net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25 #include "rdev-ops.h"
  26
  27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  28                                    struct genl_info *info,
  29                                    struct cfg80211_crypto_settings *settings,
  30                                    int cipher_limit);
  31
  32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  33                             struct genl_info *info);
  34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  35                               struct genl_info *info);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam = {
  39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  40         .name = "nl80211",      /* have users key off the name instead */
  41         .hdrsize = 0,           /* no private header */
  42         .version = 1,           /* no particular meaning now */
  43         .maxattr = NL80211_ATTR_MAX,
  44         .netnsok = true,
  45         .pre_doit = nl80211_pre_doit,
  46         .post_doit = nl80211_post_doit,
  47 };
  48
  49 /* returns ERR_PTR values */
  50 static struct wireless_dev *
  51 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  52 {
  53         struct cfg80211_registered_device *rdev;
  54         struct wireless_dev *result = NULL;
  55         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  56         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  57         u64 wdev_id;
  58         int wiphy_idx = -1;
  59         int ifidx = -1;
  60
  61         assert_cfg80211_lock();
  62
  63         if (!have_ifidx && !have_wdev_id)
  64                 return ERR_PTR(-EINVAL);
  65
  66         if (have_ifidx)
  67                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  68         if (have_wdev_id) {
  69                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  70                 wiphy_idx = wdev_id >> 32;
  71         }
  72
  73         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  74                 struct wireless_dev *wdev;
  75
  76                 if (wiphy_net(&rdev->wiphy) != netns)
  77                         continue;
  78
  79                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  80                         continue;
  81
  82                 mutex_lock(&rdev->devlist_mtx);
  83                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  84                         if (have_ifidx && wdev->netdev &&
  85                             wdev->netdev->ifindex == ifidx) {
  86                                 result = wdev;
  87                                 break;
  88                         }
  89                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  90                                 result = wdev;
  91                                 break;
  92                         }
  93                 }
  94                 mutex_unlock(&rdev->devlist_mtx);
  95
  96                 if (result)
  97                         break;
  98         }
  99
 100         if (result)
 101                 return result;
 102         return ERR_PTR(-ENODEV);
 103 }
 104
 105 static struct cfg80211_registered_device *
 106 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 107 {
 108         struct cfg80211_registered_device *rdev = NULL, *tmp;
 109         struct net_device *netdev;
 110
 111         assert_cfg80211_lock();
 112
 113         if (!attrs[NL80211_ATTR_WIPHY] &&
 114             !attrs[NL80211_ATTR_IFINDEX] &&
 115             !attrs[NL80211_ATTR_WDEV])
 116                 return ERR_PTR(-EINVAL);
 117
 118         if (attrs[NL80211_ATTR_WIPHY])
 119                 rdev = cfg80211_rdev_by_wiphy_idx(
 120                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 121
 122         if (attrs[NL80211_ATTR_WDEV]) {
 123                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 124                 struct wireless_dev *wdev;
 125                 bool found = false;
 126
 127                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 128                 if (tmp) {
 129                         /* make sure wdev exists */
 130                         mutex_lock(&tmp->devlist_mtx);
 131                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 132                                 if (wdev->identifier != (u32)wdev_id)
 133                                         continue;
 134                                 found = true;
 135                                 break;
 136                         }
 137                         mutex_unlock(&tmp->devlist_mtx);
 138
 139                         if (!found)
 140                                 tmp = NULL;
 141
 142                         if (rdev && tmp != rdev)
 143                                 return ERR_PTR(-EINVAL);
 144                         rdev = tmp;
 145                 }
 146         }
 147
 148         if (attrs[NL80211_ATTR_IFINDEX]) {
 149                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 150                 netdev = dev_get_by_index(netns, ifindex);
 151                 if (netdev) {
 152                         if (netdev->ieee80211_ptr)
 153                                 tmp = wiphy_to_dev(
 154                                                 netdev->ieee80211_ptr->wiphy);
 155                         else
 156                                 tmp = NULL;
 157
 158                         dev_put(netdev);
 159
 160                         /* not wireless device -- return error */
 161                         if (!tmp)
 162                                 return ERR_PTR(-EINVAL);
 163
 164                         /* mismatch -- return error */
 165                         if (rdev && tmp != rdev)
 166                                 return ERR_PTR(-EINVAL);
 167
 168                         rdev = tmp;
 169                 }
 170         }
 171
 172         if (!rdev)
 173                 return ERR_PTR(-ENODEV);
 174
 175         if (netns != wiphy_net(&rdev->wiphy))
 176                 return ERR_PTR(-ENODEV);
 177
 178         return rdev;
 179 }
 180
 181 /*
 182  * This function returns a pointer to the driver
 183  * that the genl_info item that is passed refers to.
