         goto nla_put_failure;
2922
2923                 nla_nest_end(msg, bss_param);
2924         }
2925         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
2926             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
2927                     sizeof(struct nl80211_sta_flag_update),
2928                     &sinfo->sta_flags))
2929                 goto nla_put_failure;
2930         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
2931                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
2932                             sinfo->t_offset))
2933                 goto nla_put_failure;
2934         nla_nest_end(msg, sinfoattr);
2935
2936         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
2937             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2938                     sinfo->assoc_req_ies))
2939                 goto nla_put_failure;
2940
2941         return genlmsg_end(msg, hdr);
2942
2943  nla_put_failure:
2944         genlmsg_cancel(msg, hdr);
2945         return -EMSGSIZE;
2946 }
2947
2948 static int nl80211_dump_station(struct sk_buff *skb,
2949                                 struct netlink_callback *cb)
2950 {
2951         struct station_info sinfo;
2952         struct cfg80211_registered_device *dev;
2953         struct net_device *netdev;
2954         u8 mac_addr[ETH_ALEN];
2955         int sta_idx = cb->args[1];
2956         int err;
2957
2958         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2959         if (err)
2960                 return err;
2961
2962         if (!dev->ops->dump_station) {
2963                 err = -EOPNOTSUPP;
2964                 goto out_err;
2965         }
2966
2967         while (1) {
2968                 memset(&sinfo, 0, sizeof(sinfo));
2969                 err = rdev_dump_station(dev, netdev, sta_idx,
2970                                         mac_addr, &sinfo);
2971                 if (err == -ENOENT)
2972                         break;
2973                 if (err)
2974                         goto out_err;
2975
2976                 if (nl80211_send_station(skb,
2977                                 NETLINK_CB(cb->skb).portid,
2978                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2979                                 dev, netdev, mac_addr,
2980                                 &sinfo) < 0)
2981                         goto out;
2982
2983                 sta_idx++;
2984         }
2985
2986
2987  out:
2988         cb->args[1] = sta_idx;
2989         err = skb->len;
2990  out_err:
2991         nl80211_finish_netdev_dump(dev);
2992
2993         return err;
2994 }
2995
2996 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2997 {
2998         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2999         struct net_device *dev = info->user_ptr[1];
3000         struct station_info sinfo;
3001         struct sk_buff *msg;
3002         u8 *mac_addr = NULL;
3003         int err;
3004
3005         memset(&sinfo, 0, sizeof(sinfo));
3006
3007         if (!info->attrs[NL80211_ATTR_MAC])
3008                 return -EINVAL;
3009
3010         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3011
3012         if (!rdev->ops->get_station)
3013                 return -EOPNOTSUPP;
3014
3015         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3016         if (err)
3017                 return err;
3018
3019         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3020         if (!msg)
3021                 return -ENOMEM;
3022
3023         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3024                                  rdev, dev, mac_addr, &sinfo) < 0) {
3025                 nlmsg_free(msg);
3026                 return -ENOBUFS;
3027         }
3028
3029         return genlmsg_reply(msg, info);
3030 }
3031
3032 /*
3033  * Get vlan interface making sure it is running and on the right wiphy.
3034  */
3035 static struct net_device *get_vlan(struct genl_info *info,
3036                                    struct cfg80211_registered_device *rdev)
3037 {
3038         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3039         struct net_device *v;
3040         int ret;
3041
3042         if (!vlanattr)
3043                 return NULL;
3044
3045         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3046         if (!v)
3047                 return ERR_PTR(-ENODEV);
3048
3049         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3050                 ret = -EINVAL;
3051                 goto error;
3052         }
3053
3054         if (!netif_running(v)) {
3055                 ret = -ENETDOWN;
3056                 goto error;
3057         }
3058
3059         return v;
3060  error:
3061         dev_put(v);
3062         return ERR_PTR(ret);
3063 }
3064
3065 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3066 {
3067         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3068         int err;
3069         struct net_device *dev = info->user_ptr[1];
3070         struct station_parameters params;
3071         u8 *mac_addr = NULL;
3072
3073         memset(&params, 0, sizeof(params));
3074
3075         params.listen_interval = -1;
3076         params.plink_state = -1;
3077
3078         if (info->attrs[NL80211_ATTR_STA_AID])
3079                 return -EINVAL;
3080
3081         if (!info->attrs[NL80211_ATTR_MAC])
3082                 return -EINVAL;
3083
3084         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3085
3086         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3087                 params.supported_rates =
3088                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3089                 params.supported_rates_len =
3090                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3091         }
3092
3093         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3094                 params.listen_interval =
3095                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3096
3097         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3098                 params.ht_capa =
3099                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3100
3101         if (!rdev->ops->change_station)
3102                 return -EOPNOTSUPP;
3103
3104         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3105                 return -EINVAL;
3106
3107         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3108                 params.plink_action =
3109                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3110
3111         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
3112                 params.plink_state =
3113                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3114
3115         switch (dev->ieee80211_ptr->iftype) {
3116         case NL80211_IFTYPE_AP:
3117         case NL80211_IFTYPE_AP_VLAN:
3118         case NL80211_IFTYPE_P2P_GO:
3119                 /* disallow mesh-specific things */
3120                 if (params.plink_action)
3121                         return -EINVAL;
3122
3123                 /* TDLS can't be set, ... */
3124                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3125                         return -EINVAL;
3126                 /*
3127                  * ... but don't bother the driver with it. This works around
3128                  * a hostapd/wpa_supplicant issue -- it always includes the
3129                  * TLDS_PEER flag in the mask even for AP mode.
3130                  */
3131                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3132
3133                 /* accept only the listed bits */
3134                 if (params.sta_flags_mask &
3135                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3136                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3137                                   BIT(NL80211_STA_FLAG_WME) |
3138                                   BIT(NL80211_STA_FLAG_MFP)))
3139                         return -EINVAL;
3140
3141                 /* must be last in here for error handling */
3142                 params.vlan = get_vlan(info, rdev);
3143                 if (IS_ERR(params.vlan))
3144                         return PTR_ERR(params.vlan);
3145                 break;
3146         case NL80211_IFTYPE_P2P_CLIENT:
3147         case NL80211_IFTYPE_STATION:
3148                 /*
3149                  * Don't allow userspace to change the TDLS_PEER flag,
3150                  * but silently ignore attempts to change it since we
3151                  * don't have state here to verify that it doesn't try
3152                  * to change the flag.
3153                  */
3154                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3155                 /* fall through */
3156         case NL80211_IFTYPE_ADHOC:
3157                 /* disallow things sta doesn't support */
3158                 if (params.plink_action)
3159                         return -EINVAL;
3160                 if (params.ht_capa)
3161                         return -EINVAL;
3162                 if (params.listen_interval >= 0)
3163                         return -EINVAL;
3164                 /* reject any changes other than AUTHORIZED */
3165                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3166                         return -EINVAL;
3167                 break;
3168         case NL80211_IFTYPE_MESH_POINT:
3169                 /* disallow things mesh doesn't support */
3170                 if (params.vlan)
3171                         return -EINVAL;
3172                 if (params.ht_capa)
3173                         return -EINVAL;
3174                 if (params.listen_interval >= 0)
3175                         return -EINVAL;
3176                 /*
3177                  * No special handling for TDLS here -- the userspace
3178                  * mesh code doesn't have this bug.
3179                  */
3180                 if (params.sta_flags_mask &
3181                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3182                                   BIT(NL80211_STA_FLAG_MFP) |
3183                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3184                         return -EINVAL;
3185                 break;
3186         default:
3187                 return -EOPNOTSUPP;
3188         }
3189
3190         /* be aware of params.vlan when changing code here */
3191
3192         err = rdev_change_station(rdev, dev, mac_addr, &params);
3193
3194         if (params.vlan)
3195                 dev_put(params.vlan);
3196
3197         return err;
3198 }
3199
3200 static struct nla_policy
3201 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3202         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3203         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3204 };
3205
3206 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3207 {
3208         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3209         int err;
3210         struct net_device *dev = info->user_ptr[1];
3211         struct station_parameters params;
3212         u8 *mac_addr = NULL;
3213
3214         memset(&params, 0, sizeof(params));
3215
3216         if (!info->attrs[NL80211_ATTR_MAC])
3217                 return -EINVAL;
3218
3219         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3220                 return -EINVAL;
3221
3222         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3223                 return -EINVAL;
3224
3225         if (!info->attrs[NL80211_ATTR_STA_AID])
3226                 return -EINVAL;
3227
3228         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3229         params.supported_rates =
3230                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3231         params.supported_rates_len =
3232                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3233         params.listen_interval =
3234                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3235
3236         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3237         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3238                 return -EINVAL;
3239
3240         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3241                 params.ht_capa =
3242                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3243
3244         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3245                 params.vht_capa =
3246                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3247
3248         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3249                 params.plink_action =
3250                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3251
3252         if (!rdev->ops->add_station)
3253                 return -EOPNOTSUPP;
3254
3255         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3256                 return -EINVAL;
3257
3258         switch (dev->ieee80211_ptr->iftype) {
3259         case NL80211_IFTYPE_AP:
3260         case NL80211_IFTYPE_AP_VLAN:
3261         case NL80211_IFTYPE_P2P_GO:
3262                 /* parse WME attributes if sta is WME capable */
3263                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
3264                     (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
3265                     info->attrs[NL80211_ATTR_STA_WME]) {
3266                         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3267                         struct nlattr *nla;
3268
3269                         nla = info->attrs[NL80211_ATTR_STA_WME];
3270                         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3271                                                nl80211_sta_wme_policy);
3272                         if (err)
3273                                 return err;
3274
3275                         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3276                                 params.uapsd_queues =
3277                                      nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
3278                         if (params.uapsd_queues &
3279                                         ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3280                                 return -EINVAL;
3281
3282                         if (tb[NL80211_STA_WME_MAX_SP])
3283                                 params.max_sp =
3284                                      nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3285
3286                         if (params.max_sp &
3287                                         ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3288                                 return -EINVAL;
3289
3290                         params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3291                 }
3292                 /* TDLS peers cannot be added */
3293                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3294                         return -EINVAL;
3295                 /* but don't bother the driver with it */
3296                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3297
3298                 /* must be last in here for error handling */
3299                 params.vlan = get_vlan(info, rdev);
3300                 if (IS_ERR(params.vlan))
3301                         return PTR_ERR(params.vlan);
3302                 break;
3303         case NL80211_IFTYPE_MESH_POINT:
3304                 /* TDLS peers cannot be added */
3305                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3306                         return -EINVAL;
3307                 break;
3308         case NL80211_IFTYPE_STATION:
3309                 /* Only TDLS peers can be added */
3310                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3311                         return -EINVAL;
3312                 /* Can only add if TDLS ... */
3313                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
3314                         return -EOPNOTSUPP;
3315                 /* ... with external setup is supported */
3316                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
3317                         return -EOPNOTSUPP;
3318                 break;
3319         default:
3320                 return -EOPNOTSUPP;
3321         }
3322
3323         /* be aware of params.vlan when changing code here */
3324
3325         err = rdev_add_station(rdev, dev, mac_addr, &params);
3326
3327         if (params.vlan)
3328                 dev_put(params.vlan);
3329         return err;
3330 }
3331
3332 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
3333 {
3334         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3335         struct net_device *dev = info->user_ptr[1];
3336         u8 *mac_addr = NULL;
3337
3338         if (info->attrs[NL80211_ATTR_MAC])
3339                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3340
3341         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3342             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3343             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
3344             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3345                 return -EINVAL;
3346
3347         if (!rdev->ops->del_station)
3348                 return -EOPNOTSUPP;
3349
3350         return rdev_del_station(rdev, dev, mac_addr);
3351 }
3352
3353 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
3354                                 int flags, struct net_device *dev,
3355                                 u8 *dst, u8 *next_hop,
3356                                 struct mpath_info *pinfo)
3357 {
3358         void *hdr;
3359         struct nlattr *pinfoattr;
3360
3361         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3362         if (!hdr)
3363                 return -1;
3364
3365         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3366             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
3367             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
3368             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
3369                 goto nla_put_failure;
3370
3371         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
3372         if (!pinfoattr)
3373                 goto nla_put_failure;
3374         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
3375             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
3376                         pinfo->frame_qlen))
3377                 goto nla_put_failure;
3378         if (((pinfo->filled & MPATH_INFO_SN) &&
3379              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
3380             ((pinfo->filled & MPATH_INFO_METRIC) &&
3381              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
3382                          pinfo->metric)) ||
3383             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
3384              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
3385                          pinfo->exptime)) ||
3386             ((pinfo->filled & MPATH_INFO_FLAGS) &&
3387              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
3388                         pinfo->flags)) ||
3389             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
3390              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
3391                          pinfo->discovery_timeout)) ||
3392             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
3393              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
3394                         pinfo->discovery_retries)))
3395                 goto nla_put_failure;
3396
3397         nla_nest_end(msg, pinfoattr);
3398
3399         return genlmsg_end(msg, hdr);
3400
3401  nla_put_failure:
3402         genlmsg_cancel(msg, hdr);
3403         return -EMSGSIZE;
3404 }
3405
3406 static int nl80211_dump_mpath(struct sk_buff *skb,
3407                               struct netlink_callback *cb)
3408 {
3409         struct mpath_info pinfo;
3410         struct cfg80211_registered_device *dev;
3411         struct net_device *netdev;
3412         u8 dst[ETH_ALEN];
3413         u8 next_hop[ETH_ALEN];
3414         int path_idx = cb->args[1];
3415         int err;
3416
3417         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3418         if (err)
3419                 return err;
3420
3421         if (!dev->ops->dump_mpath) {
3422                 err = -EOPNOTSUPP;
3423                 goto out_err;
3424         }
3425
3426         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
3427                 err = -EOPNOTSUPP;
3428                 goto out_err;
3429         }
3430
3431         while (1) {
3432                 err = rdev_dump_mpath(dev, netdev, path_idx, dst, next_hop,
3433                                       &pinfo);
3434                 if (err == -ENOENT)
3435                         break;
3436                 if (err)
3437                         goto out_err;
3438
3439                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
3440                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
3441                                        netdev, dst, next_hop,
3442                                        &pinfo) < 0)
3443                         goto out;
3444
3445                 path_idx++;
3446         }
3447
3448
3449  out:
3450         cb->args[1] = path_idx;
3451         err = skb->len;
3452  out_err:
3453         nl80211_finish_netdev_dump(dev);
3454         return err;
3455 }
3456
3457 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
3458 {
3459         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3460         int err;
3461         struct net_device *dev = info->user_ptr[1];
3462         struct mpath_info pinfo;
3463         struct sk_buff *msg;
3464         u8 *dst = NULL;
3465         u8 next_hop[ETH_ALEN];
3466
3467         memset(&pinfo, 0, sizeof(pinfo));
3468
3469         if (!info->attrs[NL80211_ATTR_MAC])
3470                 return -EINVAL;
3471
3472         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3473
3474         if (!rdev->ops->get_mpath)
3475                 return -EOPNOTSUPP;
3476
3477         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3478                 return -EOPNOTSUPP;
3479
3480         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
3481         if (err)
3482                 return err;
3483
3484         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3485         if (!msg)
3486                 return -ENOMEM;
3487
3488         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
3489                                  dev, dst, next_hop, &pinfo) < 0) {
3490                 nlmsg_free(msg);
3491                 return -ENOBUFS;
3492         }
3493
3494         return genlmsg_reply(msg, info);
3495 }
3496
3497 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
3498 {
3499         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3500         struct net_device *dev = info->user_ptr[1];
3501         u8 *dst = NULL;
3502         u8 *next_hop = NULL;
3503
3504         if (!info->attrs[NL80211_ATTR_MAC])
3505                 return -EINVAL;
3506
3507         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3508                 return -EINVAL;
3509
3510         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3511         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3512
3513         if (!rdev->ops->change_mpath)
3514                 return -EOPNOTSUPP;
3515
3516         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3517                 return -EOPNOTSUPP;
3518
3519         return rdev_change_mpath(rdev, dev, dst, next_hop);
3520 }
3521
3522 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3523 {
3524         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3525         struct net_device *dev = info->user_ptr[1];
3526         u8 *dst = NULL;
3527         u8 *next_hop = NULL;
3528
3529         if (!info->attrs[NL80211_ATTR_MAC])
3530                 return -EINVAL;
3531
3532         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3533                 return -EINVAL;
3534
3535         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3536         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3537
3538         if (!rdev->ops->add_mpath)
3539                 return -EOPNOTSUPP;
3540
3541         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3542                 return -EOPNOTSUPP;
3543
3544         return rdev_add_mpath(rdev, dev, dst, next_hop);
3545 }
3546
3547 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
3548 {
3549         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3550         struct net_device *dev = info->user_ptr[1];
3551         u8 *dst = NULL;
3552
3553         if (info->attrs[NL80211_ATTR_MAC])
3554                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3555
3556         if (!rdev->ops->del_mpath)
3557                 return -EOPNOTSUPP;
3558
3559         return rdev_del_mpath(rdev, dev, dst);
3560 }
3561
3562 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
3563 {
3564         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3565         struct net_device *dev = info->user_ptr[1];
3566         struct bss_parameters params;
3567
3568         memset(&params, 0, sizeof(params));
3569         /* default to not changing parameters */
3570         params.use_cts_prot = -1;
3571         params.use_short_preamble = -1;
3572         params.use_short_slot_time = -1;
3573         params.ap_isolate = -1;
3574         params.ht_opmode = -1;
3575
3576         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
3577                 params.use_cts_prot =
3578                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
3579         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
3580                 params.use_short_preamble =
3581                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
3582         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
3583                 params.use_short_slot_time =
3584                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
3585         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3586                 params.basic_rates =
3587                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3588                 params.basic_rates_len =
3589                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3590         }
3591         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
3592                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
3593         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
3594                 params.ht_opmode =
3595                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
3596
3597         if (!rdev->ops->change_bss)
3598                 return -EOPNOTSUPP;
3599
3600         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3601             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3602                 return -EOPNOTSUPP;
3603
3604         return rdev_change_bss(rdev, dev, &params);
3605 }
3606
3607 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
3608         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
3609         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
3610         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
3611         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
3612         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
3613         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
3614 };
3615
3616 static int parse_reg_rule(struct nlattr *tb[],
3617         struct ieee80211_reg_rule *reg_rule)
3618 {
3619         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
3620         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
3621
3622         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
3623                 return -EINVAL;
3624         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
3625                 return -EINVAL;
3626         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
3627                 return -EINVAL;
3628         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
3629                 return -EINVAL;
3630         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
3631                 return -EINVAL;
3632
3633         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
3634
3635         freq_range->start_freq_khz =
3636                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
3637         freq_range->end_freq_khz =
3638                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
3639         freq_range->max_bandwidth_khz =
3640                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
3641
3642         power_rule->max_eirp =
3643                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
3644
3645         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
3646                 power_rule->max_antenna_gain =
3647                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
3648
3649         return 0;
3650 }
3651
3652 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
3653 {
3654         int r;
3655         char *data = NULL;
3656         enum nl80211_user_reg_hint_type user_reg_hint_type;
3657
3658         /*
3659          * You should only get this when cfg80211 hasn't yet initialized
3660          * completely when built-in to the kernel right between the time
3661          * window between nl80211_init() and regulatory_init(), if that is
3662          * even possible.