 184  * If successful, it returns non-NULL and also locks
 185  * the driver's mutex!
 186  *
 187  * This means that you need to call cfg80211_unlock_rdev()
 188  * before being allowed to acquire &cfg80211_mutex!
 189  *
 190  * This is necessary because we need to lock the global
 191  * mutex to get an item off the list safely, and then
 192  * we lock the rdev mutex so it doesn't go away under us.
 193  *
 194  * We don't want to keep cfg80211_mutex locked
 195  * for all the time in order to allow requests on
 196  * other interfaces to go through at the same time.
 197  *
 198  * The result of this can be a PTR_ERR and hence must
 199  * be checked with IS_ERR() for errors.
 200  */
 201 static struct cfg80211_registered_device *
 202 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 203 {
 204         struct cfg80211_registered_device *rdev;
 205
 206         mutex_lock(&cfg80211_mutex);
 207         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 208
 209         /* if it is not an error we grab the lock on
 210          * it to assure it won't be going away while
 211          * we operate on it */
 212         if (!IS_ERR(rdev))
 213                 mutex_lock(&rdev->mtx);
 214
 215         mutex_unlock(&cfg80211_mutex);
 216
 217         return rdev;
 218 }
 219
 220 /* policy for the attributes */
 221 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 222         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 223         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 224                                       .len = 20-1 },
 225         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 226         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 229         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 230         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 231         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 232         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 233
 234         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 235         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 236         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 237
 238         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 239         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 240
 241         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 242         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 243                                     .len = WLAN_MAX_KEY_LEN },
 244         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 245         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 246         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 247         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 248         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 249
 250         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 251         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 252         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 253                                        .len = IEEE80211_MAX_DATA_LEN },
 254         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 255                                        .len = IEEE80211_MAX_DATA_LEN },
 256         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 257         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 258         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 259         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 260                                                .len = NL80211_MAX_SUPP_RATES },
 261         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 262         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 263         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 264         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 265                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 266         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 267
 268         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 269         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 270
 271         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 272         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 273         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 274         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 275                                            .len = NL80211_MAX_SUPP_RATES },
 276         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 277
 278         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 279         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 280
 281         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 282
 283         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 284         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 285                               .len = IEEE80211_MAX_DATA_LEN },
 286         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 287         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 288
 289         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 290                                 .len = IEEE80211_MAX_SSID_LEN },
 291         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 292         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 293         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 294         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 295         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 296         [NL80211_ATTR_STA_FLAGS2] = {
 297                 .len = sizeof(struct nl80211_sta_flag_update),
 298         },
 299         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 301         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 302         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 303         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 304         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 305         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 306         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 307         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 308                                  .len = WLAN_PMKID_LEN },
 309         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 310         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 311         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 312         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 313                                  .len = IEEE80211_MAX_DATA_LEN },
 314         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 315         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 316         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 317         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 318         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 319         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 320         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 321         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 322         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 323         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 324         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 325         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 326         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 327         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 329         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 330         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 331         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 332         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 333         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 334                                          .len = IEEE80211_MAX_DATA_LEN },
 335         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 336                                          .len = IEEE80211_MAX_DATA_LEN },
 337         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 338         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 339         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 341         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 342         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 343         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 347                                       .len = IEEE80211_MAX_DATA_LEN },
 348         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 351                 .len = NL80211_HT_CAPABILITY_LEN
 352         },
 353         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 354         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 355         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 356         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 357         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 358         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 359         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 360         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 361 };
 362
 363 /* policy for the key attributes */
 364 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 365         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 366         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 367         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 368         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 369         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 370         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 371         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 372         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 373 };
 374
 375 /* policy for the key default flags */
 376 static const struct nla_policy
 377 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 378         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 379         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 380 };
 381
 382 /* policy for WoWLAN attributes */
 383 static const struct nla_policy
 384 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 385         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 386         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 387         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 388         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 389         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 390         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 391         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 392         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 393 };
 394
 395 /* policy for GTK rekey offload attributes */
 396 static const struct nla_policy
 397 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 398         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 399         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 400         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 401 };
 402
 403 static const struct nla_policy
 404 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 405         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 406                                                  .len = IEEE80211_MAX_SSID_LEN },
 407         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 408 };
 409
 410 /* ifidx get helper */
 411 static int nl80211_get_ifidx(struct netlink_callback *cb)
 412 {
 413         int res;
 414
 415         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 416                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 417                           nl80211_policy);
 418         if (res)
 419                 return res;
 420
 421         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 422                 return -EINVAL;
 423
 424         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 425         if (!res)
 426                 return -EINVAL;
 427         return res;
 428 }
 429
 430 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 431                                        struct netlink_callback *cb,
 432                                        struct cfg80211_registered_device **rdev,
 433                                        struct net_device **dev)
 434 {
 435         int ifidx = cb->args[0];
 436         int err;
 437
 438         if (!ifidx)
 439                 ifidx = nl80211_get_ifidx(cb);
 440         if (ifidx < 0)
 441                 return ifidx;
 442
 443         cb->args[0] = ifidx;
 444
 445         rtnl_lock();
 446
 447         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 448         if (!*dev) {
 449                 err = -ENODEV;
 450                 goto out_rtnl;
 451         }
 452
 453         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 454         if (IS_ERR(*rdev)) {
 455                 err = PTR_ERR(*rdev);
 456                 goto out_rtnl;
 457         }
 458
 459         return 0;
 460  out_rtnl:
 461         rtnl_unlock();
 462         return err;
 463 }
 464
 465 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 466 {
 467         cfg80211_unlock_rdev(rdev);
 468         rtnl_unlock();
 469 }
 470
 471 /* IE validation */
 472 static bool is_valid_ie_attr(const struct nlattr *attr)
 473 {
 474         const u8 *pos;
 475         int len;
 476
 477         if (!attr)
 478                 return true;
 479
 480         pos = nla_data(attr);
 481         len = nla_len(attr);
 482
 483         while (len) {
 484                 u8 elemlen;
 485
 486                 if (len < 2)
 487                         return false;
 488                 len -= 2;
 489
 490                 elemlen = pos[1];
 491                 if (elemlen > len)
 492                         return false;
 493
 494                 len -= elemlen;
 495                 pos += 2 + elemlen;
 496         }
 497
 498         return true;
 499 }
 500
 501 /* message building helper */
 502 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 503                                    int flags, u8 cmd)
 504 {
 505         /* since there is no private header just add the generic one */
 506         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 507 }
 508
 509 static int nl80211_msg_put_channel(struct sk_buff *msg,
 510                                    struct ieee80211_channel *chan)
 511 {
 512         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 513                         chan->center_freq))
 514                 goto nla_put_failure;
 515
 516         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 517             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 518                 goto nla_put_failure;
 519         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 520             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 521                 goto nla_put_failure;
 522         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 523             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 524                 goto nla_put_failure;