3663          */
3664         mutex_lock(&cfg80211_mutex);
3665         if (unlikely(!cfg80211_regdomain)) {
3666                 mutex_unlock(&cfg80211_mutex);
3667                 return -EINPROGRESS;
3668         }
3669         mutex_unlock(&cfg80211_mutex);
3670
3671         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3672                 return -EINVAL;
3673
3674         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3675
3676         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
3677                 user_reg_hint_type =
3678                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
3679         else
3680                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
3681
3682         switch (user_reg_hint_type) {
3683         case NL80211_USER_REG_HINT_USER:
3684         case NL80211_USER_REG_HINT_CELL_BASE:
3685                 break;
3686         default:
3687                 return -EINVAL;
3688         }
3689
3690         r = regulatory_hint_user(data, user_reg_hint_type);
3691
3692         return r;
3693 }
3694
3695 static int nl80211_get_mesh_config(struct sk_buff *skb,
3696                                    struct genl_info *info)
3697 {
3698         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3699         struct net_device *dev = info->user_ptr[1];
3700         struct wireless_dev *wdev = dev->ieee80211_ptr;
3701         struct mesh_config cur_params;
3702         int err = 0;
3703         void *hdr;
3704         struct nlattr *pinfoattr;
3705         struct sk_buff *msg;
3706
3707         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3708                 return -EOPNOTSUPP;
3709
3710         if (!rdev->ops->get_mesh_config)
3711                 return -EOPNOTSUPP;
3712
3713         wdev_lock(wdev);
3714         /* If not connected, get default parameters */
3715         if (!wdev->mesh_id_len)
3716                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3717         else
3718                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
3719         wdev_unlock(wdev);
3720
3721         if (err)
3722                 return err;
3723
3724         /* Draw up a netlink message to send back */
3725         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3726         if (!msg)
3727                 return -ENOMEM;
3728         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3729                              NL80211_CMD_GET_MESH_CONFIG);
3730         if (!hdr)
3731                 goto out;
3732         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3733         if (!pinfoattr)
3734                 goto nla_put_failure;
3735         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3736             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3737                         cur_params.dot11MeshRetryTimeout) ||
3738             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3739                         cur_params.dot11MeshConfirmTimeout) ||
3740             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3741                         cur_params.dot11MeshHoldingTimeout) ||
3742             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3743                         cur_params.dot11MeshMaxPeerLinks) ||
3744             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
3745                        cur_params.dot11MeshMaxRetries) ||
3746             nla_put_u8(msg, NL80211_MESHCONF_TTL,
3747                        cur_params.dot11MeshTTL) ||
3748             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3749                        cur_params.element_ttl) ||
3750             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3751                        cur_params.auto_open_plinks) ||
3752             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3753                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
3754             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3755                        cur_params.dot11MeshHWMPmaxPREQretries) ||
3756             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3757                         cur_params.path_refresh_time) ||
3758             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3759                         cur_params.min_discovery_timeout) ||
3760             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3761                         cur_params.dot11MeshHWMPactivePathTimeout) ||
3762             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3763                         cur_params.dot11MeshHWMPpreqMinInterval) ||
3764             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3765                         cur_params.dot11MeshHWMPperrMinInterval) ||
3766             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3767                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
3768             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3769                        cur_params.dot11MeshHWMPRootMode) ||
3770             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3771                         cur_params.dot11MeshHWMPRannInterval) ||
3772             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3773                        cur_params.dot11MeshGateAnnouncementProtocol) ||
3774             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
3775                        cur_params.dot11MeshForwarding) ||
3776             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
3777                         cur_params.rssi_threshold) ||
3778             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
3779                         cur_params.ht_opmode) ||
3780             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3781                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
3782             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3783                         cur_params.dot11MeshHWMProotInterval) ||
3784             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3785                         cur_params.dot11MeshHWMPconfirmationInterval))
3786                 goto nla_put_failure;
3787         nla_nest_end(msg, pinfoattr);
3788         genlmsg_end(msg, hdr);
3789         return genlmsg_reply(msg, info);
3790
3791  nla_put_failure:
3792         genlmsg_cancel(msg, hdr);
3793  out:
3794         nlmsg_free(msg);
3795         return -ENOBUFS;
3796 }
3797
3798 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3799         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3800         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3801         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3802         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3803         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3804         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3805         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3806         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3807         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
3808         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3809         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3810         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3811         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3812         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3813         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
3814         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3815         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3816         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3817         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3818         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
3819         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
3820         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
3821         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
3822         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
3823         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
3824 };
3825
3826 static const struct nla_policy
3827         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3828         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
3829         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3830         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3831         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3832         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3833                                     .len = IEEE80211_MAX_DATA_LEN },
3834         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3835 };
3836
3837 static int nl80211_parse_mesh_config(struct genl_info *info,
3838                                      struct mesh_config *cfg,
3839                                      u32 *mask_out)
3840 {
3841         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3842         u32 mask = 0;
3843
3844 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3845 do {\
3846         if (table[attr_num]) {\
3847                 cfg->param = nla_fn(table[attr_num]); \
3848                 mask |= (1 << (attr_num - 1)); \
3849         } \
3850 } while (0);\
3851
3852
3853         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3854                 return -EINVAL;
3855         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3856                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3857                              nl80211_meshconf_params_policy))
3858                 return -EINVAL;
3859
3860         /* This makes sure that there aren't more than 32 mesh config
3861          * parameters (otherwise our bitfield scheme would not work.) */
3862         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3863
3864         /* Fill in the params struct */
3865         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3866                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
3867                                   nla_get_u16);
3868         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3869                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3870                                   nla_get_u16);
3871         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3872                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
3873                                   nla_get_u16);
3874         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3875                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
3876                                   nla_get_u16);
3877         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3878                                   mask, NL80211_MESHCONF_MAX_RETRIES,
3879                                   nla_get_u8);
3880         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3881                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
3882         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3883                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
3884                                   nla_get_u8);
3885         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3886                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3887                                   nla_get_u8);
3888         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, mask,
3889                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3890                                   nla_get_u32);
3891         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3892                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3893                                   nla_get_u8);
3894         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3895                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
3896                                   nla_get_u32);
3897         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3898                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3899                                   nla_get_u16);
3900         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, mask,
3901                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3902                                   nla_get_u32);
3903         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3904                                   mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3905                                   nla_get_u16);
3906         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
3907                                   mask, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3908                                   nla_get_u16);
3909         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3910                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
3911                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3912                                   nla_get_u16);
3913         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
3914                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
3915         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
3916                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3917                                   nla_get_u16);
3918         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3919                                   dot11MeshGateAnnouncementProtocol, mask,
3920                                   NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3921                                   nla_get_u8);
3922         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding,
3923                                   mask, NL80211_MESHCONF_FORWARDING,
3924                                   nla_get_u8);
3925         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold,
3926                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
3927                                   nla_get_u32);
3928         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode,
3929                                   mask, NL80211_MESHCONF_HT_OPMODE,
3930                                   nla_get_u16);
3931         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
3932                                   mask,
3933                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3934                                   nla_get_u32);
3935         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval,
3936                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3937                                   nla_get_u16);
3938         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3939                                   dot11MeshHWMPconfirmationInterval, mask,
3940                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3941                                   nla_get_u16);
3942         if (mask_out)
3943                 *mask_out = mask;
3944
3945         return 0;
3946
3947 #undef FILL_IN_MESH_PARAM_IF_SET
3948 }
3949
3950 static int nl80211_parse_mesh_setup(struct genl_info *info,
3951                                      struct mesh_setup *setup)
3952 {
3953         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3954
3955         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3956                 return -EINVAL;
3957         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3958                              info->attrs[NL80211_ATTR_MESH_SETUP],
3959                              nl80211_mesh_setup_params_policy))
3960                 return -EINVAL;
3961
3962         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
3963                 setup->sync_method =
3964                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
3965                  IEEE80211_SYNC_METHOD_VENDOR :
3966                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
3967
3968         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3969                 setup->path_sel_proto =
3970                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3971                  IEEE80211_PATH_PROTOCOL_VENDOR :
3972                  IEEE80211_PATH_PROTOCOL_HWMP;
3973
3974         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3975                 setup->path_metric =
3976                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3977                  IEEE80211_PATH_METRIC_VENDOR :
3978                  IEEE80211_PATH_METRIC_AIRTIME;
3979
3980
3981         if (tb[NL80211_MESH_SETUP_IE]) {
3982                 struct nlattr *ieattr =
3983                         tb[NL80211_MESH_SETUP_IE];
3984                 if (!is_valid_ie_attr(ieattr))
3985                         return -EINVAL;
3986                 setup->ie = nla_data(ieattr);
3987                 setup->ie_len = nla_len(ieattr);
3988         }
3989         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3990         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3991
3992         return 0;
3993 }
3994
3995 static int nl80211_update_mesh_config(struct sk_buff *skb,
3996                                       struct genl_info *info)
3997 {
3998         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3999         struct net_device *dev = info->user_ptr[1];
4000         struct wireless_dev *wdev = dev->ieee80211_ptr;
4001         struct mesh_config cfg;
4002         u32 mask;
4003         int err;
4004
4005         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4006                 return -EOPNOTSUPP;
4007
4008         if (!rdev->ops->update_mesh_config)
4009                 return -EOPNOTSUPP;
4010
4011         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4012         if (err)
4013                 return err;
4014
4015         wdev_lock(wdev);
4016         if (!wdev->mesh_id_len)
4017                 err = -ENOLINK;
4018
4019         if (!err)
4020                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4021
4022         wdev_unlock(wdev);
4023
4024         return err;
4025 }
4026
4027 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4028 {
4029         struct sk_buff *msg;
4030         void *hdr = NULL;
4031         struct nlattr *nl_reg_rules;
4032         unsigned int i;
4033         int err = -EINVAL;
4034
4035         mutex_lock(&cfg80211_mutex);
4036
4037         if (!cfg80211_regdomain)
4038                 goto out;
4039
4040         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4041         if (!msg) {
4042                 err = -ENOBUFS;
4043                 goto out;
4044         }
4045
4046         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4047                              NL80211_CMD_GET_REG);
4048         if (!hdr)
4049                 goto put_failure;
4050
4051         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
4052                            cfg80211_regdomain->alpha2) ||
4053             (cfg80211_regdomain->dfs_region &&
4054              nla_put_u8(msg, NL80211_ATTR_DFS_REGION,
4055                         cfg80211_regdomain->dfs_region)))
4056                 goto nla_put_failure;
4057
4058         if (reg_last_request_cell_base() &&
4059             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4060                         NL80211_USER_REG_HINT_CELL_BASE))
4061                 goto nla_put_failure;
4062
4063         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4064         if (!nl_reg_rules)
4065                 goto nla_put_failure;
4066
4067         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
4068                 struct nlattr *nl_reg_rule;
4069                 const struct ieee80211_reg_rule *reg_rule;
4070                 const struct ieee80211_freq_range *freq_range;
4071                 const struct ieee80211_power_rule *power_rule;
4072
4073                 reg_rule = &cfg80211_regdomain->reg_rules[i];
4074                 freq_range = &reg_rule->freq_range;
4075                 power_rule = &reg_rule->power_rule;
4076
4077                 nl_reg_rule = nla_nest_start(msg, i);
4078                 if (!nl_reg_rule)
4079                         goto nla_put_failure;
4080
4081                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4082                                 reg_rule->flags) ||
4083                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4084                                 freq_range->start_freq_khz) ||
4085                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4086                                 freq_range->end_freq_khz) ||
4087                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4088                                 freq_range->max_bandwidth_khz) ||
4089                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4090                                 power_rule->max_antenna_gain) ||
4091                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4092                                 power_rule->max_eirp))
4093                         goto nla_put_failure;
4094
4095                 nla_nest_end(msg, nl_reg_rule);
4096         }
4097
4098         nla_nest_end(msg, nl_reg_rules);
4099
4100         genlmsg_end(msg, hdr);
4101         err = genlmsg_reply(msg, info);
4102         goto out;
4103
4104 nla_put_failure:
4105         genlmsg_cancel(msg, hdr);
4106 put_failure:
4107         nlmsg_free(msg);
4108         err = -EMSGSIZE;
4109 out:
4110         mutex_unlock(&cfg80211_mutex);
4111         return err;
4112 }
4113
4114 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4115 {
4116         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4117         struct nlattr *nl_reg_rule;
4118         char *alpha2 = NULL;
4119         int rem_reg_rules = 0, r = 0;
4120         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4121         u8 dfs_region = 0;
4122         struct ieee80211_regdomain *rd = NULL;
4123
4124         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4125                 return -EINVAL;
4126
4127         if (!info->attrs[NL80211_ATTR_REG_RULES])
4128                 return -EINVAL;
4129
4130         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4131
4132         if (info->attrs[NL80211_ATTR_DFS_REGION])
4133                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4134
4135         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4136                         rem_reg_rules) {
4137                 num_rules++;
4138                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4139                         return -EINVAL;
4140         }
4141
4142         mutex_lock(&cfg80211_mutex);
4143
4144         if (!reg_is_valid_request(alpha2)) {
4145                 r = -EINVAL;
4146                 goto bad_reg;
4147         }
4148
4149         size_of_regd = sizeof(struct ieee80211_regdomain) +
4150                 (num_rules * sizeof(struct ieee80211_reg_rule));
4151
4152         rd = kzalloc(size_of_regd, GFP_KERNEL);
4153         if (!rd) {
4154                 r = -ENOMEM;
4155                 goto bad_reg;
4156         }
4157
4158         rd->n_reg_rules = num_rules;
4159         rd->alpha2[0] = alpha2[0];
4160         rd->alpha2[1] = alpha2[1];
4161
4162         /*
4163          * Disable DFS master mode if the DFS region was
4164          * not supported or known on this kernel.
4165          */
4166         if (reg_supported_dfs_region(dfs_region))
4167                 rd->dfs_region = dfs_region;
4168
4169         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4170                         rem_reg_rules) {
4171                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4172                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4173                         reg_rule_policy);
4174                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4175                 if (r)
4176                         goto bad_reg;
4177
4178                 rule_idx++;
4179
4180                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
4181                         r = -EINVAL;
4182                         goto bad_reg;
4183                 }
4184         }
4185
4186         BUG_ON(rule_idx != num_rules);
4187
4188         r = set_regdom(rd);
4189
4190         mutex_unlock(&cfg80211_mutex);
4191
4192         return r;
4193
4194  bad_reg:
4195         mutex_unlock(&cfg80211_mutex);
4196         kfree(rd);
4197         return r;
4198 }
4199
4200 static int validate_scan_freqs(struct nlattr *freqs)
4201 {
4202         struct nlattr *attr1, *attr2;
4203         int n_channels = 0, tmp1, tmp2;
4204
4205         nla_for_each_nested(attr1, freqs, tmp1) {
4206                 n_channels++;
4207                 /*
4208                  * Some hardware has a limited channel list for
4209                  * scanning, and it is pretty much nonsensical
4210                  * to scan for a channel twice, so disallow that
4211                  * and don't require drivers to check that the
4212                  * channel list they get isn't longer than what
4213                  * they can scan, as long as they can scan all
4214                  * the channels they registered at once.
4215                  */
4216                 nla_for_each_nested(attr2, freqs, tmp2)
4217                         if (attr1 != attr2 &&
4218                             nla_get_u32(attr1) == nla_get_u32(attr2))
4219                                 return 0;
4220         }
4221
4222         return n_channels;
4223 }
4224
4225 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4226 {
4227         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4228         struct wireless_dev *wdev = info->user_ptr[1];
4229         struct cfg80211_scan_request *request;
4230         struct nlattr *attr;
4231         struct wiphy *wiphy;
4232         int err, tmp, n_ssids = 0, n_channels, i;
4233         size_t ie_len;
4234
4235         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4236                 return -EINVAL;
4237
4238         wiphy = &rdev->wiphy;
4239
4240         if (!rdev->ops->scan)
4241                 return -EOPNOTSUPP;
4242
4243         if (rdev->scan_req)
4244                 return -EBUSY;
4245
4246         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4247                 n_channels = validate_scan_freqs(
4248                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4249                 if (!n_channels)
4250                         return -EINVAL;
4251         } else {
4252                 enum ieee80211_band band;
4253                 n_channels = 0;
4254
4255                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4256                         if (wiphy->bands[band])
4257                                 n_channels += wiphy->bands[band]->n_channels;
4258         }
4259
4260         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4261                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4262                         n_ssids++;
4263
4264         if (n_ssids > wiphy->max_scan_ssids)
4265                 return -EINVAL;
4266
4267         if (info->attrs[NL80211_ATTR_IE])
4268                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4269         else
4270                 ie_len = 0;
4271
4272         if (ie_len > wiphy->max_scan_ie_len)
4273                 return -EINVAL;
4274
4275         request = kzalloc(sizeof(*request)
4276                         + sizeof(*request->ssids) * n_ssids
4277                         + sizeof(*request->channels) * n_channels
4278                         + ie_len, GFP_KERNEL);
4279         if (!request)
4280                 return -ENOMEM;
4281
4282         if (n_ssids)
4283                 request->ssids = (void *)&request->channels[n_channels];
4284         request->n_ssids = n_ssids;
4285         if (ie_len) {
4286                 if (request->ssids)
4287                         request->ie = (void *)(request->ssids + n_ssids);
4288                 else
4289                         request->ie = (void *)(request->channels + n_channels);
4290         }
4291
4292         i = 0;
4293         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4294                 /* user specified, bail out if channel not found */
4295                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
4296                         struct ieee80211_channel *chan;
4297
4298                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4299
4300                         if (!chan) {
4301                                 err = -EINVAL;
4302                                 goto out_free;
4303                         }
4304
4305                         /* ignore disabled channels */
4306                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4307                                 continue;
4308
4309                         request->channels[i] = chan;
4310                         i++;
4311                 }
4312         } else {
4313                 enum ieee80211_band band;
4314
4315                 /* all channels */
4316                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4317                         int j;
4318                         if (!wiphy->bands[band])
4319                                 continue;
4320                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4321                                 struct ieee80211_channel *chan;
4322
4323                                 chan = &wiphy->bands[band]->channels[j];
4324
4325                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4326                                         continue;
4327
4328                                 request->channels[i] = chan;
4329                                 i++;
4330                         }
4331                 }
4332         }
4333
4334         if (!i) {
4335                 err = -EINVAL;
4336                 goto out_free;
4337         }
4338
4339         request->n_channels = i;
4340
4341         i = 0;
4342         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4343                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
4344                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4345                                 err = -EINVAL;
4346                                 goto out_free;
4347                         }
4348                         request->ssids[i].ssid_len = nla_len(attr);
4349                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
4350                         i++;
4351                 }
4352         }
4353
4354         if (info->attrs[NL80211_ATTR_IE]) {
4355                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4356                 memcpy((void *)request->ie,
4357                        nla_data(info->attrs[NL80211_ATTR_IE]),
4358                        request->ie_len);
4359         }
4360
4361         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
4362                 if (wiphy->bands[i])
4363                         request->rates[i] =
4364                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
4365
4366         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
4367                 nla_for_each_nested(attr,
4368                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
4369                                     tmp) {
4370                         enum ieee80211_band band = nla_type(attr);
4371
4372                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4373                                 err = -EINVAL;
4374                                 goto out_free;
4375                         }
4376                         err = ieee80211_get_ratemask(wiphy->bands[band],
4377                                                      nla_data(attr),
4378                                                      nla_len(attr),
4379                                                      &request->rates[band]);
4380                         if (err)
4381                                 goto out_free;
4382                 }
4383         }
4384
4385         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4386                 request->flags = nla_get_u32(
4387                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4388                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4389                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4390                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4391                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4392                         err = -EOPNOTSUPP;
4393                         goto out_free;
4394                 }
4395         }
4396
4397         request->no_cck =
4398                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
4399
4400         request->wdev = wdev;
4401         request->wiphy = &rdev->wiphy;
4402         request->scan_start = jiffies;
4403
4404         rdev->scan_req = request;
4405         err = rdev_scan(rdev, request);
4406
4407         if (!err) {
4408                 nl80211_send_scan_start(rdev, wdev);
4409                 if (wdev->netdev)
4410                         dev_hold(wdev->netdev);
4411         } else {
4412  out_free:
4413                 rdev->scan_req = NULL;
4414                 kfree(request);
4415         }
4416
4417         return err;
4418 }
4419
4420 static int nl80211_start_sched_scan(struct sk_buff *skb,
4421                                     struct genl_info *info)
4422 {
4423         struct cfg80211_sched_scan_request *request;
4424         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4425         struct net_device *dev = info->user_ptr[1];
4426         struct nlattr *attr;
4427         struct wiphy *wiphy;
4428         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
4429         u32 interval;
4430         enum ieee80211_band band;
4431         size_t ie_len;
4432         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
4433
4434         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4435             !rdev->ops->sched_scan_start)
4436                 return -EOPNOTSUPP;
4437
4438         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4439                 return -EINVAL;
4440
4441         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
4442                 return -EINVAL;
4443
4444         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
4445         if (interval == 0)
4446                 return -EINVAL;
4447
4448         wiphy = &rdev->wiphy;
4449
4450         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4451                 n_channels = validate_scan_freqs(
4452                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4453                 if (!n_channels)
4454                         return -EINVAL;
4455         } else {
4456                 n_channels = 0;
4457
4458                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4459                         if (wiphy->bands[band])
4460                                 n_channels += wiphy->bands[band]->n_channels;
4461         }
4462
4463         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4464                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4465                                     tmp)
4466                         n_ssids++;
4467
4468         if (n_ssids > wiphy->max_sched_scan_ssids)
4469                 return -EINVAL;
4470
4471         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
4472                 nla_for_each_nested(attr,
4473                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4474                                     tmp)
4475                         n_match_sets++;
4476
4477         if (n_match_sets > wiphy->max_match_sets)
4478                 return -EINVAL;
4479
4480         if (info->attrs[NL80211_ATTR_IE])
4481                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4482         else
4483                 ie_len = 0;
4484
4485         if (ie_len > wiphy->max_sched_scan_ie_len)
4486                 return -EINVAL;
4487
4488         mutex_lock(&rdev->sched_scan_mtx);
4489
4490         if (rdev->sched_scan_req) {
4491                 err = -EINPROGRESS;
4492                 goto out;
4493         }
4494
4495         request = kzalloc(sizeof(*request)
4496                         + sizeof(*request->ssids) * n_ssids
4497                         + sizeof(*request->match_sets) * n_match_sets
4498                         + sizeof(*request->channels) * n_channels
4499                         + ie_len, GFP_KERNEL);
4500         if (!request) {
4501                 err = -ENOMEM;
4502                 goto out;
4503         }
4504
4505         if (n_ssids)
4506                 request->ssids = (void *)&request->channels[n_channels];
4507         request->n_ssids = n_ssids;
4508         if (ie_len) {
4509                 if (request->ssids)
4510                         request->ie = (void *)(request->ssids + n_ssids);
4511                 else
4512                         request->ie = (void *)(request->channels + n_channels);
4513         }
4514
4515         if (n_match_sets) {
4516                 if (request->ie)
4517                         request->match_sets = (void *)(request->ie + ie_len);
4518                 else if (request->ssids)
4519                         request->match_sets =
4520                                 (void *)(request->ssids + n_ssids);
4521                 else
4522                         request->match_sets =
4523                                 (void *)(request->channels + n_channels);
4524         }
4525         request->n_match_sets = n_match_sets;
4526
4527         i = 0;
4528         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4529                 /* user specified, bail out if channel not found */
4530                 nla_for_each_nested(attr,
4531                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
4532                                     tmp) {
4533                         struct ieee80211_channel *chan;
4534
4535                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4536
4537                         if (!chan) {
4538                                 err = -EINVAL;
4539                                 goto out_free;
4540                         }
4541
4542                         /* ignore disabled channels */
4543                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4544                                 continue;
4545
4546                         request->channels[i] = chan;
4547                         i++;
4548                 }
4549         } else {
4550                 /* all channels */
4551                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4552                         int j;
4553                         if (!wiphy->bands[band])