 525         if ((chan->flags & IEEE80211_CHAN_RADAR) &&
 526             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 527                 goto nla_put_failure;
 528
 529         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 530                         DBM_TO_MBM(chan->max_power)))
 531                 goto nla_put_failure;
 532
 533         return 0;
 534
 535  nla_put_failure:
 536         return -ENOBUFS;
 537 }
 538
 539 /* netlink command implementations */
 540
 541 struct key_parse {
 542         struct key_params p;
 543         int idx;
 544         int type;
 545         bool def, defmgmt;
 546         bool def_uni, def_multi;
 547 };
 548
 549 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 550 {
 551         struct nlattr *tb[NL80211_KEY_MAX + 1];
 552         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 553                                    nl80211_key_policy);
 554         if (err)
 555                 return err;
 556
 557         k->def = !!tb[NL80211_KEY_DEFAULT];
 558         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 559
 560         if (k->def) {
 561                 k->def_uni = true;
 562                 k->def_multi = true;
 563         }
 564         if (k->defmgmt)
 565                 k->def_multi = true;
 566
 567         if (tb[NL80211_KEY_IDX])
 568                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 569
 570         if (tb[NL80211_KEY_DATA]) {
 571                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 572                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 573         }
 574
 575         if (tb[NL80211_KEY_SEQ]) {
 576                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 577                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 578         }
 579
 580         if (tb[NL80211_KEY_CIPHER])
 581                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 582
 583         if (tb[NL80211_KEY_TYPE]) {
 584                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 585                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 586                         return -EINVAL;
 587         }
 588
 589         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 590                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 591                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 592                                        tb[NL80211_KEY_DEFAULT_TYPES],
 593                                        nl80211_key_default_policy);
 594                 if (err)
 595                         return err;
 596
 597                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 598                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 599         }
 600
 601         return 0;
 602 }
 603
 604 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 605 {
 606         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 607                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 608                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 609         }
 610
 611         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 612                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 613                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 614         }
 615
 616         if (info->attrs[NL80211_ATTR_KEY_IDX])
 617                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 618
 619         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 620                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 621
 622         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 623         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 624
 625         if (k->def) {
 626                 k->def_uni = true;
 627                 k->def_multi = true;
 628         }
 629         if (k->defmgmt)
 630                 k->def_multi = true;
 631
 632         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 633                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 634                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 635                         return -EINVAL;
 636         }
 637
 638         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 639                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 640                 int err = nla_parse_nested(
 641                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 642                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 643                                 nl80211_key_default_policy);
 644                 if (err)
 645                         return err;
 646
 647                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 648                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 649         }
 650
 651         return 0;
 652 }
 653
 654 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 655 {
 656         int err;
 657
 658         memset(k, 0, sizeof(*k));
 659         k->idx = -1;
 660         k->type = -1;
 661
 662         if (info->attrs[NL80211_ATTR_KEY])
 663                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 664         else
 665                 err = nl80211_parse_key_old(info, k);
 666
 667         if (err)
 668                 return err;
 669
 670         if (k->def && k->defmgmt)
 671                 return -EINVAL;
 672
 673         if (k->defmgmt) {
 674                 if (k->def_uni || !k->def_multi)
 675                         return -EINVAL;
 676         }
 677
 678         if (k->idx != -1) {
 679                 if (k->defmgmt) {
 680                         if (k->idx < 4 || k->idx > 5)
 681                                 return -EINVAL;
 682                 } else if (k->def) {
 683                         if (k->idx < 0 || k->idx > 3)
 684                                 return -EINVAL;
 685                 } else {
 686                         if (k->idx < 0 || k->idx > 5)
 687                                 return -EINVAL;
 688                 }
 689         }
 690
 691         return 0;
 692 }
 693
 694 static struct cfg80211_cached_keys *
 695 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 696                        struct nlattr *keys, bool *no_ht)
 697 {
 698         struct key_parse parse;
 699         struct nlattr *key;
 700         struct cfg80211_cached_keys *result;
 701         int rem, err, def = 0;
 702
 703         result = kzalloc(sizeof(*result), GFP_KERNEL);
 704         if (!result)
 705                 return ERR_PTR(-ENOMEM);
 706
 707         result->def = -1;
 708         result->defmgmt = -1;
 709
 710         nla_for_each_nested(key, keys, rem) {
 711                 memset(&parse, 0, sizeof(parse));
 712                 parse.idx = -1;
 713
 714                 err = nl80211_parse_key_new(key, &parse);
 715                 if (err)
 716                         goto error;
 717                 err = -EINVAL;
 718                 if (!parse.p.key)
 719                         goto error;
 720                 if (parse.idx < 0 || parse.idx > 4)
 721                         goto error;
 722                 if (parse.def) {
 723                         if (def)
 724                                 goto error;
 725                         def = 1;
 726                         result->def = parse.idx;
 727                         if (!parse.def_uni || !parse.def_multi)
 728                                 goto error;
 729                 } else if (parse.defmgmt)
 730                         goto error;
 731                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 732                                                      parse.idx, false, NULL);
 733                 if (err)
 734                         goto error;
 735                 result->params[parse.idx].cipher = parse.p.cipher;
 736                 result->params[parse.idx].key_len = parse.p.key_len;
 737                 result->params[parse.idx].key = result->data[parse.idx];
 738                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 739
 740                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 741                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 742                         if (no_ht)
 743                                 *no_ht = true;
 744                 }
 745         }
 746
 747         return result;
 748  error:
 749         kfree(result);
 750         return ERR_PTR(err);
 751 }
 752
 753 static int nl80211_key_allowed(struct wireless_dev *wdev)
 754 {
 755         ASSERT_WDEV_LOCK(wdev);
 756
 757         switch (wdev->iftype) {
 758         case NL80211_IFTYPE_AP:
 759         case NL80211_IFTYPE_AP_VLAN:
 760         case NL80211_IFTYPE_P2P_GO:
 761         case NL80211_IFTYPE_MESH_POINT:
 762                 break;
 763         case NL80211_IFTYPE_ADHOC:
 764                 if (!wdev->current_bss)
 765                         return -ENOLINK;
 766                 break;
 767         case NL80211_IFTYPE_STATION:
 768         case NL80211_IFTYPE_P2P_CLIENT:
 769                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 770                         return -ENOLINK;
 771                 break;
 772         default:
 773                 return -EINVAL;
 774         }
 775
 776         return 0;
 777 }
 778
 779 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 780 {
 781         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 782         int i;
 783
 784         if (!nl_modes)
 785                 goto nla_put_failure;
 786
 787         i = 0;
 788         while (ifmodes) {
 789                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 790                         goto nla_put_failure;
 791                 ifmodes >>= 1;
 792                 i++;
 793         }
 794
 795         nla_nest_end(msg, nl_modes);
 796         return 0;
 797
 798 nla_put_failure:
 799         return -ENOBUFS;
 800 }
 801
 802 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 803                                           struct sk_buff *msg)
 804 {
 805         struct nlattr *nl_combis;
 806         int i, j;
 807
 808         nl_combis = nla_nest_start(msg,
 809                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 810         if (!nl_combis)
 811                 goto nla_put_failure;
 812
 813         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 814                 const struct ieee80211_iface_combination *c;
 815                 struct nlattr *nl_combi, *nl_limits;
 816
 817                 c = &wiphy->iface_combinations[i];
 818
 819                 nl_combi = nla_nest_start(msg, i + 1);
 820                 if (!nl_combi)
 821                         goto nla_put_failure;
 822
 823                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 824                 if (!nl_limits)
 825                         goto nla_put_failure;
 826
 827                 for (j = 0; j < c->n_limits; j++) {
 828                         struct nlattr *nl_limit;
 829
 830                         nl_limit = nla_nest_start(msg, j + 1);
 831                         if (!nl_limit)
 832                                 goto nla_put_failure;
 833                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 834                                         c->limits[j].max))
 835                                 goto nla_put_failure;
 836                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 837                                                 c->limits[j].types))
 838                                 goto nla_put_failure;
 839                         nla_nest_end(msg, nl_limit);
 840                 }
 841
 842                 nla_nest_end(msg, nl_limits);
 843
 844                 if (c->beacon_int_infra_match &&
 845                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 846                         goto nla_put_failure;
 847                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 848                                 c->num_different_channels) ||
 849                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 850                                 c->max_interfaces))
 851                         goto nla_put_failure;
 852
 853                 nla_nest_end(msg, nl_combi);
 854         }
 855
 856         nla_nest_end(msg, nl_combis);
 857
 858         return 0;
 859 nla_put_failure:
 860         return -ENOBUFS;
 861 }
 862
 863 static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
 864                               struct cfg80211_registered_device *dev)
 865 {
 866         void *hdr;
 867         struct nlattr *nl_bands, *nl_band;
 868         struct nlattr *nl_freqs, *nl_freq;
 869         struct nlattr *nl_rates, *nl_rate;
 870         struct nlattr *nl_cmds;
 871         enum ieee80211_band band;
 872         struct ieee80211_channel *chan;
 873         struct ieee80211_rate *rate;
 874         int i;
 875         const struct ieee80211_txrx_stypes *mgmt_stypes =
 876                                 dev->wiphy.mgmt_stypes;
 877
 878         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
 879         if (!hdr)
 880                 return -1;
 881
 882         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
 883             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
 884             nla_put_u32(msg, NL80211_ATTR_GENERATION,
 885                         cfg80211_rdev_list_generation) ||
 886             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 887                        dev->wiphy.retry_short) ||
 888             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 889                        dev->wiphy.retry_long) ||
 890             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 891                         dev->wiphy.frag_threshold) ||
 892             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 893                         dev->wiphy.rts_threshold) ||
 894             nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 895                        dev->wiphy.coverage_class) ||
 896             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 897                        dev->wiphy.max_scan_ssids) ||
 898             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 899                        dev->wiphy.max_sched_scan_ssids) ||
 900             nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 901                         dev->wiphy.max_scan_ie_len) ||
 902             nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 903                         dev->wiphy.max_sched_scan_ie_len) ||
 904             nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 905                        dev->wiphy.max_match_sets))
 906                 goto nla_put_failure;
 907
 908         if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
 909             nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
 910                 goto nla_put_failure;
 911         if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
 912             nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