4554                                 continue;
4555                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4556                                 struct ieee80211_channel *chan;
4557
4558                                 chan = &wiphy->bands[band]->channels[j];
4559
4560                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4561                                         continue;
4562
4563                                 request->channels[i] = chan;
4564                                 i++;
4565                         }
4566                 }
4567         }
4568
4569         if (!i) {
4570                 err = -EINVAL;
4571                 goto out_free;
4572         }
4573
4574         request->n_channels = i;
4575
4576         i = 0;
4577         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4578                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4579                                     tmp) {
4580                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4581                                 err = -EINVAL;
4582                                 goto out_free;
4583                         }
4584                         request->ssids[i].ssid_len = nla_len(attr);
4585                         memcpy(request->ssids[i].ssid, nla_data(attr),
4586                                nla_len(attr));
4587                         i++;
4588                 }
4589         }
4590
4591         i = 0;
4592         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
4593                 nla_for_each_nested(attr,
4594                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4595                                     tmp) {
4596                         struct nlattr *ssid, *rssi;
4597
4598                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
4599                                   nla_data(attr), nla_len(attr),
4600                                   nl80211_match_policy);
4601                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
4602                         if (ssid) {
4603                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
4604                                         err = -EINVAL;
4605                                         goto out_free;
4606                                 }
4607                                 memcpy(request->match_sets[i].ssid.ssid,
4608                                        nla_data(ssid), nla_len(ssid));
4609                                 request->match_sets[i].ssid.ssid_len =
4610                                         nla_len(ssid);
4611                         }
4612                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
4613                         if (rssi)
4614                                 request->rssi_thold = nla_get_u32(rssi);
4615                         else
4616                                 request->rssi_thold =
4617                                                    NL80211_SCAN_RSSI_THOLD_OFF;
4618                         i++;
4619                 }
4620         }
4621
4622         if (info->attrs[NL80211_ATTR_IE]) {
4623                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4624                 memcpy((void *)request->ie,
4625                        nla_data(info->attrs[NL80211_ATTR_IE]),
4626                        request->ie_len);
4627         }
4628
4629         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4630                 request->flags = nla_get_u32(
4631                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4632                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4633                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4634                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4635                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4636                         err = -EOPNOTSUPP;
4637                         goto out_free;
4638                 }
4639         }
4640
4641         request->dev = dev;
4642         request->wiphy = &rdev->wiphy;
4643         request->interval = interval;
4644         request->scan_start = jiffies;
4645
4646         err = rdev_sched_scan_start(rdev, dev, request);
4647         if (!err) {
4648                 rdev->sched_scan_req = request;
4649                 nl80211_send_sched_scan(rdev, dev,
4650                                         NL80211_CMD_START_SCHED_SCAN);
4651                 goto out;
4652         }
4653
4654 out_free:
4655         kfree(request);
4656 out:
4657         mutex_unlock(&rdev->sched_scan_mtx);
4658         return err;
4659 }
4660
4661 static int nl80211_stop_sched_scan(struct sk_buff *skb,
4662                                    struct genl_info *info)
4663 {
4664         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4665         int err;
4666
4667         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4668             !rdev->ops->sched_scan_stop)
4669                 return -EOPNOTSUPP;
4670
4671         mutex_lock(&rdev->sched_scan_mtx);
4672         err = __cfg80211_stop_sched_scan(rdev, false);
4673         mutex_unlock(&rdev->sched_scan_mtx);
4674
4675         return err;
4676 }
4677
4678 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
4679                             u32 seq, int flags,
4680                             struct cfg80211_registered_device *rdev,
4681                             struct wireless_dev *wdev,
4682                             struct cfg80211_internal_bss *intbss)
4683 {
4684         struct cfg80211_bss *res = &intbss->pub;
4685         void *hdr;
4686         struct nlattr *bss;
4687
4688         ASSERT_WDEV_LOCK(wdev);
4689
4690         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
4691                              NL80211_CMD_NEW_SCAN_RESULTS);
4692         if (!hdr)
4693                 return -1;
4694
4695         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
4696
4697         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
4698             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
4699                 goto nla_put_failure;
4700
4701         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
4702         if (!bss)
4703                 goto nla_put_failure;
4704         if ((!is_zero_ether_addr(res->bssid) &&
4705              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)) ||
4706             (res->information_elements && res->len_information_elements &&
4707              nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
4708                      res->len_information_elements,
4709                      res->information_elements)) ||
4710             (res->beacon_ies && res->len_beacon_ies &&
4711              res->beacon_ies != res->information_elements &&
4712              nla_put(msg, NL80211_BSS_BEACON_IES,
4713                      res->len_beacon_ies, res->beacon_ies)))
4714                 goto nla_put_failure;
4715         if (res->tsf &&
4716             nla_put_u64(msg, NL80211_BSS_TSF, res->tsf))
4717                 goto nla_put_failure;
4718         if (res->beacon_interval &&
4719             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
4720                 goto nla_put_failure;
4721         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
4722             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
4723             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
4724                         jiffies_to_msecs(jiffies - intbss->ts)))
4725                 goto nla_put_failure;
4726
4727         switch (rdev->wiphy.signal_type) {
4728         case CFG80211_SIGNAL_TYPE_MBM:
4729                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
4730                         goto nla_put_failure;
4731                 break;
4732         case CFG80211_SIGNAL_TYPE_UNSPEC:
4733                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
4734                         goto nla_put_failure;
4735                 break;
4736         default:
4737                 break;
4738         }
4739
4740         switch (wdev->iftype) {
4741         case NL80211_IFTYPE_P2P_CLIENT:
4742         case NL80211_IFTYPE_STATION:
4743                 if (intbss == wdev->current_bss &&
4744                     nla_put_u32(msg, NL80211_BSS_STATUS,
4745                                 NL80211_BSS_STATUS_ASSOCIATED))
4746                         goto nla_put_failure;
4747                 break;
4748         case NL80211_IFTYPE_ADHOC:
4749                 if (intbss == wdev->current_bss &&
4750                     nla_put_u32(msg, NL80211_BSS_STATUS,
4751                                 NL80211_BSS_STATUS_IBSS_JOINED))
4752                         goto nla_put_failure;
4753                 break;
4754         default:
4755                 break;
4756         }
4757
4758         nla_nest_end(msg, bss);
4759
4760         return genlmsg_end(msg, hdr);
4761
4762  nla_put_failure:
4763         genlmsg_cancel(msg, hdr);
4764         return -EMSGSIZE;
4765 }
4766
4767 static int nl80211_dump_scan(struct sk_buff *skb,
4768                              struct netlink_callback *cb)
4769 {
4770         struct cfg80211_registered_device *rdev;
4771         struct net_device *dev;
4772         struct cfg80211_internal_bss *scan;
4773         struct wireless_dev *wdev;
4774         int start = cb->args[1], idx = 0;
4775         int err;
4776
4777         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
4778         if (err)
4779                 return err;
4780
4781         wdev = dev->ieee80211_ptr;
4782
4783         wdev_lock(wdev);
4784         spin_lock_bh(&rdev->bss_lock);
4785         cfg80211_bss_expire(rdev);
4786
4787         cb->seq = rdev->bss_generation;
4788
4789         list_for_each_entry(scan, &rdev->bss_list, list) {
4790                 if (++idx <= start)
4791                         continue;
4792                 if (nl80211_send_bss(skb, cb,
4793                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4794                                 rdev, wdev, scan) < 0) {
4795                         idx--;
4796                         break;
4797                 }
4798         }
4799
4800         spin_unlock_bh(&rdev->bss_lock);
4801         wdev_unlock(wdev);
4802
4803         cb->args[1] = idx;
4804         nl80211_finish_netdev_dump(rdev);
4805
4806         return skb->len;
4807 }
4808
4809 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
4810                                 int flags, struct net_device *dev,
4811                                 struct survey_info *survey)
4812 {
4813         void *hdr;
4814         struct nlattr *infoattr;
4815
4816         hdr = nl80211hdr_put(msg, portid, seq, flags,
4817                              NL80211_CMD_NEW_SURVEY_RESULTS);
4818         if (!hdr)
4819                 return -ENOMEM;
4820
4821         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
4822                 goto nla_put_failure;
4823
4824         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
4825         if (!infoattr)
4826                 goto nla_put_failure;
4827
4828         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
4829                         survey->channel->center_freq))
4830                 goto nla_put_failure;
4831
4832         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
4833             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
4834                 goto nla_put_failure;
4835         if ((survey->filled & SURVEY_INFO_IN_USE) &&
4836             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
4837                 goto nla_put_failure;
4838         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
4839             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
4840                         survey->channel_time))
4841                 goto nla_put_failure;
4842         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
4843             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
4844                         survey->channel_time_busy))
4845                 goto nla_put_failure;
4846         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
4847             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
4848                         survey->channel_time_ext_busy))
4849                 goto nla_put_failure;
4850         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
4851             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
4852                         survey->channel_time_rx))
4853                 goto nla_put_failure;
4854         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
4855             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
4856                         survey->channel_time_tx))
4857                 goto nla_put_failure;
4858
4859         nla_nest_end(msg, infoattr);
4860
4861         return genlmsg_end(msg, hdr);
4862
4863  nla_put_failure:
4864         genlmsg_cancel(msg, hdr);
4865         return -EMSGSIZE;
4866 }
4867
4868 static int nl80211_dump_survey(struct sk_buff *skb,
4869                         struct netlink_callback *cb)
4870 {
4871         struct survey_info survey;
4872         struct cfg80211_registered_device *dev;
4873         struct net_device *netdev;
4874         int survey_idx = cb->args[1];
4875         int res;
4876
4877         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4878         if (res)
4879                 return res;
4880
4881         if (!dev->ops->dump_survey) {
4882                 res = -EOPNOTSUPP;
4883                 goto out_err;
4884         }
4885
4886         while (1) {
4887                 struct ieee80211_channel *chan;
4888
4889                 res = rdev_dump_survey(dev, netdev, survey_idx, &survey);
4890                 if (res == -ENOENT)
4891                         break;
4892                 if (res)
4893                         goto out_err;
4894
4895                 /* Survey without a channel doesn't make sense */
4896                 if (!survey.channel) {
4897                         res = -EINVAL;
4898                         goto out;
4899                 }
4900
4901                 chan = ieee80211_get_channel(&dev->wiphy,
4902                                              survey.channel->center_freq);
4903                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4904                         survey_idx++;
4905                         continue;
4906                 }
4907
4908                 if (nl80211_send_survey(skb,
4909                                 NETLINK_CB(cb->skb).portid,
4910                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4911                                 netdev,
4912                                 &survey) < 0)
4913                         goto out;
4914                 survey_idx++;
4915         }
4916
4917  out:
4918         cb->args[1] = survey_idx;
4919         res = skb->len;
4920  out_err:
4921         nl80211_finish_netdev_dump(dev);
4922         return res;
4923 }
4924
4925 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4926 {
4927         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4928                                   NL80211_WPA_VERSION_2));
4929 }
4930
4931 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4932 {
4933         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4934         struct net_device *dev = info->user_ptr[1];
4935         struct ieee80211_channel *chan;
4936         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
4937         int err, ssid_len, ie_len = 0, sae_data_len = 0;
4938         enum nl80211_auth_type auth_type;
4939         struct key_parse key;
4940         bool local_state_change;
4941
4942         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4943                 return -EINVAL;
4944
4945         if (!info->attrs[NL80211_ATTR_MAC])
4946                 return -EINVAL;
4947
4948         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4949                 return -EINVAL;
4950
4951         if (!info->attrs[NL80211_ATTR_SSID])
4952                 return -EINVAL;
4953
4954         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4955                 return -EINVAL;
4956
4957         err = nl80211_parse_key(info, &key);
4958         if (err)
4959                 return err;
4960
4961         if (key.idx >= 0) {
4962                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4963                         return -EINVAL;
4964                 if (!key.p.key || !key.p.key_len)
4965                         return -EINVAL;
4966                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4967                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4968                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4969                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4970                         return -EINVAL;
4971                 if (key.idx > 4)
4972                         return -EINVAL;
4973         } else {
4974                 key.p.key_len = 0;
4975                 key.p.key = NULL;
4976         }
4977
4978         if (key.idx >= 0) {
4979                 int i;
4980                 bool ok = false;
4981                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4982                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4983                                 ok = true;
4984                                 break;
4985                         }
4986                 }
4987                 if (!ok)
4988                         return -EINVAL;
4989         }
4990
4991         if (!rdev->ops->auth)
4992                 return -EOPNOTSUPP;
4993
4994         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4995             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4996                 return -EOPNOTSUPP;
4997
4998         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4999         chan = ieee80211_get_channel(&rdev->wiphy,
5000                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5001         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5002                 return -EINVAL;
5003
5004         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5005         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5006
5007         if (info->attrs[NL80211_ATTR_IE]) {
5008                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5009                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5010         }
5011
5012         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5013         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5014                 return -EINVAL;
5015
5016         if (auth_type == NL80211_AUTHTYPE_SAE &&
5017             !info->attrs[NL80211_ATTR_SAE_DATA])
5018                 return -EINVAL;
5019
5020         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5021                 if (auth_type != NL80211_AUTHTYPE_SAE)
5022                         return -EINVAL;
5023                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5024                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5025                 /* need to include at least Auth Transaction and Status Code */
5026                 if (sae_data_len < 4)
5027                         return -EINVAL;
5028         }
5029
5030         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5031
5032         /*
5033          * Since we no longer track auth state, ignore
5034          * requests to only change local state.
5035          */
5036         if (local_state_change)
5037                 return 0;
5038
5039         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5040                                   ssid, ssid_len, ie, ie_len,
5041                                   key.p.key, key.p.key_len, key.idx,
5042                                   sae_data, sae_data_len);
5043 }
5044
5045 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5046                                    struct genl_info *info,
5047                                    struct cfg80211_crypto_settings *settings,
5048                                    int cipher_limit)
5049 {
5050         memset(settings, 0, sizeof(*settings));
5051
5052         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5053
5054         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5055                 u16 proto;
5056                 proto = nla_get_u16(
5057                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5058                 settings->control_port_ethertype = cpu_to_be16(proto);
5059                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5060                     proto != ETH_P_PAE)
5061                         return -EINVAL;
5062                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5063                         settings->control_port_no_encrypt = true;
5064         } else
5065                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5066
5067         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5068                 void *data;
5069                 int len, i;
5070
5071                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5072                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5073                 settings->n_ciphers_pairwise = len / sizeof(u32);
5074
5075                 if (len % sizeof(u32))
5076                         return -EINVAL;
5077
5078                 if (settings->n_ciphers_pairwise > cipher_limit)
5079                         return -EINVAL;
5080
5081                 memcpy(settings->ciphers_pairwise, data, len);
5082
5083                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5084                         if (!cfg80211_supported_cipher_suite(
5085                                         &rdev->wiphy,
5086                                         settings->ciphers_pairwise[i]))
5087                                 return -EINVAL;
5088         }
5089
5090         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5091                 settings->cipher_group =
5092                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5093                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5094                                                      settings->cipher_group))
5095                         return -EINVAL;
5096         }
5097
5098         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5099                 settings->wpa_versions =
5100                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5101                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5102                         return -EINVAL;
5103         }
5104
5105         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5106                 void *data;
5107                 int len;
5108
5109                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5110                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5111                 settings->n_akm_suites = len / sizeof(u32);
5112
5113                 if (len % sizeof(u32))
5114                         return -EINVAL;
5115
5116                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
5117                         return -EINVAL;
5118
5119                 memcpy(settings->akm_suites, data, len);
5120         }
5121
5122         return 0;
5123 }
5124
5125 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
5126 {
5127         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5128         struct net_device *dev = info->user_ptr[1];
5129         struct cfg80211_crypto_settings crypto;
5130         struct ieee80211_channel *chan;
5131         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
5132         int err, ssid_len, ie_len = 0;
5133         bool use_mfp = false;
5134         u32 flags = 0;
5135         struct ieee80211_ht_cap *ht_capa = NULL;
5136         struct ieee80211_ht_cap *ht_capa_mask = NULL;
5137
5138         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5139                 return -EINVAL;
5140
5141         if (!info->attrs[NL80211_ATTR_MAC] ||
5142             !info->attrs[NL80211_ATTR_SSID] ||
5143             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5144                 return -EINVAL;
5145
5146         if (!rdev->ops->assoc)
5147                 return -EOPNOTSUPP;
5148
5149         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5150             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5151                 return -EOPNOTSUPP;
5152
5153         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5154
5155         chan = ieee80211_get_channel(&rdev->wiphy,
5156                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5157         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5158                 return -EINVAL;
5159
5160         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5161         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5162
5163         if (info->attrs[NL80211_ATTR_IE]) {
5164                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5165                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5166         }
5167
5168         if (info->attrs[NL80211_ATTR_USE_MFP]) {
5169                 enum nl80211_mfp mfp =
5170                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
5171                 if (mfp == NL80211_MFP_REQUIRED)
5172                         use_mfp = true;
5173                 else if (mfp != NL80211_MFP_NO)
5174                         return -EINVAL;
5175         }
5176
5177         if (info->attrs[NL80211_ATTR_PREV_BSSID])
5178                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
5179
5180         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5181                 flags |= ASSOC_REQ_DISABLE_HT;
5182
5183         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5184                 ht_capa_mask =
5185                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
5186
5187         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5188                 if (!ht_capa_mask)
5189                         return -EINVAL;
5190                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5191         }
5192
5193         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
5194         if (!err)
5195                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
5196                                           ssid, ssid_len, ie, ie_len, use_mfp,
5197                                           &crypto, flags, ht_capa,
5198                                           ht_capa_mask);
5199
5200         return err;
5201 }
5202
5203 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
5204 {
5205         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5206         struct net_device *dev = info->user_ptr[1];
5207         const u8 *ie = NULL, *bssid;
5208         int ie_len = 0;
5209         u16 reason_code;
5210         bool local_state_change;
5211
5212         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5213                 return -EINVAL;
5214
5215         if (!info->attrs[NL80211_ATTR_MAC])
5216                 return -EINVAL;
5217
5218         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5219                 return -EINVAL;
5220
5221         if (!rdev->ops->deauth)
5222                 return -EOPNOTSUPP;
5223
5224         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5225             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5226                 return -EOPNOTSUPP;
5227
5228         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5229
5230         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5231         if (reason_code == 0) {
5232                 /* Reason Code 0 is reserved */
5233                 return -EINVAL;
5234         }
5235
5236         if (info->attrs[NL80211_ATTR_IE]) {
5237                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5238                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5239         }
5240
5241         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5242
5243         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
5244                                     local_state_change);
5245 }
5246
5247 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
5248 {
5249         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5250         struct net_device *dev = info->user_ptr[1];
5251         const u8 *ie = NULL, *bssid;
5252         int ie_len = 0;
5253         u16 reason_code;
5254         bool local_state_change;
5255
5256         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5257                 return -EINVAL;
5258
5259         if (!info->attrs[NL80211_ATTR_MAC])
5260                 return -EINVAL;
5261
5262         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5263                 return -EINVAL;
5264
5265         if (!rdev->ops->disassoc)
5266                 return -EOPNOTSUPP;
5267
5268         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5269             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5270                 return -EOPNOTSUPP;
5271
5272         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5273
5274         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5275         if (reason_code == 0) {
5276                 /* Reason Code 0 is reserved */
5277                 return -EINVAL;
5278         }
5279
5280         if (info->attrs[NL80211_ATTR_IE]) {
5281                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5282                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5283         }
5284
5285         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5286
5287         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
5288                                       local_state_change);
5289 }
5290
5291 static bool
5292 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
5293                          int mcast_rate[IEEE80211_NUM_BANDS],
5294                          int rateval)
5295 {
5296         struct wiphy *wiphy = &rdev->wiphy;
5297         bool found = false;
5298         int band, i;
5299
5300         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5301                 struct ieee80211_supported_band *sband;
5302
5303                 sband = wiphy->bands[band];
5304                 if (!sband)
5305                         continue;
5306
5307                 for (i = 0; i < sband->n_bitrates; i++) {
5308                         if (sband->bitrates[i].bitrate == rateval) {
5309                                 mcast_rate[band] = i + 1;
5310                                 found = true;
5311                                 break;
5312                         }
5313                 }
5314         }
5315
5316         return found;
5317 }
5318
5319 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
5320 {
5321         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5322         struct net_device *dev = info->user_ptr[1];
5323         struct cfg80211_ibss_params ibss;
5324         struct wiphy *wiphy;
5325         struct cfg80211_cached_keys *connkeys = NULL;
5326         int err;
5327
5328         memset(&ibss, 0, sizeof(ibss));
5329
5330         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5331                 return -EINVAL;
5332
5333         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5334             !info->attrs[NL80211_ATTR_SSID] ||
5335             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5336                 return -EINVAL;
5337
5338         ibss.beacon_interval = 100;
5339
5340         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
5341                 ibss.beacon_interval =
5342                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5343                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
5344                         return -EINVAL;
5345         }
5346
5347         if (!rdev->ops->join_ibss)
5348                 return -EOPNOTSUPP;
5349
5350         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5351                 return -EOPNOTSUPP;
5352
5353         wiphy = &rdev->wiphy;
5354
5355         if (info->attrs[NL80211_ATTR_MAC]) {
5356                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5357
5358                 if (!is_valid_ether_addr(ibss.bssid))
5359                         return -EINVAL;
5360         }
5361         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5362         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5363
5364         if (info->attrs[NL80211_ATTR_IE]) {
5365                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5366                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5367         }
5368
5369         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5370                 enum nl80211_channel_type channel_type;
5371
5372                 if (!nl80211_valid_channel_type(info, &channel_type))
5373                         return -EINVAL;
5374
5375                 if (channel_type != NL80211_CHAN_NO_HT &&
5376                     !(wiphy->features & NL80211_FEATURE_HT_IBSS))
5377                         return -EINVAL;
5378
5379                 ibss.channel_type = channel_type;
5380         } else {
5381                 ibss.channel_type = NL80211_CHAN_NO_HT;
5382         }
5383
5384         ibss.channel = rdev_freq_to_chan(rdev,
5385                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
5386                 ibss.channel_type);
5387         if (!ibss.channel ||
5388             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
5389             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
5390                 return -EINVAL;
5391
5392         /* Both channels should be able to initiate communication */
5393         if ((ibss.channel_type == NL80211_CHAN_HT40PLUS ||
5394              ibss.channel_type == NL80211_CHAN_HT40MINUS) &&
5395             !cfg80211_can_beacon_sec_chan(&rdev->wiphy, ibss.channel,
5396                                           ibss.channel_type))
5397                 return -EINVAL;
5398
5399         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
5400         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5401
5402         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5403                 u8 *rates =
5404                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5405                 int n_rates =
5406                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5407                 struct ieee80211_supported_band *sband =
5408                         wiphy->bands[ibss.channel->band];
5409
5410                 err = ieee80211_get_ratemask(sband, rates, n_rates,
5411                                              &ibss.basic_rates);
5412                 if (err)
5413                         return err;
5414         }
5415
5416         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5417             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
5418                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5419                 return -EINVAL;
5420
5421         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5422                 bool no_ht = false;
5423
5424                 connkeys = nl80211_parse_connkeys(rdev,
5425                                           info->attrs[NL80211_ATTR_KEYS],
5426                                           &no_ht);
5427                 if (IS_ERR(connkeys))
5428                         return PTR_ERR(connkeys);
5429
5430                 if ((ibss.channel_type != NL80211_CHAN_NO_HT) && no_ht) {
5431                         kfree(connkeys);
5432                         return -EINVAL;
5433                 }
5434         }
5435
5436         ibss.control_port =
5437                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
5438
5439         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
5440         if (err)
5441                 kfree(connkeys);
5442         return err;
5443 }
5444
5445 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
5446 {
5447         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5448         struct net_device *dev = info->user_ptr[1];
5449
5450         if (!rdev->ops->leave_ibss)
5451                 return -EOPNOTSUPP;
5452
5453         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5454                 return -EOPNOTSUPP;
5455
5456         return cfg80211_leave_ibss(rdev, dev, false);
5457 }
5458
5459 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
5460 {
5461         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5462         struct net_device *dev = info->user_ptr[1];
5463         int mcast_rate[IEEE80211_NUM_BANDS];
5464         u32 nla_rate;
5465         int err;
5466
5467         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5468             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5469                 return -EOPNOTSUPP;
5470
5471         if (!rdev->ops->set_mcast_rate)
5472                 return -EOPNOTSUPP;
5473
5474         memset(mcast_rate, 0, sizeof(mcast_rate));
5475
5476         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
5477                 return -EINVAL;
5478
5479         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
5480         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
5481                 return -EINVAL;
5482
5483         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
5484
5485         return err;
5486 }
5487
5488
5489 #ifdef CONFIG_NL80211_TESTMODE
5490 static struct genl_multicast_group nl80211_testmode_mcgrp = {
5491         .name = "testmode",
5492 };
5493
5494 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
5495 {
5496         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5497         int err;
5498
5499         if (!info->attrs[NL80211_ATTR_TESTDATA])
5500                 return -EINVAL;
5501
5502         err = -EOPNOTSUPP;
5503         if (rdev->ops->testmode_cmd) {
5504                 rdev->testmode_info = info;
5505                 err = rdev_testmode_cmd(rdev,
5506                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
5507                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
5508                 rdev->testmode_info = NULL;
5509         }
5510
5511         return err;
5512 }
5513
5514 static int nl80211_testmode_dump(struct sk_buff *skb,
5515                                  struct netlink_callback *cb)
5516 {
5517         struct cfg80211_registered_device *rdev;
5518         int err;
5519         long phy_idx;
5520         void *data = NULL;
5521         int data_len = 0;
5522
5523         if (cb->args[0]) {
5524                 /*
5525                  * 0 is a valid index, but not valid for args[0],
5526                  * so we need to offset by 1.