 913                 goto nla_put_failure;
 914         if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
 915             nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
 916                 goto nla_put_failure;
 917         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
 918             nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
 919                 goto nla_put_failure;
 920         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
 921             nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
 922                 goto nla_put_failure;
 923         if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
 924             nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
 925                 goto nla_put_failure;
 926
 927         if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
 928                     sizeof(u32) * dev->wiphy.n_cipher_suites,
 929                     dev->wiphy.cipher_suites))
 930                 goto nla_put_failure;
 931
 932         if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 933                        dev->wiphy.max_num_pmkids))
 934                 goto nla_put_failure;
 935
 936         if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
 937             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
 938                 goto nla_put_failure;
 939
 940         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 941                         dev->wiphy.available_antennas_tx) ||
 942             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 943                         dev->wiphy.available_antennas_rx))
 944                 goto nla_put_failure;
 945
 946         if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
 947             nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
 948                         dev->wiphy.probe_resp_offload))
 949                 goto nla_put_failure;
 950
 951         if ((dev->wiphy.available_antennas_tx ||
 952              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 953                 u32 tx_ant = 0, rx_ant = 0;
 954                 int res;
 955                 res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
 956                 if (!res) {
 957                         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
 958                                         tx_ant) ||
 959                             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
 960                                         rx_ant))
 961                                 goto nla_put_failure;
 962                 }
 963         }
 964
 965         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 966                                 dev->wiphy.interface_modes))
 967                 goto nla_put_failure;
 968
 969         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 970         if (!nl_bands)
 971                 goto nla_put_failure;
 972
 973         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 974                 if (!dev->wiphy.bands[band])
 975                         continue;
 976
 977                 nl_band = nla_nest_start(msg, band);
 978                 if (!nl_band)
 979                         goto nla_put_failure;
 980
 981                 /* add HT info */
 982                 if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
 983                     (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 984                              sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 985                              &dev->wiphy.bands[band]->ht_cap.mcs) ||
 986                      nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
 987                                  dev->wiphy.bands[band]->ht_cap.cap) ||
 988                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 989                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
 990                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 991                                 dev->wiphy.bands[band]->ht_cap.ampdu_density)))
 992                         goto nla_put_failure;
 993
 994                 /* add VHT info */
 995                 if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
 996                     (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
 997                              sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
 998                              &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
 999                      nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1000                                  dev->wiphy.bands[band]->vht_cap.cap)))
1001                         goto nla_put_failure;
1002
1003                 /* add frequencies */
1004                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
1005                 if (!nl_freqs)
1006                         goto nla_put_failure;
1007
1008                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
1009                         nl_freq = nla_nest_start(msg, i);
1010                         if (!nl_freq)
1011                                 goto nla_put_failure;
1012
1013                         chan = &dev->wiphy.bands[band]->channels[i];
1014
1015                         if (nl80211_msg_put_channel(msg, chan))
1016                                 goto nla_put_failure;
1017
1018                         nla_nest_end(msg, nl_freq);
1019                 }
1020
1021                 nla_nest_end(msg, nl_freqs);
1022
1023                 /* add bitrates */
1024                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1025                 if (!nl_rates)
1026                         goto nla_put_failure;
1027
1028                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
1029                         nl_rate = nla_nest_start(msg, i);
1030                         if (!nl_rate)
1031                                 goto nla_put_failure;
1032
1033                         rate = &dev->wiphy.bands[band]->bitrates[i];
1034                         if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1035                                         rate->bitrate))
1036                                 goto nla_put_failure;
1037                         if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1038                             nla_put_flag(msg,
1039                                          NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1040                                 goto nla_put_failure;
1041
1042                         nla_nest_end(msg, nl_rate);
1043                 }
1044
1045                 nla_nest_end(msg, nl_rates);
1046
1047                 nla_nest_end(msg, nl_band);
1048         }
1049         nla_nest_end(msg, nl_bands);
1050
1051         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1052         if (!nl_cmds)
1053                 goto nla_put_failure;
1054
1055         i = 0;
1056 #define CMD(op, n)                                              \
1057          do {                                                   \
1058                 if (dev->ops->op) {                             \
1059                         i++;                                    \
1060                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1061                                 goto nla_put_failure;           \
1062                 }                                               \
1063         } while (0)
1064
1065         CMD(add_virtual_intf, NEW_INTERFACE);
1066         CMD(change_virtual_intf, SET_INTERFACE);
1067         CMD(add_key, NEW_KEY);
1068         CMD(start_ap, START_AP);
1069         CMD(add_station, NEW_STATION);
1070         CMD(add_mpath, NEW_MPATH);
1071         CMD(update_mesh_config, SET_MESH_CONFIG);
1072         CMD(change_bss, SET_BSS);
1073         CMD(auth, AUTHENTICATE);
1074         CMD(assoc, ASSOCIATE);
1075         CMD(deauth, DEAUTHENTICATE);
1076         CMD(disassoc, DISASSOCIATE);
1077         CMD(join_ibss, JOIN_IBSS);
1078         CMD(join_mesh, JOIN_MESH);
1079         CMD(set_pmksa, SET_PMKSA);
1080         CMD(del_pmksa, DEL_PMKSA);
1081         CMD(flush_pmksa, FLUSH_PMKSA);
1082         if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1083                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1084         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1085         CMD(mgmt_tx, FRAME);
1086         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1087         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1088                 i++;
1089                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1090                         goto nla_put_failure;
1091         }
1092         if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1093             dev->ops->join_mesh) {
1094                 i++;
1095                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1096                         goto nla_put_failure;
1097         }
1098         CMD(set_wds_peer, SET_WDS_PEER);
1099         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1100                 CMD(tdls_mgmt, TDLS_MGMT);
1101                 CMD(tdls_oper, TDLS_OPER);
1102         }
1103         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1104                 CMD(sched_scan_start, START_SCHED_SCAN);
1105         CMD(probe_client, PROBE_CLIENT);
1106         CMD(set_noack_map, SET_NOACK_MAP);
1107         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1108                 i++;
1109                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1110                         goto nla_put_failure;
1111         }
1112         CMD(start_p2p_device, START_P2P_DEVICE);
1113         CMD(set_mcast_rate, SET_MCAST_RATE);
1114
1115 #ifdef CONFIG_NL80211_TESTMODE
1116         CMD(testmode_cmd, TESTMODE);
1117 #endif
1118
1119 #undef CMD
1120
1121         if (dev->ops->connect || dev->ops->auth) {
1122                 i++;
1123                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1124                         goto nla_put_failure;
1125         }
1126
1127         if (dev->ops->disconnect || dev->ops->deauth) {
1128                 i++;
1129                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1130                         goto nla_put_failure;
1131         }
1132
1133         nla_nest_end(msg, nl_cmds);
1134
1135         if (dev->ops->remain_on_channel &&
1136             (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1137             nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1138                         dev->wiphy.max_remain_on_channel_duration))
1139                 goto nla_put_failure;
1140
1141         if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1142             nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1143                 goto nla_put_failure;
1144
1145         if (mgmt_stypes) {
1146                 u16 stypes;
1147                 struct nlattr *nl_ftypes, *nl_ifs;
1148                 enum nl80211_iftype ift;
1149
1150                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1151                 if (!nl_ifs)
1152                         goto nla_put_failure;
1153
1154                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1155                         nl_ftypes = nla_nest_start(msg, ift);
1156                         if (!nl_ftypes)
1157                                 goto nla_put_failure;
1158                         i = 0;
1159                         stypes = mgmt_stypes[ift].tx;
1160                         while (stypes) {
1161                                 if ((stypes & 1) &&
1162                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1163                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1164                                         goto nla_put_failure;
1165                                 stypes >>= 1;
1166                                 i++;
1167                         }
1168                         nla_nest_end(msg, nl_ftypes);
1169                 }
1170
1171                 nla_nest_end(msg, nl_ifs);
1172
1173                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1174                 if (!nl_ifs)
1175                         goto nla_put_failure;
1176
1177                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1178                         nl_ftypes = nla_nest_start(msg, ift);
1179                         if (!nl_ftypes)
1180                                 goto nla_put_failure;
1181                         i = 0;
1182                         stypes = mgmt_stypes[ift].rx;
1183                         while (stypes) {
1184                                 if ((stypes & 1) &&
1185                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1186                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1187                                         goto nla_put_failure;
1188                                 stypes >>= 1;
1189                                 i++;
1190                         }
1191                         nla_nest_end(msg, nl_ftypes);
1192                 }
1193                 nla_nest_end(msg, nl_ifs);
1194         }
1195
1196 #ifdef CONFIG_PM
1197         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
1198                 struct nlattr *nl_wowlan;
1199
1200                 nl_wowlan = nla_nest_start(msg,
1201                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1202                 if (!nl_wowlan)
1203                         goto nla_put_failure;
1204
1205                 if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1206                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1207                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1208                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1209                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1210                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1211                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1212                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1213                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1214                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1215                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1216                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1217                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1218                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1219                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1220                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1221                     goto nla_put_failure;
1222                 if (dev->wiphy.wowlan.n_patterns) {
1223                         struct nl80211_wowlan_pattern_support pat = {
1224                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
1225                                 .min_pattern_len =
1226                                         dev->wiphy.wowlan.pattern_min_len,
1227                                 .max_pattern_len =