5527                  */
5528                 phy_idx = cb->args[0] - 1;
5529         } else {
5530                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
5531                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
5532                                   nl80211_policy);
5533                 if (err)
5534                         return err;
5535
5536                 mutex_lock(&cfg80211_mutex);
5537                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
5538                                                   nl80211_fam.attrbuf);
5539                 if (IS_ERR(rdev)) {
5540                         mutex_unlock(&cfg80211_mutex);
5541                         return PTR_ERR(rdev);
5542                 }
5543                 phy_idx = rdev->wiphy_idx;
5544                 rdev = NULL;
5545                 mutex_unlock(&cfg80211_mutex);
5546
5547                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
5548                         cb->args[1] =
5549                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
5550         }
5551
5552         if (cb->args[1]) {
5553                 data = nla_data((void *)cb->args[1]);
5554                 data_len = nla_len((void *)cb->args[1]);
5555         }
5556
5557         mutex_lock(&cfg80211_mutex);
5558         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
5559         if (!rdev) {
5560                 mutex_unlock(&cfg80211_mutex);
5561                 return -ENOENT;
5562         }
5563         cfg80211_lock_rdev(rdev);
5564         mutex_unlock(&cfg80211_mutex);
5565
5566         if (!rdev->ops->testmode_dump) {
5567                 err = -EOPNOTSUPP;
5568                 goto out_err;
5569         }
5570
5571         while (1) {
5572                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
5573                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
5574                                            NL80211_CMD_TESTMODE);
5575                 struct nlattr *tmdata;
5576
5577                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
5578                         genlmsg_cancel(skb, hdr);
5579                         break;
5580                 }
5581
5582                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5583                 if (!tmdata) {
5584                         genlmsg_cancel(skb, hdr);
5585                         break;
5586                 }
5587                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
5588                 nla_nest_end(skb, tmdata);
5589
5590                 if (err == -ENOBUFS || err == -ENOENT) {
5591                         genlmsg_cancel(skb, hdr);
5592                         break;
5593                 } else if (err) {
5594                         genlmsg_cancel(skb, hdr);
5595                         goto out_err;
5596                 }
5597
5598                 genlmsg_end(skb, hdr);
5599         }
5600
5601         err = skb->len;
5602         /* see above */
5603         cb->args[0] = phy_idx + 1;
5604  out_err:
5605         cfg80211_unlock_rdev(rdev);
5606         return err;
5607 }
5608
5609 static struct sk_buff *
5610 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
5611                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
5612 {
5613         struct sk_buff *skb;
5614         void *hdr;
5615         struct nlattr *data;
5616
5617         skb = nlmsg_new(approxlen + 100, gfp);
5618         if (!skb)
5619                 return NULL;
5620
5621         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
5622         if (!hdr) {
5623                 kfree_skb(skb);
5624                 return NULL;
5625         }
5626
5627         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
5628                 goto nla_put_failure;
5629         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5630
5631         ((void **)skb->cb)[0] = rdev;
5632         ((void **)skb->cb)[1] = hdr;
5633         ((void **)skb->cb)[2] = data;
5634
5635         return skb;
5636
5637  nla_put_failure:
5638         kfree_skb(skb);
5639         return NULL;
5640 }
5641
5642 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
5643                                                   int approxlen)
5644 {
5645         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5646
5647         if (WARN_ON(!rdev->testmode_info))
5648                 return NULL;
5649
5650         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
5651                                 rdev->testmode_info->snd_portid,
5652                                 rdev->testmode_info->snd_seq,
5653                                 GFP_KERNEL);
5654 }
5655 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
5656
5657 int cfg80211_testmode_reply(struct sk_buff *skb)
5658 {
5659         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
5660         void *hdr = ((void **)skb->cb)[1];
5661         struct nlattr *data = ((void **)skb->cb)[2];
5662
5663         if (WARN_ON(!rdev->testmode_info)) {
5664                 kfree_skb(skb);
5665                 return -EINVAL;
5666         }
5667
5668         nla_nest_end(skb, data);
5669         genlmsg_end(skb, hdr);
5670         return genlmsg_reply(skb, rdev->testmode_info);
5671 }
5672 EXPORT_SYMBOL(cfg80211_testmode_reply);
5673
5674 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
5675                                                   int approxlen, gfp_t gfp)
5676 {
5677         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5678
5679         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
5680 }
5681 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
5682
5683 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
5684 {
5685         void *hdr = ((void **)skb->cb)[1];
5686         struct nlattr *data = ((void **)skb->cb)[2];
5687
5688         nla_nest_end(skb, data);
5689         genlmsg_end(skb, hdr);
5690         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
5691 }
5692 EXPORT_SYMBOL(cfg80211_testmode_event);
5693 #endif
5694
5695 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
5696 {
5697         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5698         struct net_device *dev = info->user_ptr[1];
5699         struct cfg80211_connect_params connect;
5700         struct wiphy *wiphy;
5701         struct cfg80211_cached_keys *connkeys = NULL;
5702         int err;
5703
5704         memset(&connect, 0, sizeof(connect));
5705
5706         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5707                 return -EINVAL;
5708
5709         if (!info->attrs[NL80211_ATTR_SSID] ||
5710             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5711                 return -EINVAL;
5712
5713         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5714                 connect.auth_type =
5715                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5716                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
5717                                              NL80211_CMD_CONNECT))
5718                         return -EINVAL;
5719         } else
5720                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5721
5722         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
5723
5724         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
5725                                       NL80211_MAX_NR_CIPHER_SUITES);
5726         if (err)
5727                 return err;
5728
5729         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5730             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5731                 return -EOPNOTSUPP;
5732
5733         wiphy = &rdev->wiphy;
5734
5735         connect.bg_scan_period = -1;
5736         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
5737                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
5738                 connect.bg_scan_period =
5739                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
5740         }
5741
5742         if (info->attrs[NL80211_ATTR_MAC])
5743                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5744         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5745         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5746
5747         if (info->attrs[NL80211_ATTR_IE]) {
5748                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5749                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5750         }
5751
5752         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5753                 connect.channel =
5754                         ieee80211_get_channel(wiphy,
5755                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5756                 if (!connect.channel ||
5757                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
5758                         return -EINVAL;
5759         }
5760
5761         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5762                 connkeys = nl80211_parse_connkeys(rdev,
5763                                           info->attrs[NL80211_ATTR_KEYS], NULL);
5764                 if (IS_ERR(connkeys))
5765                         return PTR_ERR(connkeys);
5766         }
5767
5768         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5769                 connect.flags |= ASSOC_REQ_DISABLE_HT;
5770
5771         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5772                 memcpy(&connect.ht_capa_mask,
5773                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
5774                        sizeof(connect.ht_capa_mask));
5775
5776         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5777                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
5778                         kfree(connkeys);
5779                         return -EINVAL;
5780                 }
5781                 memcpy(&connect.ht_capa,
5782                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
5783                        sizeof(connect.ht_capa));
5784         }
5785
5786         err = cfg80211_connect(rdev, dev, &connect, connkeys);
5787         if (err)
5788                 kfree(connkeys);
5789         return err;
5790 }
5791
5792 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
5793 {
5794         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5795         struct net_device *dev = info->user_ptr[1];
5796         u16 reason;
5797
5798         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5799                 reason = WLAN_REASON_DEAUTH_LEAVING;
5800         else
5801                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5802
5803         if (reason == 0)
5804                 return -EINVAL;
5805
5806         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5807             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5808                 return -EOPNOTSUPP;
5809
5810         return cfg80211_disconnect(rdev, dev, reason, true);
5811 }
5812
5813 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
5814 {
5815         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5816         struct net *net;
5817         int err;
5818         u32 pid;
5819
5820         if (!info->attrs[NL80211_ATTR_PID])
5821                 return -EINVAL;
5822
5823         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
5824
5825         net = get_net_ns_by_pid(pid);
5826         if (IS_ERR(net))
5827                 return PTR_ERR(net);
5828
5829         err = 0;
5830
5831         /* check if anything to do */
5832         if (!net_eq(wiphy_net(&rdev->wiphy), net))
5833                 err = cfg80211_switch_netns(rdev, net);
5834
5835         put_net(net);
5836         return err;
5837 }
5838
5839 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
5840 {
5841         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5842         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
5843                         struct cfg80211_pmksa *pmksa) = NULL;
5844         struct net_device *dev = info->user_ptr[1];
5845         struct cfg80211_pmksa pmksa;
5846
5847         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
5848
5849         if (!info->attrs[NL80211_ATTR_MAC])
5850                 return -EINVAL;
5851
5852         if (!info->attrs[NL80211_ATTR_PMKID])
5853                 return -EINVAL;
5854
5855         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
5856         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5857
5858         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5859             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5860                 return -EOPNOTSUPP;
5861
5862         switch (info->genlhdr->cmd) {
5863         case NL80211_CMD_SET_PMKSA:
5864                 rdev_ops = rdev->ops->set_pmksa;
5865                 break;
5866         case NL80211_CMD_DEL_PMKSA:
5867                 rdev_ops = rdev->ops->del_pmksa;
5868                 break;
5869         default:
5870                 WARN_ON(1);
5871                 break;
5872         }
5873
5874         if (!rdev_ops)
5875                 return -EOPNOTSUPP;
5876
5877         return rdev_ops(&rdev->wiphy, dev, &pmksa);
5878 }
5879
5880 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
5881 {
5882         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5883         struct net_device *dev = info->user_ptr[1];
5884
5885         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5886             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5887                 return -EOPNOTSUPP;
5888
5889         if (!rdev->ops->flush_pmksa)
5890                 return -EOPNOTSUPP;
5891
5892         return rdev_flush_pmksa(rdev, dev);
5893 }
5894
5895 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
5896 {
5897         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5898         struct net_device *dev = info->user_ptr[1];
5899         u8 action_code, dialog_token;
5900         u16 status_code;
5901         u8 *peer;
5902
5903         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5904             !rdev->ops->tdls_mgmt)
5905                 return -EOPNOTSUPP;
5906
5907         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
5908             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
5909             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
5910             !info->attrs[NL80211_ATTR_IE] ||
5911             !info->attrs[NL80211_ATTR_MAC])
5912                 return -EINVAL;
5913
5914         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5915         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
5916         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
5917         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
5918
5919         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
5920                               dialog_token, status_code,
5921                               nla_data(info->attrs[NL80211_ATTR_IE]),
5922                               nla_len(info->attrs[NL80211_ATTR_IE]));
5923 }
5924
5925 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
5926 {
5927         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5928         struct net_device *dev = info->user_ptr[1];
5929         enum nl80211_tdls_operation operation;
5930         u8 *peer;
5931
5932         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5933             !rdev->ops->tdls_oper)
5934                 return -EOPNOTSUPP;
5935
5936         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
5937             !info->attrs[NL80211_ATTR_MAC])
5938                 return -EINVAL;
5939
5940         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
5941         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5942
5943         return rdev_tdls_oper(rdev, dev, peer, operation);
5944 }
5945
5946 static int nl80211_remain_on_channel(struct sk_buff *skb,
5947                                      struct genl_info *info)
5948 {
5949         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5950         struct wireless_dev *wdev = info->user_ptr[1];
5951         struct ieee80211_channel *chan;
5952         struct sk_buff *msg;
5953         void *hdr;
5954         u64 cookie;
5955         u32 freq, duration;
5956         int err;
5957
5958         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5959             !info->attrs[NL80211_ATTR_DURATION])
5960                 return -EINVAL;
5961
5962         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5963
5964         if (!rdev->ops->remain_on_channel ||
5965             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
5966                 return -EOPNOTSUPP;
5967
5968         /*
5969          * We should be on that channel for at least a minimum amount of
5970          * time (10ms) but no longer than the driver supports.
5971          */
5972         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
5973             duration > rdev->wiphy.max_remain_on_channel_duration)
5974                 return -EINVAL;
5975
5976         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
5977             !nl80211_valid_channel_type(info, NULL))
5978                 return -EINVAL;
5979
5980         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5981         chan = rdev_freq_to_chan(rdev, freq, NL80211_CHAN_NO_HT);
5982         if (chan == NULL)
5983                 return -EINVAL;
5984
5985         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5986         if (!msg)
5987                 return -ENOMEM;
5988
5989         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5990                              NL80211_CMD_REMAIN_ON_CHANNEL);
5991
5992         if (IS_ERR(hdr)) {
5993                 err = PTR_ERR(hdr);
5994                 goto free_msg;
5995         }
5996
5997         err = rdev_remain_on_channel(rdev, wdev, chan, duration, &cookie);
5998
5999         if (err)
6000                 goto free_msg;
6001
6002         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6003                 goto nla_put_failure;
6004
6005         genlmsg_end(msg, hdr);
6006
6007         return genlmsg_reply(msg, info);
6008
6009  nla_put_failure:
6010         err = -ENOBUFS;
6011  free_msg:
6012         nlmsg_free(msg);
6013         return err;
6014 }
6015
6016 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6017                                             struct genl_info *info)
6018 {
6019         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6020         struct wireless_dev *wdev = info->user_ptr[1];
6021         u64 cookie;
6022
6023         if (!info->attrs[NL80211_ATTR_COOKIE])
6024                 return -EINVAL;
6025
6026         if (!rdev->ops->cancel_remain_on_channel)
6027                 return -EOPNOTSUPP;
6028
6029         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6030
6031         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6032 }
6033
6034 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6035                            u8 *rates, u8 rates_len)
6036 {
6037         u8 i;
6038         u32 mask = 0;
6039
6040         for (i = 0; i < rates_len; i++) {
6041                 int rate = (rates[i] & 0x7f) * 5;
6042                 int ridx;
6043                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6044                         struct ieee80211_rate *srate =
6045                                 &sband->bitrates[ridx];
6046                         if (rate == srate->bitrate) {
6047                                 mask |= 1 << ridx;
6048                                 break;
6049                         }
6050                 }
6051                 if (ridx == sband->n_bitrates)
6052                         return 0; /* rate not found */
6053         }
6054
6055         return mask;
6056 }
6057
6058 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6059                                u8 *rates, u8 rates_len,
6060                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6061 {
6062         u8 i;
6063
6064         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6065
6066         for (i = 0; i < rates_len; i++) {
6067                 int ridx, rbit;
6068
6069                 ridx = rates[i] / 8;
6070                 rbit = BIT(rates[i] % 8);
6071
6072                 /* check validity */
6073                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6074                         return false;
6075
6076                 /* check availability */
6077                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
6078                         mcs[ridx] |= rbit;
6079                 else
6080                         return false;
6081         }
6082
6083         return true;
6084 }
6085
6086 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
6087         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
6088                                     .len = NL80211_MAX_SUPP_RATES },
6089         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
6090                                  .len = NL80211_MAX_SUPP_HT_RATES },
6091 };
6092
6093 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
6094                                        struct genl_info *info)
6095 {
6096         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
6097         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6098         struct cfg80211_bitrate_mask mask;
6099         int rem, i;
6100         struct net_device *dev = info->user_ptr[1];
6101         struct nlattr *tx_rates;
6102         struct ieee80211_supported_band *sband;
6103
6104         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
6105                 return -EINVAL;
6106
6107         if (!rdev->ops->set_bitrate_mask)
6108                 return -EOPNOTSUPP;
6109
6110         memset(&mask, 0, sizeof(mask));
6111         /* Default to all rates enabled */
6112         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
6113                 sband = rdev->wiphy.bands[i];
6114                 mask.control[i].legacy =
6115                         sband ? (1 << sband->n_bitrates) - 1 : 0;
6116                 if (sband)
6117                         memcpy(mask.control[i].mcs,
6118                                sband->ht_cap.mcs.rx_mask,
6119                                sizeof(mask.control[i].mcs));
6120                 else
6121                         memset(mask.control[i].mcs, 0,
6122                                sizeof(mask.control[i].mcs));
6123         }
6124
6125         /*
6126          * The nested attribute uses enum nl80211_band as the index. This maps
6127          * directly to the enum ieee80211_band values used in cfg80211.
6128          */
6129         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
6130         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
6131         {
6132                 enum ieee80211_band band = nla_type(tx_rates);
6133                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
6134                         return -EINVAL;
6135                 sband = rdev->wiphy.bands[band];
6136                 if (sband == NULL)
6137                         return -EINVAL;
6138                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
6139                           nla_len(tx_rates), nl80211_txattr_policy);
6140                 if (tb[NL80211_TXRATE_LEGACY]) {
6141                         mask.control[band].legacy = rateset_to_mask(
6142                                 sband,
6143                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
6144                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
6145                         if ((mask.control[band].legacy == 0) &&
6146                             nla_len(tb[NL80211_TXRATE_LEGACY]))
6147                                 return -EINVAL;
6148                 }
6149                 if (tb[NL80211_TXRATE_MCS]) {
6150                         if (!ht_rateset_to_mask(
6151                                         sband,
6152                                         nla_data(tb[NL80211_TXRATE_MCS]),
6153                                         nla_len(tb[NL80211_TXRATE_MCS]),
6154                                         mask.control[band].mcs))
6155                                 return -EINVAL;
6156                 }
6157
6158                 if (mask.control[band].legacy == 0) {
6159                         /* don't allow empty legacy rates if HT
6160                          * is not even supported. */
6161                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
6162                                 return -EINVAL;
6163
6164                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
6165                                 if (mask.control[band].mcs[i])
6166                                         break;
6167
6168                         /* legacy and mcs rates may not be both empty */
6169                         if (i == IEEE80211_HT_MCS_MASK_LEN)
6170                                 return -EINVAL;
6171                 }
6172         }
6173
6174         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
6175 }
6176
6177 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
6178 {
6179         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6180         struct wireless_dev *wdev = info->user_ptr[1];
6181         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
6182
6183         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
6184                 return -EINVAL;
6185
6186         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
6187                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
6188
6189         switch (wdev->iftype) {
6190         case NL80211_IFTYPE_STATION:
6191         case NL80211_IFTYPE_ADHOC:
6192         case NL80211_IFTYPE_P2P_CLIENT:
6193         case NL80211_IFTYPE_AP:
6194         case NL80211_IFTYPE_AP_VLAN:
6195         case NL80211_IFTYPE_MESH_POINT:
6196         case NL80211_IFTYPE_P2P_GO:
6197         case NL80211_IFTYPE_P2P_DEVICE:
6198                 break;
6199         default:
6200                 return -EOPNOTSUPP;
6201         }
6202
6203         /* not much point in registering if we can't reply */
6204         if (!rdev->ops->mgmt_tx)
6205                 return -EOPNOTSUPP;
6206
6207         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
6208                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
6209                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
6210 }
6211
6212 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
6213 {
6214         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6215         struct wireless_dev *wdev = info->user_ptr[1];
6216         struct ieee80211_channel *chan;
6217         u32 freq;
6218         int err;
6219         void *hdr = NULL;
6220         u64 cookie;
6221         struct sk_buff *msg = NULL;
6222         unsigned int wait = 0;
6223         bool offchan, no_cck, dont_wait_for_ack;
6224
6225         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
6226
6227         if (!info->attrs[NL80211_ATTR_FRAME] ||
6228             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6229                 return -EINVAL;
6230
6231         if (!rdev->ops->mgmt_tx)
6232                 return -EOPNOTSUPP;
6233
6234         switch (wdev->iftype) {
6235         case NL80211_IFTYPE_STATION:
6236         case NL80211_IFTYPE_ADHOC:
6237         case NL80211_IFTYPE_P2P_CLIENT:
6238         case NL80211_IFTYPE_AP:
6239         case NL80211_IFTYPE_AP_VLAN:
6240         case NL80211_IFTYPE_MESH_POINT:
6241         case NL80211_IFTYPE_P2P_GO:
6242         case NL80211_IFTYPE_P2P_DEVICE:
6243                 break;
6244         default:
6245                 return -EOPNOTSUPP;
6246         }
6247
6248         if (info->attrs[NL80211_ATTR_DURATION]) {
6249                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6250                         return -EINVAL;
6251                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6252
6253                 /*
6254                  * We should wait on the channel for at least a minimum amount
6255                  * of time (10ms) but no longer than the driver supports.
6256                  */
6257                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6258                     wait > rdev->wiphy.max_remain_on_channel_duration)
6259                         return -EINVAL;
6260
6261         }
6262
6263         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
6264             !nl80211_valid_channel_type(info, NULL))
6265                 return -EINVAL;
6266
6267         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
6268
6269         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6270                 return -EINVAL;
6271
6272         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6273
6274         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6275         chan = rdev_freq_to_chan(rdev, freq, NL80211_CHAN_NO_HT);
6276         if (chan == NULL)
6277                 return -EINVAL;
6278
6279         if (!dont_wait_for_ack) {
6280                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6281                 if (!msg)
6282                         return -ENOMEM;
6283
6284                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6285                                      NL80211_CMD_FRAME);
6286
6287                 if (IS_ERR(hdr)) {
6288                         err = PTR_ERR(hdr);
6289                         goto free_msg;
6290                 }
6291         }
6292
6293         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chan, offchan, wait,
6294                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
6295                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
6296                                     no_cck, dont_wait_for_ack, &cookie);
6297         if (err)
6298                 goto free_msg;
6299
6300         if (msg) {
6301                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6302                         goto nla_put_failure;
6303
6304                 genlmsg_end(msg, hdr);
6305                 return genlmsg_reply(msg, info);
6306         }
6307
6308         return 0;
6309
6310  nla_put_failure:
6311         err = -ENOBUFS;
6312  free_msg:
6313         nlmsg_free(msg);
6314         return err;
6315 }
6316
6317 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
6318 {
6319         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6320         struct wireless_dev *wdev = info->user_ptr[1];
6321         u64 cookie;
6322
6323         if (!info->attrs[NL80211_ATTR_COOKIE])
6324                 return -EINVAL;
6325
6326         if (!rdev->ops->mgmt_tx_cancel_wait)
6327                 return -EOPNOTSUPP;
6328
6329         switch (wdev->iftype) {
6330         case NL80211_IFTYPE_STATION:
6331         case NL80211_IFTYPE_ADHOC:
6332         case NL80211_IFTYPE_P2P_CLIENT:
6333         case NL80211_IFTYPE_AP:
6334         case NL80211_IFTYPE_AP_VLAN:
6335         case NL80211_IFTYPE_P2P_GO:
6336         case NL80211_IFTYPE_P2P_DEVICE:
6337                 break;
6338         default:
6339                 return -EOPNOTSUPP;
6340         }
6341
6342         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6343
6344         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
6345 }
6346
6347 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
6348 {
6349         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6350         struct wireless_dev *wdev;
6351         struct net_device *dev = info->user_ptr[1];
6352         u8 ps_state;
6353         bool state;
6354         int err;
6355
6356         if (!info->attrs[NL80211_ATTR_PS_STATE])
6357                 return -EINVAL;
6358
6359         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
6360
6361         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
6362                 return -EINVAL;
6363
6364         wdev = dev->ieee80211_ptr;
6365
6366         if (!rdev->ops->set_power_mgmt)
6367                 return -EOPNOTSUPP;
6368
6369         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
6370
6371         if (state == wdev->ps)
6372                 return 0;
6373
6374         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
6375         if (!err)
6376                 wdev->ps = state;
6377         return err;
6378 }
6379
6380 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
6381 {
6382         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6383         enum nl80211_ps_state ps_state;
6384         struct wireless_dev *wdev;
6385         struct net_device *dev = info->user_ptr[1];
6386         struct sk_buff *msg;
6387         void *hdr;
6388         int err;
6389
6390         wdev = dev->ieee80211_ptr;
6391
6392         if (!rdev->ops->set_power_mgmt)
6393                 return -EOPNOTSUPP;
6394
6395         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6396         if (!msg)
6397                 return -ENOMEM;
6398
6399         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6400                              NL80211_CMD_GET_POWER_SAVE);
6401         if (!hdr) {
6402                 err = -ENOBUFS;
6403                 goto free_msg;
6404         }
6405
6406         if (wdev->ps)
6407                 ps_state = NL80211_PS_ENABLED;
6408         else
6409                 ps_state = NL80211_PS_DISABLED;
6410
6411         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
6412                 goto nla_put_failure;
6413
6414         genlmsg_end(msg, hdr);
6415         return genlmsg_reply(msg, info);
6416
6417  nla_put_failure:
6418         err = -ENOBUFS;
6419  free_msg:
6420         nlmsg_free(msg);
6421         return err;
6422 }
6423
6424 static struct nla_policy
6425 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
6426         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
6427         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
6428         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
6429         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
6430         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
6431         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
6432 };
6433
6434 static int nl80211_set_cqm_txe(struct genl_info *info,
6435                                 u32 rate, u32 pkts, u32 intvl)
6436 {
6437         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6438         struct wireless_dev *wdev;
6439         struct net_device *dev = info->user_ptr[1];
6440
6441         if ((rate < 0 || rate > 100) ||
6442             (intvl < 0 || intvl > NL80211_CQM_TXE_MAX_INTVL))
6443                 return -EINVAL;
6444
6445         wdev = dev->ieee80211_ptr;
6446
6447         if (!rdev->ops->set_cqm_txe_config)
6448                 return -EOPNOTSUPP;
6449
6450         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6451             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6452                 return -EOPNOTSUPP;
6453
6454         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
6455 }
6456
6457 static int nl80211_set_cqm_rssi(struct genl_info *info,
6458                                 s32 threshold, u32 hysteresis)
6459 {
6460         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6461         struct wireless_dev *wdev;
6462         struct net_device *dev = info->user_ptr[1];
6463
6464         if (threshold > 0)
6465                 return -EINVAL;
6466
6467         wdev = dev->ieee80211_ptr;
6468
6469         if (!rdev->ops->set_cqm_rssi_config)
6470                 return -EOPNOTSUPP;
6471
6472         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6473             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6474                 return -EOPNOTSUPP;
6475
6476         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
6477 }
6478
6479 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
6480 {
6481         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
6482         struct nlattr *cqm;
6483         int err;
6484
6485         cqm = info->attrs[NL80211_ATTR_CQM];
6486         if (!cqm) {
6487                 err = -EINVAL;
6488                 goto out;
6489         }
6490
6491         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
6492                                nl80211_attr_cqm_policy);
6493         if (err)
6494                 goto out;
6495
6496         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
6497             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
6498                 s32 threshold;
6499                 u32 hysteresis;
6500                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
6501                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
6502                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
6503         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
6504                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
6505                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
6506                 u32 rate, pkts, intvl;
6507                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
6508                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
6509                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
6510                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
6511         } else
6512                 err = -EINVAL;
6513
6514 out:
6515         return err;
6516 }
6517
6518 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
6519 {
6520         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6521         struct net_device *dev = info->user_ptr[1];
6522         struct mesh_config cfg;
6523         struct mesh_setup setup;
6524         int err;
6525
6526         /* start with default */
6527         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
6528         memcpy(&setup, &default_mesh_setup, sizeof(setup));
6529
6530         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
6531                 /* and parse parameters if given */
6532                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
6533                 if (err)
6534                         return err;
6535         }
6536
6537         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
6538             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
6539                 return -EINVAL;
6540
6541         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
6542         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
6543
6544         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6545             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
6546                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6547                         return -EINVAL;
6548
6549         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
6550                 /* parse additional setup parameters if given */
6551                 err = nl80211_parse_mesh_setup(info, &setup);
6552                 if (err)
6553                         return err;
6554         }
6555
6556         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6557                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
6558
6559                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
6560                     !nl80211_valid_channel_type(info, &channel_type))
6561                         return -EINVAL;
6562
6563                 setup.channel = rdev_freq_to_chan(rdev,
6564                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
6565                         channel_type);
6566                 if (!setup.channel)
6567                         return -EINVAL;
6568                 setup.channel_type = channel_type;
6569         } else {
6570                 /* cfg80211_join_mesh() will sort it out */
6571                 setup.channel = NULL;
6572         }
6573
6574         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
6575 }
6576
6577 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
6578 {
6579         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6580         struct net_device *dev = info->user_ptr[1];
6581
6582         return cfg80211_leave_mesh(rdev, dev);
6583 }
6584
6585 #ifdef CONFIG_PM
6586 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
6587 {
6588         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6589         struct sk_buff *msg;
6590         void *hdr;
6591
6592         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6593                 return -EOPNOTSUPP;
6594
6595         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6596         if (!msg)
6597                 return -ENOMEM;
6598
6599         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6600                              NL80211_CMD_GET_WOWLAN);
6601         if (!hdr)
6602                 goto nla_put_failure;
6603
6604         if (rdev->wowlan) {
6605                 struct nlattr *nl_wowlan;
6606
6607                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
6608                 if (!nl_wowlan)
6609                         goto nla_put_failure;
6610
6611                 if ((rdev->wowlan->any &&
6612                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
6613                     (rdev->wowlan->disconnect &&
6614                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
6615                     (rdev->wowlan->magic_pkt &&
6616                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
6617                     (rdev->wowlan->gtk_rekey_failure &&
6618                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
6619                     (rdev->wowlan->eap_identity_req &&
6620                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
6621                     (rdev->wowlan->four_way_handshake &&
6622                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
6623                     (rdev->wowlan->rfkill_release &&
6624                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
6625                         goto nla_put_failure;
6626                 if (rdev->wowlan->n_patterns) {
6627                         struct nlattr *nl_pats, *nl_pat;
6628                         int i, pat_len;
6629
6630                         nl_pats = nla_nest_start(msg,
6631                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
6632                         if (!nl_pats)
6633                                 goto nla_put_failure;
6634
6635                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
6636                                 nl_pat = nla_nest_start(msg, i + 1);
6637                                 if (!nl_pat)
6638                                         goto nla_put_failure;
6639                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
6640                                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
6641                                             DIV_ROUND_UP(pat_len, 8),
6642                                             rdev->wowlan->patterns[i].mask) ||
6643                                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
6644                                             pat_len,
6645                                             rdev->wowlan->patterns[i].pattern))
6646                                         goto nla_put_failure;
6647                                 nla_nest_end(msg, nl_pat);
6648                         }
6649                         nla_nest_end(msg, nl_pats);
6650                 }
6651
6652                 nla_nest_end(msg, nl_wowlan);
6653         }
6654
6655         genlmsg_end(msg, hdr);
6656         return genlmsg_reply(msg, info);
6657
6658 nla_put_failure:
6659         nlmsg_free(msg);
6660         return -ENOBUFS;
6661 }
6662
6663 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
6664 {
6665         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6666         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
6667         struct cfg80211_wowlan new_triggers = {};
6668         struct cfg80211_wowlan *ntrig;
6669         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
6670         int err, i;
6671         bool prev_enabled = rdev->wowlan;
6672
6673         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6674                 return -EOPNOTSUPP;
6675
6676         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
6677                 cfg80211_rdev_free_wowlan(rdev);
6678                 rdev->wowlan = NULL;
6679                 goto set_wakeup;
6680         }
6681
6682         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
6683                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6684                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6685                         nl80211_wowlan_policy);
6686         if (err)
6687                 return err;
6688
6689         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
6690                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
6691                         return -EINVAL;
6692                 new_triggers.any = true;
6693         }
6694
6695         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
6696                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
6697                         return -EINVAL;
6698                 new_triggers.disconnect = true;
6699         }
6700
6701         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
6702                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
6703                         return -EINVAL;
6704                 new_triggers.magic_pkt = true;
6705         }
6706
6707         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
6708                 return -EINVAL;
6709
6710         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
6711                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
6712                         return -EINVAL;
6713                 new_triggers.gtk_rekey_failure = true;
6714         }
6715
6716         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
6717                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
6718                         return -EINVAL;
6719                 new_triggers.eap_identity_req = true;
6720         }
6721
6722         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
6723                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
6724                         return -EINVAL;
6725                 new_triggers.four_way_handshake = true;
6726         }
6727
6728         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
6729                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
6730                         return -EINVAL;
6731                 new_triggers.rfkill_release = true;
6732         }
6733
6734         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
6735                 struct nlattr *pat;
6736                 int n_patterns = 0;
6737                 int rem, pat_len, mask_len;
6738                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
6739
6740                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6741                                     rem)
6742                         n_patterns++;
6743                 if (n_patterns > wowlan->n_patterns)
6744                         return -EINVAL;
6745
6746                 new_triggers.patterns = kcalloc(n_patterns,
6747                                                 sizeof(new_triggers.patterns[0]),
6748                                                 GFP_KERNEL);
6749                 if (!new_triggers.patterns)
6750                         return -ENOMEM;
6751
6752                 new_triggers.n_patterns = n_patterns;
6753                 i = 0;
6754
6755                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6756                                     rem) {
6757                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
6758                                   nla_data(pat), nla_len(pat), NULL);
6759                         err = -EINVAL;
6760                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
6761                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
6762                                 goto error;
6763                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
6764                         mask_len = DIV_ROUND_UP(pat_len, 8);
6765                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
6766                             mask_len)
6767                                 goto error;
6768                         if (pat_len > wowlan->pattern_max_len ||
6769                             pat_len < wowlan->pattern_min_len)
6770                                 goto error;
6771
6772                         new_triggers.patterns[i].mask =
6773                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
6774                         if (!new_triggers.patterns[i].mask) {
6775                                 err = -ENOMEM;
6776                                 goto error;
6777                         }
6778                         new_triggers.patterns[i].pattern =
6779                                 new_triggers.patterns[i].mask + mask_len;
6780                         memcpy(new_triggers.patterns[i].mask,
6781                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
6782                                mask_len);
6783                         new_triggers.patterns[i].pattern_len = pat_len;
6784                         memcpy(new_triggers.patterns[i].pattern,
6785                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
6786                                pat_len);
6787                         i++;
6788                 }
6789         }
6790
6791         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
6792         if (!ntrig) {
6793                 err = -ENOMEM;
6794                 goto error;
6795         }
6796         cfg80211_rdev_free_wowlan(rdev);
6797         rdev->wowlan = ntrig;
6798
6799  set_wakeup:
6800         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
6801                 rdev_set_wakeup(rdev, rdev->wowlan);
6802
6803         return 0;
6804  error:
6805         for (i = 0; i < new_triggers.n_patterns; i++)
6806                 kfree(new_triggers.patterns[i].mask);
6807         kfree(new_triggers.patterns);
6808         return err;
6809 }
6810 #endif
6811
6812 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
6813 {
6814         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6815         struct net_device *dev = info->user_ptr[1];
6816         struct wireless_dev *wdev = dev->ieee80211_ptr;
6817         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
6818         struct cfg80211_gtk_rekey_data rekey_data;
6819         int err;
6820
6821         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
6822                 return -EINVAL;
6823
6824         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
6825                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
6826                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
6827                         nl80211_rekey_policy);
6828         if (err)
6829                 return err;
6830
6831         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
6832                 return -ERANGE;
6833         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
6834                 return -ERANGE;
6835         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
6836                 return -ERANGE;
6837
6838         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
6839                NL80211_KEK_LEN);
6840         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
6841                NL80211_KCK_LEN);
6842         memcpy(rekey_data.replay_ctr,
6843                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
6844                NL80211_REPLAY_CTR_LEN);
6845
6846         wdev_lock(wdev);
6847         if (!wdev->current_bss) {
6848                 err = -ENOTCONN;
6849                 goto out;
6850         }
6851
6852         if (!rdev->ops->set_rekey_data) {
6853                 err = -EOPNOTSUPP;
6854                 goto out;
6855         }
6856
6857         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
6858  out:
6859         wdev_unlock(wdev);
6860         return err;
6861 }
6862
6863 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
6864                                              struct genl_info *info)
6865 {
6866         struct net_device *dev = info->user_ptr[1];
6867         struct wireless_dev *wdev = dev->ieee80211_ptr;
6868
6869         if (wdev->iftype != NL80211_IFTYPE_AP &&
6870             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6871                 return -EINVAL;
6872
6873         if (wdev->ap_unexpected_nlportid)
6874                 return -EBUSY;
6875
6876         wdev->ap_unexpected_nlportid = info->snd_portid;
6877         return 0;
6878 }
6879
6880 static int nl80211_probe_client(struct sk_buff *skb,
6881                                 struct genl_info *info)
6882 {
6883         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6884         struct net_device *dev = info->user_ptr[1];
6885         struct wireless_dev *wdev = dev->ieee80211_ptr;
6886         struct sk_buff *msg;
6887         void *hdr;
6888         const u8 *addr;
6889         u64 cookie;
6890         int err;
6891
6892         if (wdev->iftype != NL80211_IFTYPE_AP &&
6893             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6894                 return -EOPNOTSUPP;
6895
6896         if (!info->attrs[NL80211_ATTR_MAC])
6897                 return -EINVAL;
6898
6899         if (!rdev->ops->probe_client)
6900                 return -EOPNOTSUPP;
6901
6902         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6903         if (!msg)
6904                 return -ENOMEM;
6905
6906         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6907                              NL80211_CMD_PROBE_CLIENT);
6908
6909         if (IS_ERR(hdr)) {
6910                 err = PTR_ERR(hdr);
6911                 goto free_msg;
6912         }
6913
6914         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6915
6916         err = rdev_probe_client(rdev, dev, addr, &cookie);
6917         if (err)
6918                 goto free_msg;
6919
6920         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6921                 goto nla_put_failure;
6922
6923         genlmsg_end(msg, hdr);
6924
6925         return genlmsg_reply(msg, info);
6926
6927  nla_put_failure:
6928         err = -ENOBUFS;
6929  free_msg:
6930         nlmsg_free(msg);
6931         return err;
6932 }
6933
6934 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
6935 {
6936         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6937         struct cfg80211_beacon_registration *reg, *nreg;
6938         int rv;
6939
6940         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
6941                 return -EOPNOTSUPP;
6942
6943         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
6944         if (!nreg)
6945                 return -ENOMEM;
6946
6947         /* First, check if already registered. */
6948         spin_lock_bh(&rdev->beacon_registrations_lock);
6949         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
6950                 if (reg->nlportid == info->snd_portid) {
6951                         rv = -EALREADY;
6952                         goto out_err;
6953                 }
6954         }
6955         /* Add it to the list */
6956         nreg->nlportid = info->snd_portid;
6957         list_add(&nreg->list, &rdev->beacon_registrations);
6958
6959         spin_unlock_bh(&rdev->beacon_registrations_lock);
6960
6961         return 0;
6962 out_err:
6963         spin_unlock_bh(&rdev->beacon_registrations_lock);
6964         kfree(nreg);
6965         return rv;
6966 }
6967
6968 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
6969 {
6970         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6971         struct wireless_dev *wdev = info->user_ptr[1];
6972         int err;
6973
6974         if (!rdev->ops->start_p2p_device)
6975                 return -EOPNOTSUPP;
6976
6977         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
6978                 return -EOPNOTSUPP;
6979
6980         if (wdev->p2p_started)
6981                 return 0;
6982
6983         mutex_lock(&rdev->devlist_mtx);
6984         err = cfg80211_can_add_interface(rdev, wdev->iftype);
6985         mutex_unlock(&rdev->devlist_mtx);
6986         if (err)
6987                 return err;
6988
6989         err = rdev_start_p2p_device(rdev, wdev);
6990         if (err)
6991                 return err;
6992
6993         wdev->p2p_started = true;
6994         mutex_lock(&rdev->devlist_mtx);
6995         rdev->opencount++;
6996         mutex_unlock(&rdev->devlist_mtx);
6997
6998         return 0;
6999 }
7000
7001 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
7002 {
7003         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7004         struct wireless_dev *wdev = info->user_ptr[1];
7005
7006         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
7007                 return -EOPNOTSUPP;
7008
7009         if (!rdev->ops->stop_p2p_device)
7010                 return -EOPNOTSUPP;
7011
7012         if (!wdev->p2p_started)
7013                 return 0;
7014
7015         rdev_stop_p2p_device(rdev, wdev);
7016         wdev->p2p_started = false;
7017
7018         mutex_lock(&rdev->devlist_mtx);
7019         rdev->opencount--;
7020         mutex_unlock(&rdev->devlist_mtx);
7021
7022         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
7023                 rdev->scan_req->aborted = true;
7024                 ___cfg80211_scan_done(rdev, true);
7025         }
7026
7027         return 0;
7028 }
7029
7030 #define NL80211_FLAG_NEED_WIPHY         0x01
7031 #define NL80211_FLAG_NEED_NETDEV        0x02
7032 #define NL80211_FLAG_NEED_RTNL          0x04
7033 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
7034 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
7035                                          NL80211_FLAG_CHECK_NETDEV_UP)
7036 #define NL80211_FLAG_NEED_WDEV          0x10
7037 /* If a netdev is associated, it must be UP, P2P must be started */
7038 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
7039                                          NL80211_FLAG_CHECK_NETDEV_UP)
7040
7041 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
7042                             struct genl_info *info)
7043 {
7044         struct cfg80211_registered_device *rdev;
7045         struct wireless_dev *wdev;
7046         struct net_device *dev;
7047         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
7048
7049         if (rtnl)
7050                 rtnl_lock();
7051
7052         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
7053                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7054                 if (IS_ERR(rdev)) {
7055                         if (rtnl)
7056                                 rtnl_unlock();
7057                         return PTR_ERR(rdev);
7058                 }
7059                 info->user_ptr[0] = rdev;
7060         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
7061                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7062                 mutex_lock(&cfg80211_mutex);
7063                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
7064                                                   info->attrs);
7065                 if (IS_ERR(wdev)) {
7066                         mutex_unlock(&cfg80211_mutex);
7067                         if (rtnl)
7068                                 rtnl_unlock();
7069                         return PTR_ERR(wdev);
7070                 }
7071
7072                 dev = wdev->netdev;
7073                 rdev = wiphy_to_dev(wdev->wiphy);
7074
7075                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
7076                         if (!dev) {
7077                                 mutex_unlock(&cfg80211_mutex);
7078                                 if (rtnl)
7079                                         rtnl_unlock();
7080                                 return -EINVAL;
7081                         }
7082
7083                         info->user_ptr[1] = dev;
7084                 } else {
7085                         info->user_ptr[1] = wdev;
7086                 }
7087
7088                 if (dev) {
7089                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
7090                             !netif_running(dev)) {
7091                                 mutex_unlock(&cfg80211_mutex);
7092                                 if (rtnl)
7093                                         rtnl_unlock();
7094                                 return -ENETDOWN;
7095                         }
7096
7097                         dev_hold(dev);
7098                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
7099                         if (!wdev->p2p_started) {
7100                                 mutex_unlock(&cfg80211_mutex);
7101                                 if (rtnl)
7102                                         rtnl_unlock();
7103                                 return -ENETDOWN;
7104                         }
7105                 }
7106
7107                 cfg80211_lock_rdev(rdev);
7108
7109                 mutex_unlock(&cfg80211_mutex);
7110
7111                 info->user_ptr[0] = rdev;
7112         }
7113
7114         return 0;
7115 }
7116
7117 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
7118                               struct genl_info *info)
7119 {
7120         if (info->user_ptr[0])
7121                 cfg80211_unlock_rdev(info->user_ptr[0]);
7122         if (info->user_ptr[1]) {
7123                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7124                         struct wireless_dev *wdev = info->user_ptr[1];
7125
7126                         if (wdev->netdev)
7127                                 dev_put(wdev->netdev);
7128                 } else {
7129                         dev_put(info->user_ptr[1]);
7130                 }
7131         }
7132         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
7133                 rtnl_unlock();
7134 }
7135
7136 static struct genl_ops nl80211_ops[] = {
7137         {
7138                 .cmd = NL80211_CMD_GET_WIPHY,
7139                 .doit = nl80211_get_wiphy,
7140                 .dumpit = nl80211_dump_wiphy,
7141                 .policy = nl80211_policy,
7142                 /* can be retrieved by unprivileged users */
7143                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
7144         },
7145         {
7146                 .cmd = NL80211_CMD_SET_WIPHY,
7147                 .doit = nl80211_set_wiphy,
7148                 .policy = nl80211_policy,
7149                 .flags = GENL_ADMIN_PERM,
7150                 .internal_flags = NL80211_FLAG_NEED_RTNL,
7151         },
7152         {
7153                 .cmd = NL80211_CMD_GET_INTERFACE,
7154                 .doit = nl80211_get_interface,
7155                 .dumpit = nl80211_dump_interface,
7156                 .policy = nl80211_policy,
7157                 /* can be retrieved by unprivileged users */
7158                 .internal_flags = NL80211_FLAG_NEED_WDEV,
7159         },
7160         {
7161                 .cmd = NL80211_CMD_SET_INTERFACE,
7162                 .doit = nl80211_set_interface,
7163                 .policy = nl80211_policy,
7164                 .flags = GENL_ADMIN_PERM,
7165                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7166                                   NL80211_FLAG_NEED_RTNL,
7167         },
7168         {
7169                 .cmd = NL80211_CMD_NEW_INTERFACE,
7170                 .doit = nl80211_new_interface,
7171                 .policy = nl80211_policy,
7172                 .flags = GENL_ADMIN_PERM,
7173                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7174                                   NL80211_FLAG_NEED_RTNL,
7175         },
7176         {
7177                 .cmd = NL80211_CMD_DEL_INTERFACE,
7178                 .doit = nl80211_del_interface,
7179                 .policy = nl80211_policy,
7180                 .flags = GENL_ADMIN_PERM,
7181                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7182                                   NL80211_FLAG_NEED_RTNL,
7183         },
7184         {
7185                 .cmd = NL80211_CMD_GET_KEY,
7186                 .doit = nl80211_get_key,
7187                 .policy = nl80211_policy,
7188                 .flags = GENL_ADMIN_PERM,
7189                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7190                                   NL80211_FLAG_NEED_RTNL,
7191         },
7192         {
7193                 .cmd = NL80211_CMD_SET_KEY,
7194                 .doit = nl80211_set_key,
7195                 .policy = nl80211_policy,
7196                 .flags = GENL_ADMIN_PERM,
7197                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7198                                   NL80211_FLAG_NEED_RTNL,
7199         },
7200         {
7201                 .cmd = NL80211_CMD_NEW_KEY,
7202                 .doit = nl80211_new_key,
7203                 .policy = nl80211_policy,
7204                 .flags = GENL_ADMIN_PERM,
7205                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7206                                   NL80211_FLAG_NEED_RTNL,
7207         },
7208         {
7209                 .cmd = NL80211_CMD_DEL_KEY,
7210                 .doit = nl80211_del_key,
7211                 .policy = nl80211_policy,
7212                 .flags = GENL_ADMIN_PERM,
7213                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7214                                   NL80211_FLAG_NEED_RTNL,
7215         },
7216         {
7217                 .cmd = NL80211_CMD_SET_BEACON,
7218                 .policy = nl80211_policy,
7219                 .flags = GENL_ADMIN_PERM,
7220                 .doit = nl80211_set_beacon,
7221                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7222                                   NL80211_FLAG_NEED_RTNL,
7223         },
7224         {
7225                 .cmd = NL80211_CMD_START_AP,
7226                 .policy = nl80211_policy,
7227                 .flags = GENL_ADMIN_PERM,
7228                 .doit = nl80211_start_ap,
7229                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7230                                   NL80211_FLAG_NEED_RTNL,
7231         },
7232         {
7233                 .cmd = NL80211_CMD_STOP_AP,
7234                 .policy = nl80211_policy,
7235                 .flags = GENL_ADMIN_PERM,
7236                 .doit = nl80211_stop_ap,
7237                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7238                                   NL80211_FLAG_NEED_RTNL,
7239         },
7240         {
7241                 .cmd = NL80211_CMD_GET_STATION,
7242                 .doit = nl80211_get_station,
7243                 .dumpit = nl80211_dump_station,
7244                 .policy = nl80211_policy,
7245                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7246                                   NL80211_FLAG_NEED_RTNL,
7247         },
7248         {
7249                 .cmd = NL80211_CMD_SET_STATION,
7250                 .doit = nl80211_set_station,
7251                 .policy = nl80211_policy,
7252                 .flags = GENL_ADMIN_PERM,
7253                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7254                                   NL80211_FLAG_NEED_RTNL,
7255         },
7256         {
7257                 .cmd = NL80211_CMD_NEW_STATION,
7258                 .doit = nl80211_new_station,
7259                 .policy = nl80211_policy,
7260                 .flags = GENL_ADMIN_PERM,
7261                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7262                                   NL80211_FLAG_NEED_RTNL,
7263         },
7264         {
7265                 .cmd = NL80211_CMD_DEL_STATION,
7266                 .doit = nl80211_del_station,
7267                 .policy = nl80211_policy,
7268                 .flags = GENL_ADMIN_PERM,
7269                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7270                                   NL80211_FLAG_NEED_RTNL,
7271         },
7272         {
7273                 .cmd = NL80211_CMD_GET_MPATH,
7274                 .doit = nl80211_get_mpath,
7275                 .dumpit = nl80211_dump_mpath,
7276                 .policy = nl80211_policy,
7277                 .flags = GENL_ADMIN_PERM,
7278                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7279                                   NL80211_FLAG_NEED_RTNL,
7280         },
7281         {
7282                 .cmd = NL80211_CMD_SET_MPATH,
7283                 .doit = nl80211_set_mpath,
7284                 .policy = nl80211_policy,
7285                 .flags = GENL_ADMIN_PERM,
7286                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7287                                   NL80211_FLAG_NEED_RTNL,
7288         },
7289         {
7290                 .cmd = NL80211_CMD_NEW_MPATH,
7291                 .doit = nl80211_new_mpath,
7292                 .policy = nl80211_policy,
7293                 .flags = GENL_ADMIN_PERM,
7294                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7295                                   NL80211_FLAG_NEED_RTNL,
7296         },
7297         {
7298                 .cmd = NL80211_CMD_DEL_MPATH,
7299                 .doit = nl80211_del_mpath,
7300                 .policy = nl80211_policy,
7301                 .flags = GENL_ADMIN_PERM,
7302                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7303                                   NL80211_FLAG_NEED_RTNL,
7304         },
7305         {
7306                 .cmd = NL80211_CMD_SET_BSS,
7307                 .doit = nl80211_set_bss,
7308                 .policy = nl80211_policy,
7309                 .flags = GENL_ADMIN_PERM,
7310                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7311                                   NL80211_FLAG_NEED_RTNL,
7312         },
7313         {
7314                 .cmd = NL80211_CMD_GET_REG,
7315                 .doit = nl80211_get_reg,
7316                 .policy = nl80211_policy,
7317                 /* can be retrieved by unprivileged users */
7318         },
7319         {
7320                 .cmd = NL80211_CMD_SET_REG,
7321                 .doit = nl80211_set_reg,
7322                 .policy = nl80211_policy,
7323                 .flags = GENL_ADMIN_PERM,
7324         },
7325         {
7326                 .cmd = NL80211_CMD_REQ_SET_REG,
7327                 .doit = nl80211_req_set_reg,
7328                 .policy = nl80211_policy,
7329                 .flags = GENL_ADMIN_PERM,
7330         },
7331         {
7332                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
7333                 .doit = nl80211_get_mesh_config,
7334                 .policy = nl80211_policy,
7335                 /* can be retrieved by unprivileged users */
7336                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7337                                   NL80211_FLAG_NEED_RTNL,
7338         },
7339         {
7340                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
7341                 .doit = nl80211_update_mesh_config,
7342                 .policy = nl80211_policy,
7343                 .flags = GENL_ADMIN_PERM,
7344                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7345                                   NL80211_FLAG_NEED_RTNL,
7346         },
7347         {
7348                 .cmd = NL80211_CMD_TRIGGER_SCAN,
7349                 .doit = nl80211_trigger_scan,
7350                 .policy = nl80211_policy,
7351                 .flags = GENL_ADMIN_PERM,
7352                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7353                                   NL80211_FLAG_NEED_RTNL,
7354         },
7355         {
7356                 .cmd = NL80211_CMD_GET_SCAN,
7357                 .policy = nl80211_policy,
7358                 .dumpit = nl80211_dump_scan,
7359         },
7360         {
7361                 .cmd = NL80211_CMD_START_SCHED_SCAN,
7362                 .doit = nl80211_start_sched_scan,
7363                 .policy = nl80211_policy,
7364                 .flags = GENL_ADMIN_PERM,
7365                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7366                                   NL80211_FLAG_NEED_RTNL,
7367         },
7368         {
7369                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
7370                 .doit = nl80211_stop_sched_scan,
7371                 .policy = nl80211_policy,
7372                 .flags = GENL_ADMIN_PERM,
7373                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7374                                   NL80211_FLAG_NEED_RTNL,
7375         },
7376         {
7377                 .cmd = NL80211_CMD_AUTHENTICATE,
7378                 .doit = nl80211_authenticate,
7379                 .policy = nl80211_policy,
7380                 .flags = GENL_ADMIN_PERM,
7381                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7382                                   NL80211_FLAG_NEED_RTNL,
7383         },
7384         {
7385                 .cmd = NL80211_CMD_ASSOCIATE,
7386                 .doit = nl80211_associate,
7387                 .policy = nl80211_policy,
7388                 .flags = GENL_ADMIN_PERM,
7389                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7390                                   NL80211_FLAG_NEED_RTNL,
7391         },
7392         {
7393                 .cmd = NL80211_CMD_DEAUTHENTICATE,
7394                 .doit = nl80211_deauthenticate,
7395                 .policy = nl80211_policy,
7396                 .flags = GENL_ADMIN_PERM,
7397                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7398                                   NL80211_FLAG_NEED_RTNL,
7399         },
7400         {
7401                 .cmd = NL80211_CMD_DISASSOCIATE,
7402                 .doit = nl80211_disassociate,
7403                 .policy = nl80211_policy,
7404                 .flags = GENL_ADMIN_PERM,
7405                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7406                                   NL80211_FLAG_NEED_RTNL,
7407         },
7408         {
7409                 .cmd = NL80211_CMD_JOIN_IBSS,
7410                 .doit = nl80211_join_ibss,
7411                 .policy = nl80211_policy,
7412                 .flags = GENL_ADMIN_PERM,
7413                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7414                                   NL80211_FLAG_NEED_RTNL,
7415         },
7416         {
7417                 .cmd = NL80211_CMD_LEAVE_IBSS,
7418                 .doit = nl80211_leave_ibss,
7419                 .policy = nl80211_policy,
7420                 .flags = GENL_ADMIN_PERM,
7421                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7422                                   NL80211_FLAG_NEED_RTNL,
7423         },
7424 #ifdef CONFIG_NL80211_TESTMODE
7425         {
7426                 .cmd = NL80211_CMD_TESTMODE,
7427                 .doit = nl80211_testmode_do,
7428                 .dumpit = nl80211_testmode_dump,
7429                 .policy = nl80211_policy,
7430                 .flags = GENL_ADMIN_PERM,
7431                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7432                                   NL80211_FLAG_NEED_RTNL,
7433         },
7434 #endif
7435         {
7436                 .cmd = NL80211_CMD_CONNECT,
7437                 .doit = nl80211_connect,
7438                 .policy = nl80211_policy,
7439                 .flags = GENL_ADMIN_PERM,
7440                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7441                                   NL80211_FLAG_NEED_RTNL,
7442         },
7443         {
7444                 .cmd = NL80211_CMD_DISCONNECT,
7445                 .doit = nl80211_disconnect,
7446                 .policy = nl80211_policy,
7447                 .flags = GENL_ADMIN_PERM,
7448                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7449                                   NL80211_FLAG_NEED_RTNL,
7450         },
7451         {
7452                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
7453                 .doit = nl80211_wiphy_netns,
7454                 .policy = nl80211_policy,
7455                 .flags = GENL_ADMIN_PERM,
7456                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7457                                   NL80211_FLAG_NEED_RTNL,
7458         },
7459         {
7460                 .cmd = NL80211_CMD_GET_SURVEY,
7461                 .policy = nl80211_policy,
7462                 .dumpit = nl80211_dump_survey,
7463         },
7464         {
7465                 .cmd = NL80211_CMD_SET_PMKSA,
7466                 .doit = nl80211_setdel_pmksa,
7467                 .policy = nl80211_policy,
7468                 .flags = GENL_ADMIN_PERM,
7469                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7470                                   NL80211_FLAG_NEED_RTNL,
7471         },
7472         {
7473                 .cmd = NL80211_CMD_DEL_PMKSA,
7474                 .doit = nl80211_setdel_pmksa,
7475                 .policy = nl80211_policy,
7476                 .flags = GENL_ADMIN_PERM,
7477                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7478                                   NL80211_FLAG_NEED_RTNL,
7479         },
7480         {
7481                 .cmd = NL80211_CMD_FLUSH_PMKSA,
7482                 .doit = nl80211_flush_pmksa,
7483                 .policy = nl80211_policy,
7484                 .flags = GENL_ADMIN_PERM,
7485                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7486                                   NL80211_FLAG_NEED_RTNL,
7487         },
7488         {
7489                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
7490                 .doit = nl80211_remain_on_channel,
7491                 .policy = nl80211_policy,
7492                 .flags = GENL_ADMIN_PERM,
7493                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7494                                   NL80211_FLAG_NEED_RTNL,
7495         },
7496         {
7497                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
7498                 .doit = nl80211_cancel_remain_on_channel,
7499                 .policy = nl80211_policy,
7500                 .flags = GENL_ADMIN_PERM,
7501                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7502                                   NL80211_FLAG_NEED_RTNL,
7503         },
7504         {
7505                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
7506                 .doit = nl80211_set_tx_bitrate_mask,
7507                 .policy = nl80211_policy,
7508                 .flags = GENL_ADMIN_PERM,
7509                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7510                                   NL80211_FLAG_NEED_RTNL,
7511         },
7512         {
7513                 .cmd = NL80211_CMD_REGISTER_FRAME,
7514                 .doit = nl80211_register_mgmt,
7515                 .policy = nl80211_policy,
7516                 .flags = GENL_ADMIN_PERM,
7517                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7518                                   NL80211_FLAG_NEED_RTNL,
7519         },
7520         {
7521                 .cmd = NL80211_CMD_FRAME,
7522                 .doit = nl80211_tx_mgmt,
7523                 .policy = nl80211_policy,
7524                 .flags = GENL_ADMIN_PERM,
7525                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7526                                   NL80211_FLAG_NEED_RTNL,
7527         },
7528         {
7529                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
7530                 .doit = nl80211_tx_mgmt_cancel_wait,
7531                 .policy = nl80211_policy,
7532                 .flags = GENL_ADMIN_PERM,
7533                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7534                                   NL80211_FLAG_NEED_RTNL,
7535         },
7536         {
7537                 .cmd = NL80211_CMD_SET_POWER_SAVE,
7538                 .doit = nl80211_set_power_save,
7539                 .policy = nl80211_policy,
7540                 .flags = GENL_ADMIN_PERM,
7541                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7542                                   NL80211_FLAG_NEED_RTNL,
7543         },
7544         {
7545                 .cmd = NL80211_CMD_GET_POWER_SAVE,
7546                 .doit = nl80211_get_power_save,
7547                 .policy = nl80211_policy,
7548                 /* can be retrieved by unprivileged users */
7549                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7550                                   NL80211_FLAG_NEED_RTNL,
7551         },
7552         {
7553                 .cmd = NL80211_CMD_SET_CQM,
7554                 .doit = nl80211_set_cqm,
7555                 .policy = nl80211_policy,
7556                 .flags = GENL_ADMIN_PERM,
7557                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7558                                   NL80211_FLAG_NEED_RTNL,
7559         },
7560         {
7561                 .cmd = NL80211_CMD_SET_CHANNEL,
7562                 .doit = nl80211_set_channel,
7563                 .policy = nl80211_policy,
7564                 .flags = GENL_ADMIN_PERM,
7565                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7566                                   NL80211_FLAG_NEED_RTNL,
7567         },
7568         {
7569                 .cmd = NL80211_CMD_SET_WDS_PEER,
7570                 .doit = nl80211_set_wds_peer,
7571                 .policy = nl80211_policy,
7572                 .flags = GENL_ADMIN_PERM,
7573                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7574                                   NL80211_FLAG_NEED_RTNL,
7575         },
7576         {
7577                 .cmd = NL80211_CMD_JOIN_MESH,
7578                 .doit = nl80211_join_mesh,
7579                 .policy = nl80211_policy,
7580                 .flags = GENL_ADMIN_PERM,
7581                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7582                                   NL80211_FLAG_NEED_RTNL,
7583         },
7584         {
7585                 .cmd = NL80211_CMD_LEAVE_MESH,
7586                 .doit = nl80211_leave_mesh,
7587                 .policy = nl80211_policy,
7588                 .flags = GENL_ADMIN_PERM,
7589                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7590                                   NL80211_FLAG_NEED_RTNL,
7591         },
7592 #ifdef CONFIG_PM
7593         {
7594                 .cmd = NL80211_CMD_GET_WOWLAN,
7595                 .doit = nl80211_get_wowlan,
7596                 .policy = nl80211_policy,
7597                 /* can be retrieved by unprivileged users */
7598                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7599                                   NL80211_FLAG_NEED_RTNL,
7600         },
7601         {
7602                 .cmd = NL80211_CMD_SET_WOWLAN,
7603                 .doit = nl80211_set_wowlan,
7604                 .policy = nl80211_policy,
7605                 .flags = GENL_ADMIN_PERM,
7606                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7607                                   NL80211_FLAG_NEED_RTNL,
7608         },
7609 #endif
7610         {
7611                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
7612                 .doit = nl80211_set_rekey_data,
7613                 .policy = nl80211_policy,
7614                 .flags = GENL_ADMIN_PERM,
7615                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7616                                   NL80211_FLAG_NEED_RTNL,
7617         },
7618         {
7619                 .cmd = NL80211_CMD_TDLS_MGMT,
7620                 .doit = nl80211_tdls_mgmt,
7621                 .policy = nl80211_policy,
7622                 .flags = GENL_ADMIN_PERM,
7623                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7624                                   NL80211_FLAG_NEED_RTNL,
7625         },
7626         {
7627                 .cmd = NL80211_CMD_TDLS_OPER,
7628                 .doit = nl80211_tdls_oper,
7629                 .policy = nl80211_policy,
7630                 .flags = GENL_ADMIN_PERM,
7631                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7632                                   NL80211_FLAG_NEED_RTNL,
7633         },
7634         {
7635                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
7636                 .doit = nl80211_register_unexpected_frame,
7637                 .policy = nl80211_policy,
7638                 .flags = GENL_ADMIN_PERM,
7639                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7640                                   NL80211_FLAG_NEED_RTNL,
7641         },
7642         {
7643                 .cmd = NL80211_CMD_PROBE_CLIENT,
7644                 .doit = nl80211_probe_client,
7645                 .policy = nl80211_policy,
7646                 .flags = GENL_ADMIN_PERM,
7647                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7648                                   NL80211_FLAG_NEED_RTNL,
7649         },
7650         {
7651                 .cmd = NL80211_CMD_REGISTER_BEACONS,
7652                 .doit = nl80211_register_beacons,
7653                 .policy = nl80211_policy,
7654                 .flags = GENL_ADMIN_PERM,
7655                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7656                                   NL80211_FLAG_NEED_RTNL,
7657         },
7658         {
7659                 .cmd = NL80211_CMD_SET_NOACK_MAP,
7660                 .doit = nl80211_set_noack_map,
7661                 .policy = nl80211_policy,
7662                 .flags = GENL_ADMIN_PERM,
7663                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7664                                   NL80211_FLAG_NEED_RTNL,
7665         },
7666         {
7667                 .cmd = NL80211_CMD_START_P2P_DEVICE,
7668                 .doit = nl80211_start_p2p_device,
7669                 .policy = nl80211_policy,
7670                 .flags = GENL_ADMIN_PERM,
7671                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7672                                   NL80211_FLAG_NEED_RTNL,
7673         },
7674         {
7675                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
7676                 .doit = nl80211_stop_p2p_device,
7677                 .policy = nl80211_policy,
7678                 .flags = GENL_ADMIN_PERM,
7679                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7680                                   NL80211_FLAG_NEED_RTNL,
7681         },
7682         {
7683                 .cmd = NL80211_CMD_SET_MCAST_RATE,
7684                 .doit = nl80211_set_mcast_rate,
7685                 .policy = nl80211_policy,
7686                 .flags = GENL_ADMIN_PERM,
7687                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7688                                   NL80211_FLAG_NEED_RTNL,
7689         },
7690 };
7691
7692 static struct genl_multicast_group nl80211_mlme_mcgrp = {
7693         .name = "mlme",
7694 };
7695
7696 /* multicast groups */
7697 static struct genl_multicast_group nl80211_config_mcgrp = {
7698         .name = "config",
7699 };
7700 static struct genl_multicast_group nl80211_scan_mcgrp = {
7701         .name = "scan",
7702 };
7703 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
7704         .name = "regulatory",
7705 };
7706
7707 /* notification functions */
7708
7709 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
7710 {
7711         struct sk_buff *msg;
7712
7713         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7714         if (!msg)
7715                 return;
7716
7717         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
7718                 nlmsg_free(msg);
7719                 return;
7720         }
7721
7722         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7723                                 nl80211_config_mcgrp.id, GFP_KERNEL);
7724 }
7725
7726 static int nl80211_add_scan_req(struct sk_buff *msg,
7727                                 struct cfg80211_registered_device *rdev)
7728 {
7729         struct cfg80211_scan_request *req = rdev->scan_req;
7730         struct nlattr *nest;
7731         int i;
7732
7733         ASSERT_RDEV_LOCK(rdev);
7734
7735         if (WARN_ON(!req))
7736                 return 0;
7737
7738         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
7739         if (!nest)
7740                 goto nla_put_failure;
7741         for (i = 0; i < req->n_ssids; i++) {
7742                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
7743                         goto nla_put_failure;
7744         }
7745         nla_nest_end(msg, nest);
7746
7747         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
7748         if (!nest)
7749                 goto nla_put_failure;
7750         for (i = 0; i < req->n_channels; i++) {
7751                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
7752                         goto nla_put_failure;
7753         }
7754         nla_nest_end(msg, nest);
7755
7756         if (req->ie &&
7757             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
7758                 goto nla_put_failure;
7759
7760         if (req->flags)
7761                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
7762
7763         return 0;
7764  nla_put_failure:
7765         return -ENOBUFS;
7766 }
7767
7768 static int nl80211_send_scan_msg(struct sk_buff *msg,
7769                                  struct cfg80211_registered_device *rdev,
7770                                  struct wireless_dev *wdev,
7771                                  u32 portid, u32 seq, int flags,
7772                                  u32 cmd)
7773 {
7774         void *hdr;
7775
7776         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7777         if (!hdr)
7778                 return -1;
7779
7780         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7781             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
7782                                          wdev->netdev->ifindex)) ||
7783             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
7784                 goto nla_put_failure;
7785
7786         /* ignore errors and send incomplete event anyway */
7787         nl80211_add_scan_req(msg, rdev);
7788
7789         return genlmsg_end(msg, hdr);
7790
7791  nla_put_failure:
7792         genlmsg_cancel(msg, hdr);
7793         return -EMSGSIZE;
7794 }
7795
7796 static int
7797 nl80211_send_sched_scan_msg(struct sk_buff *msg,
7798                             struct cfg80211_registered_device *rdev,
7799                             struct net_device *netdev,
7800                             u32 portid, u32 seq, int flags, u32 cmd)
7801 {
7802         void *hdr;
7803
7804         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7805         if (!hdr)
7806                 return -1;
7807
7808         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7809             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
7810                 goto nla_put_failure;
7811
7812         return genlmsg_end(msg, hdr);
7813
7814  nla_put_failure:
7815         genlmsg_cancel(msg, hdr);
7816         return -EMSGSIZE;
7817 }
7818
7819 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
7820                              struct wireless_dev *wdev)
7821 {
7822         struct sk_buff *msg;
7823
7824         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7825         if (!msg)
7826                 return;
7827
7828         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7829                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
7830                 nlmsg_free(msg);
7831                 return;
7832         }
7833
7834         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7835                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7836 }
7837
7838 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
7839                             struct wireless_dev *wdev)
7840 {
7841         struct sk_buff *msg;
7842
7843         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7844         if (!msg)
7845                 return;
7846
7847         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7848                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
7849                 nlmsg_free(msg);
7850                 return;
7851         }
7852
7853         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7854                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7855 }
7856
7857 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
7858                                struct wireless_dev *wdev)
7859 {
7860         struct sk_buff *msg;
7861
7862         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7863         if (!msg)
7864                 return;
7865
7866         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7867                                   NL80211_CMD_SCAN_ABORTED) < 0) {
7868                 nlmsg_free(msg);
7869                 return;
7870         }
7871
7872         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7873                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7874 }
7875
7876 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
7877                                      struct net_device *netdev)
7878 {
7879         struct sk_buff *msg;
7880
7881         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7882         if (!msg)
7883                 return;
7884
7885         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
7886                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
7887                 nlmsg_free(msg);
7888                 return;
7889         }
7890
7891         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7892                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7893 }
7894
7895 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
7896                              struct net_device *netdev, u32 cmd)
7897 {
7898         struct sk_buff *msg;
7899
7900         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7901         if (!msg)
7902                 return;
7903
7904         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
7905                 nlmsg_free(msg);
7906                 return;
7907         }
7908
7909         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7910                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7911 }
7912
7913 /*
7914  * This can happen on global regulatory changes or device specific settings
7915  * based on custom world regulatory domains.
7916  */
7917 void nl80211_send_reg_change_event(struct regulatory_request *request)
7918 {
7919         struct sk_buff *msg;
7920         void *hdr;
7921
7922         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7923         if (!msg)
7924                 return;
7925
7926         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
7927         if (!hdr) {
7928                 nlmsg_free(msg);
7929                 return;
7930         }
7931
7932         /* Userspace can always count this one always being set */
7933         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
7934                 goto nla_put_failure;
7935
7936         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
7937                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7938                                NL80211_REGDOM_TYPE_WORLD))
7939                         goto nla_put_failure;
7940         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
7941                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7942                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
7943                         goto nla_put_failure;
7944         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
7945                    request->intersect) {
7946                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7947                                NL80211_REGDOM_TYPE_INTERSECTION))
7948                         goto nla_put_failure;
7949         } else {
7950                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7951                                NL80211_REGDOM_TYPE_COUNTRY) ||
7952                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
7953                                    request->alpha2))
7954                         goto nla_put_failure;
7955         }
7956
7957         if (wiphy_idx_valid(request->wiphy_idx) &&
7958             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
7959                 goto nla_put_failure;
7960
7961         genlmsg_end(msg, hdr);
7962
7963         rcu_read_lock();
7964         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
7965                                 GFP_ATOMIC);
7966         rcu_read_unlock();
7967
7968         return;
7969
7970 nla_put_failure:
7971         genlmsg_cancel(msg, hdr);
7972         nlmsg_free(msg);
7973 }
7974
7975 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
7976                                     struct net_device *netdev,
7977                                     const u8 *buf, size_t len,
7978                                     enum nl80211_commands cmd, gfp_t gfp)
7979 {
7980         struct sk_buff *msg;
7981         void *hdr;
7982
7983         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7984         if (!msg)
7985                 return;
7986
7987         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7988         if (!hdr) {
7989                 nlmsg_free(msg);
7990                 return;
7991         }
7992
7993         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7994             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7995             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
7996                 goto nla_put_failure;
7997
7998         genlmsg_end(msg, hdr);
7999
8000         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8001                                 nl80211_mlme_mcgrp.id, gfp);
8002         return;
8003
8004  nla_put_failure:
8005         genlmsg_cancel(msg, hdr);
8006         nlmsg_free(msg);
8007 }
8008
8009 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
8010                           struct net_device *netdev, const u8 *buf,
8011                           size_t len, gfp_t gfp)
8012 {
8013         nl80211_send_mlme_event(rdev, netdev, buf, len,
8014                                 NL80211_CMD_AUTHENTICATE, gfp);
8015 }
8016
8017 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
8018                            struct net_device *netdev, const u8 *buf,
8019                            size_t len, gfp_t gfp)
8020 {
8021         nl80211_send_mlme_event(rdev, netdev, buf, len,
8022                                 NL80211_CMD_ASSOCIATE, gfp);
8023 }
8024
8025 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
8026                          struct net_device *netdev, const u8 *buf,
8027                          size_t len, gfp_t gfp)
8028 {
8029         nl80211_send_mlme_event(rdev, netdev, buf, len,
8030                                 NL80211_CMD_DEAUTHENTICATE, gfp);
8031 }
8032
8033 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
8034                            struct net_device *netdev, const u8 *buf,
8035                            size_t len, gfp_t gfp)
8036 {
8037         nl80211_send_mlme_event(rdev, netdev, buf, len,
8038                                 NL80211_CMD_DISASSOCIATE, gfp);
8039 }
8040
8041 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
8042                                 struct net_device *netdev, const u8 *buf,
8043                                 size_t len, gfp_t gfp)
8044 {
8045         nl80211_send_mlme_event(rdev, netdev, buf, len,
8046                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
8047 }
8048
8049 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
8050                                   struct net_device *netdev, const u8 *buf,
8051                                   size_t len, gfp_t gfp)
8052 {
8053         nl80211_send_mlme_event(rdev, netdev, buf, len,
8054                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
8055 }
8056
8057 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
8058                                       struct net_device *netdev, int cmd,
8059                                       const u8 *addr, gfp_t gfp)
8060 {
8061         struct sk_buff *msg;
8062         void *hdr;
8063
8064         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8065         if (!msg)
8066                 return;
8067
8068         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8069         if (!hdr) {
8070                 nlmsg_free(msg);
8071                 return;
8072         }
8073
8074         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8075             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8076             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
8077             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8078                 goto nla_put_failure;
8079
8080         genlmsg_end(msg, hdr);
8081
8082         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8083                                 nl80211_mlme_mcgrp.id, gfp);
8084         return;
8085
8086  nla_put_failure:
8087         genlmsg_cancel(msg, hdr);
8088         nlmsg_free(msg);
8089 }
8090
8091 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
8092                                struct net_device *netdev, const u8 *addr,
8093                                gfp_t gfp)
8094 {
8095         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
8096                                   addr, gfp);
8097 }
8098
8099 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
8100                                 struct net_device *netdev, const u8 *addr,
8101                                 gfp_t gfp)
8102 {
8103         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
8104                                   addr, gfp);
8105 }
8106
8107 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
8108                                  struct net_device *netdev, const u8 *bssid,
8109                                  const u8 *req_ie, size_t req_ie_len,
8110                                  const u8 *resp_ie, size_t resp_ie_len,
8111                                  u16 status, gfp_t gfp)
8112 {
8113         struct sk_buff *msg;
8114         void *hdr;
8115
8116         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8117         if (!msg)
8118                 return;
8119
8120         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
8121         if (!hdr) {
8122                 nlmsg_free(msg);
8123                 return;
8124         }
8125
8126         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8127             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8128             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
8129             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
8130             (req_ie &&
8131              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8132             (resp_ie &&
8133              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8134                 goto nla_put_failure;
8135
8136         genlmsg_end(msg, hdr);
8137
8138         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8139                                 nl80211_mlme_mcgrp.id, gfp);
8140         return;
8141
8142  nla_put_failure:
8143         genlmsg_cancel(msg, hdr);
8144         nlmsg_free(msg);
8145
8146 }
8147
8148 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
8149                          struct net_device *netdev, const u8 *bssid,
8150                          const u8 *req_ie, size_t req_ie_len,
8151                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
8152 {
8153         struct sk_buff *msg;
8154         void *hdr;
8155
8156         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8157         if (!msg)
8158                 return;
8159
8160         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
8161         if (!hdr) {
8162                 nlmsg_free(msg);
8163                 return;
8164         }
8165
8166         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8167             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8168             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
8169             (req_ie &&
8170              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8171             (resp_ie &&
8172              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8173                 goto nla_put_failure;
8174
8175         genlmsg_end(msg, hdr);
8176
8177         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8178                                 nl80211_mlme_mcgrp.id, gfp);
8179         return;
8180
8181  nla_put_failure:
8182         genlmsg_cancel(msg, hdr);
8183         nlmsg_free(msg);
8184
8185 }
8186
8187 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
8188                                struct net_device *netdev, u16 reason,
8189                                const u8 *ie, size_t ie_len, bool from_ap)
8190 {
8191         struct sk_buff *msg;
8192         void *hdr;
8193
8194         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8195         if (!msg)
8196                 return;
8197
8198         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
8199         if (!hdr) {
8200                 nlmsg_free(msg);
8201                 return;
8202         }
8203
8204         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8205             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8206             (from_ap && reason &&
8207              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
8208             (from_ap &&
8209              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
8210             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
8211                 goto nla_put_failure;
8212
8213         genlmsg_end(msg, hdr);
8214
8215         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8216                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
8217         return;
8218
8219  nla_put_failure:
8220         genlmsg_cancel(msg, hdr);
8221         nlmsg_free(msg);
8222
8223 }
8224
8225 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
8226                              struct net_device *netdev, const u8 *bssid,
8227                              gfp_t gfp)
8228 {
8229         struct sk_buff *msg;
8230         void *hdr;
8231
8232         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8233         if (!msg)
8234                 return;
8235
8236         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
8237         if (!hdr) {
8238                 nlmsg_free(msg);
8239                 return;
8240         }
8241
8242         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8243             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8244             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8245                 goto nla_put_failure;
8246
8247         genlmsg_end(msg, hdr);
8248
8249         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8250                                 nl80211_mlme_mcgrp.id, gfp);
8251         return;
8252
8253  nla_put_failure:
8254         genlmsg_cancel(msg, hdr);
8255         nlmsg_free(msg);
8256 }
8257
8258 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
8259                 struct net_device *netdev,
8260                 const u8 *macaddr, const u8* ie, u8 ie_len,
8261                 gfp_t gfp)
8262 {
8263         struct sk_buff *msg;
8264         void *hdr;
8265
8266         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8267         if (!msg)
8268                 return;
8269
8270         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
8271         if (!hdr) {
8272                 nlmsg_free(msg);
8273                 return;
8274         }
8275
8276         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8277             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8278             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
8279             (ie_len && ie &&
8280              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
8281                 goto nla_put_failure;
8282
8283         genlmsg_end(msg, hdr);
8284
8285         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8286                                 nl80211_mlme_mcgrp.id, gfp);
8287         return;
8288
8289  nla_put_failure:
8290         genlmsg_cancel(msg, hdr);
8291         nlmsg_free(msg);
8292 }
8293
8294 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
8295                                  struct net_device *netdev, const u8 *addr,
8296                                  enum nl80211_key_type key_type, int key_id,
8297                                  const u8 *tsc, gfp_t gfp)
8298 {
8299         struct sk_buff *msg;
8300         void *hdr;
8301
8302         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8303         if (!msg)
8304                 return;
8305
8306         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
8307         if (!hdr) {
8308                 nlmsg_free(msg);
8309                 return;
8310         }
8311
8312         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8313             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8314             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
8315             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
8316             (key_id != -1 &&
8317              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
8318             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
8319                 goto nla_put_failure;
8320
8321         genlmsg_end(msg, hdr);
8322
8323         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8324                                 nl80211_mlme_mcgrp.id, gfp);
8325         return;
8326
8327  nla_put_failure:
8328         genlmsg_cancel(msg, hdr);
8329         nlmsg_free(msg);
8330 }
8331
8332 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
8333                                     struct ieee80211_channel *channel_before,
8334                                     struct ieee80211_channel *channel_after)
8335 {
8336         struct sk_buff *msg;
8337         void *hdr;
8338         struct nlattr *nl_freq;
8339
8340         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
8341         if (!msg)
8342                 return;
8343
8344         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
8345         if (!hdr) {
8346                 nlmsg_free(msg);
8347                 return;
8348         }
8349
8350         /*
8351          * Since we are applying the beacon hint to a wiphy we know its
8352          * wiphy_idx is valid
8353          */
8354         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8355                 goto nla_put_failure;
8356
8357         /* Before */
8358         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
8359         if (!nl_freq)
8360                 goto nla_put_failure;
8361         if (nl80211_msg_put_channel(msg, channel_before))
8362                 goto nla_put_failure;
8363         nla_nest_end(msg, nl_freq);
8364
8365         /* After */
8366         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
8367         if (!nl_freq)
8368                 goto nla_put_failure;
8369         if (nl80211_msg_put_channel(msg, channel_after))
8370                 goto nla_put_failure;
8371         nla_nest_end(msg, nl_freq);
8372
8373         genlmsg_end(msg, hdr);
8374
8375         rcu_read_lock();
8376         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
8377                                 GFP_ATOMIC);
8378         rcu_read_unlock();
8379
8380         return;
8381
8382 nla_put_failure:
8383         genlmsg_cancel(msg, hdr);
8384         nlmsg_free(msg);
8385 }
8386
8387 static void nl80211_send_remain_on_chan_event(
8388         int cmd, struct cfg80211_registered_device *rdev,
8389         struct wireless_dev *wdev, u64 cookie,
8390         struct ieee80211_channel *chan,
8391         unsigned int duration, gfp_t gfp)
8392 {
8393         struct sk_buff *msg;
8394         void *hdr;
8395
8396         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8397         if (!msg)
8398                 return;
8399
8400         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8401         if (!hdr) {
8402                 nlmsg_free(msg);
8403                 return;
8404         }
8405
8406         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8407             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8408                                          wdev->netdev->ifindex)) ||
8409             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
8410             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
8411             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
8412                         NL80211_CHAN_NO_HT) ||
8413             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8414                 goto nla_put_failure;
8415
8416         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
8417             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
8418                 goto nla_put_failure;
8419
8420         genlmsg_end(msg, hdr);
8421
8422         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8423                                 nl80211_mlme_mcgrp.id, gfp);
8424         return;
8425
8426  nla_put_failure:
8427         genlmsg_cancel(msg, hdr);
8428         nlmsg_free(msg);
8429 }
8430
8431 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
8432                                     struct wireless_dev *wdev, u64 cookie,
8433                                     struct ieee80211_channel *chan,
8434                                     unsigned int duration, gfp_t gfp)
8435 {
8436         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
8437                                           rdev, wdev, cookie, chan,
8438                                           duration, gfp);
8439 }
8440
8441 void nl80211_send_remain_on_channel_cancel(
8442         struct cfg80211_registered_device *rdev,
8443         struct wireless_dev *wdev,
8444         u64 cookie, struct ieee80211_channel *chan, gfp_t gfp)
8445 {
8446         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8447                                           rdev, wdev, cookie, chan, 0, gfp);
8448 }
8449
8450 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
8451                             struct net_device *dev, const u8 *mac_addr,
8452                             struct station_info *sinfo, gfp_t gfp)
8453 {
8454         struct sk_buff *msg;
8455
8456         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8457         if (!msg)
8458                 return;
8459
8460         if (nl80211_send_station(msg, 0, 0, 0,
8461                                  rdev, dev, mac_addr, sinfo) < 0) {
8462                 nlmsg_free(msg);
8463                 return;
8464         }
8465
8466         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8467                                 nl80211_mlme_mcgrp.id, gfp);
8468 }
8469
8470 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
8471                                 struct net_device *dev, const u8 *mac_addr,
8472                                 gfp_t gfp)
8473 {
8474         struct sk_buff *msg;
8475         void *hdr;
8476
8477         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8478         if (!msg)
8479                 return;
8480
8481         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
8482         if (!hdr) {
8483                 nlmsg_free(msg);
8484                 return;
8485         }
8486
8487         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8488             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
8489                 goto nla_put_failure;
8490
8491         genlmsg_end(msg, hdr);
8492
8493         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8494                                 nl80211_mlme_mcgrp.id, gfp);
8495         return;
8496
8497  nla_put_failure:
8498         genlmsg_cancel(msg, hdr);
8499         nlmsg_free(msg);
8500 }
8501
8502 void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
8503                                     struct net_device *dev, const u8 *mac_addr,
8504                                     enum nl80211_connect_failed_reason reason,
8505                                     gfp_t gfp)
8506 {
8507         struct sk_buff *msg;
8508         void *hdr;
8509
8510         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8511         if (!msg)
8512                 return;
8513
8514         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
8515         if (!hdr) {
8516                 nlmsg_free(msg);
8517                 return;
8518         }
8519
8520         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8521             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
8522             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
8523                 goto nla_put_failure;
8524
8525         genlmsg_end(msg, hdr);
8526
8527         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8528                                 nl80211_mlme_mcgrp.id, gfp);
8529         return;
8530
8531  nla_put_failure:
8532         genlmsg_cancel(msg, hdr);
8533         nlmsg_free(msg);
8534 }
8535
8536 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
8537                                        const u8 *addr, gfp_t gfp)
8538 {
8539         struct wireless_dev *wdev = dev->ieee80211_ptr;
8540         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8541         struct sk_buff *msg;
8542         void *hdr;
8543         int err;
8544         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
8545
8546         if (!nlportid)
8547                 return false;
8548
8549         msg = nlmsg_new(100, gfp);
8550         if (!msg)
8551                 return true;
8552
8553         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8554         if (!hdr) {
8555                 nlmsg_free(msg);
8556                 return true;
8557         }
8558
8559         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8560             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8561             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8562                 goto nla_put_failure;
8563
8564         err = genlmsg_end(msg, hdr);
8565         if (err < 0) {
8566                 nlmsg_free(msg);
8567                 return true;
8568         }
8569
8570         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8571         return true;
8572
8573  nla_put_failure:
8574         genlmsg_cancel(msg, hdr);
8575         nlmsg_free(msg);
8576         return true;
8577 }
8578
8579 bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
8580 {
8581         return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
8582                                           addr, gfp);
8583 }
8584
8585 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
8586                                     const u8 *addr, gfp_t gfp)
8587 {
8588         return __nl80211_unexpected_frame(dev,
8589                                           NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
8590                                           addr, gfp);
8591 }
8592
8593 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
8594                       struct wireless_dev *wdev, u32 nlportid,
8595                       int freq, int sig_dbm,
8596                       const u8 *buf, size_t len, gfp_t gfp)
8597 {
8598         struct net_device *netdev = wdev->netdev;
8599         struct sk_buff *msg;
8600         void *hdr;
8601
8602         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8603         if (!msg)
8604                 return -ENOMEM;
8605
8606         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
8607         if (!hdr) {
8608                 nlmsg_free(msg);
8609                 return -ENOMEM;
8610         }
8611
8612         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8613             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8614                                         netdev->ifindex)) ||
8615             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
8616             (sig_dbm &&
8617              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
8618             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
8619                 goto nla_put_failure;
8620
8621         genlmsg_end(msg, hdr);
8622
8623         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8624
8625  nla_put_failure:
8626         genlmsg_cancel(msg, hdr);
8627         nlmsg_free(msg);
8628         return -ENOBUFS;
8629 }
8630
8631 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
8632                                  struct wireless_dev *wdev, u64 cookie,
8633                                  const u8 *buf, size_t len, bool ack,
8634                                  gfp_t gfp)
8635 {
8636         struct net_device *netdev = wdev->netdev;
8637         struct sk_buff *msg;
8638         void *hdr;
8639
8640         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8641         if (!msg)
8642                 return;
8643
8644         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
8645         if (!hdr) {
8646                 nlmsg_free(msg);
8647                 return;
8648         }
8649
8650         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8651             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8652                                    netdev->ifindex)) ||
8653             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
8654             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8655             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
8656                 goto nla_put_failure;
8657
8658         genlmsg_end(msg, hdr);
8659
8660         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
8661         return;
8662
8663  nla_put_failure:
8664         genlmsg_cancel(msg, hdr);
8665         nlmsg_free(msg);
8666 }
8667
8668 void
8669 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
8670                              struct net_device *netdev,
8671                              enum nl80211_cqm_rssi_threshold_event rssi_event,
8672                              gfp_t gfp)
8673 {
8674         struct sk_buff *msg;
8675         struct nlattr *pinfoattr;
8676         void *hdr;
8677
8678         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8679         if (!msg)
8680                 return;
8681
8682         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8683         if (!hdr) {
8684                 nlmsg_free(msg);
8685                 return;
8686         }
8687
8688         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8689             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8690                 goto nla_put_failure;
8691
8692         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8693         if (!pinfoattr)
8694                 goto nla_put_failure;
8695
8696         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
8697                         rssi_event))
8698                 goto nla_put_failure;
8699
8700         nla_nest_end(msg, pinfoattr);
8701
8702         genlmsg_end(msg, hdr);
8703
8704         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8705                                 nl80211_mlme_mcgrp.id, gfp);
8706         return;
8707
8708  nla_put_failure:
8709         genlmsg_cancel(msg, hdr);
8710         nlmsg_free(msg);
8711 }
8712
8713 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
8714                               struct net_device *netdev, const u8 *bssid,
8715                               const u8 *replay_ctr, gfp_t gfp)
8716 {
8717         struct sk_buff *msg;
8718         struct nlattr *rekey_attr;
8719         void *hdr;
8720
8721         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8722         if (!msg)
8723                 return;
8724
8725         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
8726         if (!hdr) {
8727                 nlmsg_free(msg);
8728                 return;
8729         }
8730
8731         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8732             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8733             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8734                 goto nla_put_failure;
8735
8736         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
8737         if (!rekey_attr)
8738                 goto nla_put_failure;
8739
8740         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
8741                     NL80211_REPLAY_CTR_LEN, replay_ctr))
8742                 goto nla_put_failure;
8743
8744         nla_nest_end(msg, rekey_attr);
8745
8746         genlmsg_end(msg, hdr);
8747
8748         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8749                                 nl80211_mlme_mcgrp.id, gfp);
8750         return;
8751
8752  nla_put_failure:
8753         genlmsg_cancel(msg, hdr);
8754         nlmsg_free(msg);
8755 }
8756
8757 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
8758                                     struct net_device *netdev, int index,
8759                                     const u8 *bssid, bool preauth, gfp_t gfp)
8760 {
8761         struct sk_buff *msg;
8762         struct nlattr *attr;
8763         void *hdr;
8764
8765         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8766         if (!msg)
8767                 return;
8768
8769         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
8770         if (!hdr) {
8771                 nlmsg_free(msg);
8772                 return;
8773         }
8774
8775         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8776             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8777                 goto nla_put_failure;
8778
8779         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
8780         if (!attr)
8781                 goto nla_put_failure;
8782
8783         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
8784             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
8785             (preauth &&
8786              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
8787                 goto nla_put_failure;
8788
8789         nla_nest_end(msg, attr);
8790
8791         genlmsg_end(msg, hdr);
8792
8793         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8794                                 nl80211_mlme_mcgrp.id, gfp);
8795         return;
8796
8797  nla_put_failure:
8798         genlmsg_cancel(msg, hdr);
8799         nlmsg_free(msg);
8800 }
8801
8802 void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
8803                               struct net_device *netdev, int freq,
8804                               enum nl80211_channel_type type, gfp_t gfp)
8805 {
8806         struct sk_buff *msg;
8807         void *hdr;
8808
8809         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8810         if (!msg)
8811                 return;
8812
8813         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
8814         if (!hdr) {
8815                 nlmsg_free(msg);
8816                 return;
8817         }
8818
8819         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8820             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
8821             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, type))
8822                 goto nla_put_failure;
8823
8824         genlmsg_end(msg, hdr);
8825
8826         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8827                                 nl80211_mlme_mcgrp.id, gfp);
8828         return;
8829
8830  nla_put_failure:
8831         genlmsg_cancel(msg, hdr);
8832         nlmsg_free(msg);
8833 }
8834
8835 void
8836 nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
8837                             struct net_device *netdev, const u8 *peer,
8838                             u32 num_packets, u32 rate, u32 intvl, gfp_t gfp)
8839 {
8840         struct sk_buff *msg;
8841         struct nlattr *pinfoattr;
8842         void *hdr;
8843
8844         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8845         if (!msg)
8846                 return;
8847
8848         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8849         if (!hdr) {
8850                 nlmsg_free(msg);
8851                 return;
8852         }
8853
8854         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8855             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8856             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
8857                 goto nla_put_failure;
8858
8859         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8860         if (!pinfoattr)
8861                 goto nla_put_failure;
8862
8863         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
8864                 goto nla_put_failure;
8865
8866         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
8867                 goto nla_put_failure;
8868
8869         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
8870                 goto nla_put_failure;
8871
8872         nla_nest_end(msg, pinfoattr);
8873
8874         genlmsg_end(msg, hdr);
8875
8876         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8877                                 nl80211_mlme_mcgrp.id, gfp);
8878         return;
8879
8880  nla_put_failure:
8881         genlmsg_cancel(msg, hdr);
8882         nlmsg_free(msg);
8883 }
8884
8885 void
8886 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
8887                                 struct net_device *netdev, const u8 *peer,
8888                                 u32 num_packets, gfp_t gfp)
8889 {
8890         struct sk_buff *msg;
8891         struct nlattr *pinfoattr;
8892         void *hdr;
8893
8894         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8895         if (!msg)
8896                 return;
8897
8898         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8899         if (!hdr) {
8900                 nlmsg_free(msg);
8901                 return;
8902         }
8903
8904         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8905             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8906             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
8907                 goto nla_put_failure;
8908
8909         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8910         if (!pinfoattr)
8911                 goto nla_put_failure;
8912
8913         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
8914                 goto nla_put_failure;
8915
8916         nla_nest_end(msg, pinfoattr);
8917
8918         genlmsg_end(msg, hdr);
8919
8920         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8921                                 nl80211_mlme_mcgrp.id, gfp);
8922         return;
8923
8924  nla_put_failure:
8925         genlmsg_cancel(msg, hdr);
8926         nlmsg_free(msg);
8927 }
8928
8929 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
8930                            u64 cookie, bool acked, gfp_t gfp)
8931 {
8932         struct wireless_dev *wdev = dev->ieee80211_ptr;
8933         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8934         struct sk_buff *msg;
8935         void *hdr;
8936         int err;
8937
8938         trace_cfg80211_probe_status(dev, addr, cookie, acked);
8939
8940         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8941
8942         if (!msg)
8943                 return;
8944
8945         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
8946         if (!hdr) {
8947                 nlmsg_free(msg);
8948                 return;
8949         }
8950
8951         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8952             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8953             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
8954             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8955             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
8956                 goto nla_put_failure;
8957
8958         err = genlmsg_end(msg, hdr);
8959         if (err < 0) {
8960                 nlmsg_free(msg);
8961                 return;
8962         }
8963
8964         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8965                                 nl80211_mlme_mcgrp.id, gfp);
8966         return;
8967
8968  nla_put_failure:
8969         genlmsg_cancel(msg, hdr);
8970         nlmsg_free(msg);
8971 }
8972 EXPORT_SYMBOL(cfg80211_probe_status);
8973
8974 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
8975                                  const u8 *frame, size_t len,
8976                                  int freq, int sig_dbm)
8977 {
8978         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
8979         struct sk_buff *msg;
8980         void *hdr;
8981         struct cfg80211_beacon_registration *reg;
8982
8983         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
8984
8985         spin_lock_bh(&rdev->beacon_registrations_lock);
8986         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8987                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
8988                 if (!msg) {
8989                         spin_unlock_bh(&rdev->beacon_registrations_lock);
8990                         return;
8991                 }
8992
8993                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
8994                 if (!hdr)
8995                         goto nla_put_failure;
8996
8997                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8998                     (freq &&
8999                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
9000                     (sig_dbm &&
9001                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9002                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
9003                         goto nla_put_failure;
9004
9005                 genlmsg_end(msg, hdr);
9006
9007                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
9008         }
9009         spin_unlock_bh(&rdev->beacon_registrations_lock);
9010         return;
9011
9012  nla_put_failure:
9013         spin_unlock_bh(&rdev->beacon_registrations_lock);
9014         if (hdr)
9015                 genlmsg_cancel(msg, hdr);
9016         nlmsg_free(msg);
9017 }
9018 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
9019
9020 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
9021                                 enum nl80211_tdls_operation oper,
9022                                 u16 reason_code, gfp_t gfp)
9023 {
9024         struct wireless_dev *wdev = dev->ieee80211_ptr;
9025         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9026         struct sk_buff *msg;
9027         void *hdr;
9028         int err;
9029
9030         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
9031                                          reason_code);
9032
9033         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9034         if (!msg)
9035                 return;
9036
9037         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
9038         if (!hdr) {
9039                 nlmsg_free(msg);
9040                 return;
9041         }
9042
9043         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9044             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9045             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
9046             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
9047             (reason_code > 0 &&
9048              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
9049                 goto nla_put_failure;
9050
9051         err = genlmsg_end(msg, hdr);
9052         if (err < 0) {
9053                 nlmsg_free(msg);
9054                 return;
9055         }
9056
9057         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9058                                 nl80211_mlme_mcgrp.id, gfp);
9059         return;
9060
9061  nla_put_failure:
9062         genlmsg_cancel(msg, hdr);
9063         nlmsg_free(msg);
9064 }
9065 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
9066
9067 static int nl80211_netlink_notify(struct notifier_block * nb,
9068                                   unsigned long state,
9069                                   void *_notify)
9070 {
9071         struct netlink_notify *notify = _notify;
9072         struct cfg80211_registered_device *rdev;
9073         struct wireless_dev *wdev;
9074         struct cfg80211_beacon_registration *reg, *tmp;
9075
9076         if (state != NETLINK_URELEASE)
9077                 return NOTIFY_DONE;
9078
9079         rcu_read_lock();
9080
9081         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
9082                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
9083                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
9084
9085                 spin_lock_bh(&rdev->beacon_registrations_lock);
9086                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
9087                                          list) {
9088                         if (reg->nlportid == notify->portid) {
9089                                 list_del(&reg->list);
9090                                 kfree(reg);
9091                                 break;
9092                         }
9093                 }
9094                 spin_unlock_bh(&rdev->beacon_registrations_lock);
9095         }
9096
9097         rcu_read_unlock();
9098
9099         return NOTIFY_DONE;
9100 }
9101
9102 static struct notifier_block nl80211_netlink_notifier = {
9103         .notifier_call = nl80211_netlink_notify,
9104 };
9105
9106 /* initialisation/exit functions */
9107
9108 int nl80211_init(void)
9109 {
9110         int err;
9111
9112         err = genl_register_family_with_ops(&nl80211_fam,
9113                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
9114         if (err)
9115                 return err;
9116
9117         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
9118         if (err)
9119                 goto err_out;
9120
9121         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
9122         if (err)
9123                 goto err_out;
9124
9125         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
9126         if (err)
9127                 goto err_out;
9128
9129         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
9130         if (err)
9131                 goto err_out;
9132
9133 #ifdef CONFIG_NL80211_TESTMODE
9134         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
9135         if (err)
9136                 goto err_out;
9137 #endif
9138
9139         err = netlink_register_notifier(&nl80211_netlink_notifier);
9140         if (err)
9141                 goto err_out;
9142
9143         return 0;
9144  err_out:
9145         genl_unregister_family(&nl80211_fam);
9146         return err;
9147 }
9148
9149 void nl80211_exit(void)
9150 {
9151         netlink_unregister_notifier(&nl80211_netlink_notifier);
9152         genl_unregister_family(&nl80211_fam);
9153 }