1228                                         dev->wiphy.wowlan.pattern_max_len,
1229                         };
1230                         if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1231                                     sizeof(pat), &pat))
1232                                 goto nla_put_failure;
1233                 }
1234
1235                 nla_nest_end(msg, nl_wowlan);
1236         }
1237 #endif
1238
1239         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1240                                 dev->wiphy.software_iftypes))
1241                 goto nla_put_failure;
1242
1243         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1244                 goto nla_put_failure;
1245
1246         if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1247             nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1248                         dev->wiphy.ap_sme_capa))
1249                 goto nla_put_failure;
1250
1251         if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
1252                         dev->wiphy.features))
1253                 goto nla_put_failure;
1254
1255         if (dev->wiphy.ht_capa_mod_mask &&
1256             nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1257                     sizeof(*dev->wiphy.ht_capa_mod_mask),
1258                     dev->wiphy.ht_capa_mod_mask))
1259                 goto nla_put_failure;
1260
1261         return genlmsg_end(msg, hdr);
1262
1263  nla_put_failure:
1264         genlmsg_cancel(msg, hdr);
1265         return -EMSGSIZE;
1266 }
1267
1268 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1269 {
1270         int idx = 0;
1271         int start = cb->args[0];
1272         struct cfg80211_registered_device *dev;
1273
1274         mutex_lock(&cfg80211_mutex);
1275         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1276                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1277                         continue;
1278                 if (++idx <= start)
1279                         continue;
1280                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).portid,
1281                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1282                                        dev) < 0) {
1283                         idx--;
1284                         break;
1285                 }
1286         }
1287         mutex_unlock(&cfg80211_mutex);
1288
1289         cb->args[0] = idx;
1290
1291         return skb->len;
1292 }
1293
1294 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1295 {
1296         struct sk_buff *msg;
1297         struct cfg80211_registered_device *dev = info->user_ptr[0];
1298
1299         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1300         if (!msg)
1301                 return -ENOMEM;
1302
1303         if (nl80211_send_wiphy(msg, info->snd_portid, info->snd_seq, 0, dev) < 0) {
1304                 nlmsg_free(msg);
1305                 return -ENOBUFS;
1306         }
1307
1308         return genlmsg_reply(msg, info);
1309 }
1310
1311 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1312         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1313         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1314         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1315         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1316         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1317 };
1318
1319 static int parse_txq_params(struct nlattr *tb[],
1320                             struct ieee80211_txq_params *txq_params)
1321 {
1322         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1323             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1324             !tb[NL80211_TXQ_ATTR_AIFS])
1325                 return -EINVAL;
1326
1327         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1328         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1329         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1330         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1331         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1332
1333         if (txq_params->ac >= NL80211_NUM_ACS)
1334                 return -EINVAL;
1335
1336         return 0;
1337 }
1338
1339 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1340 {
1341         /*
1342          * You can only set the channel explicitly for WDS interfaces,
1343          * all others have their channel managed via their respective
1344          * "establish a connection" command (connect, join, ...)
1345          *
1346          * For AP/GO and mesh mode, the channel can be set with the
1347          * channel userspace API, but is only stored and passed to the
1348          * low-level driver when the AP starts or the mesh is joined.
1349          * This is for backward compatibility, userspace can also give
1350          * the channel in the start-ap or join-mesh commands instead.
1351          *
1352          * Monitors are special as they are normally slaved to
1353          * whatever else is going on, so they have their own special
1354          * operation to set the monitor channel if possible.
1355          */
1356         return !wdev ||
1357                 wdev->iftype == NL80211_IFTYPE_AP ||
1358                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1359                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1360                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1361 }
1362
1363 static bool nl80211_valid_channel_type(struct genl_info *info,
1364                                        enum nl80211_channel_type *channel_type)
1365 {
1366         enum nl80211_channel_type tmp;
1367
1368         if (!info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1369                 return false;
1370
1371         tmp = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1372         if (tmp != NL80211_CHAN_NO_HT &&
1373             tmp != NL80211_CHAN_HT20 &&
1374             tmp != NL80211_CHAN_HT40PLUS &&
1375             tmp != NL80211_CHAN_HT40MINUS)
1376                 return false;
1377
1378         if (channel_type)
1379                 *channel_type = tmp;
1380
1381         return true;
1382 }
1383
1384 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1385                                  struct genl_info *info,
1386                                  struct cfg80211_chan_def *chandef)
1387 {
1388         struct ieee80211_sta_ht_cap *ht_cap;
1389         struct ieee80211_channel *sc;
1390         u32 control_freq;
1391         int offs;
1392
1393         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1394                 return -EINVAL;
1395
1396         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1397
1398         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1399         chandef->_type = NL80211_CHAN_NO_HT;
1400
1401         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
1402             !nl80211_valid_channel_type(info, &chandef->_type))
1403                 return -EINVAL;
1404
1405         /* Primary channel not allowed */
1406         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1407                 return -EINVAL;
1408
1409         ht_cap = &rdev->wiphy.bands[chandef->chan->band]->ht_cap;
1410
1411         switch (chandef->_type) {
1412         case NL80211_CHAN_NO_HT:
1413                 break;
1414         case NL80211_CHAN_HT40MINUS:
1415                 if (chandef->chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
1416                         return -EINVAL;
1417                 offs = -20;
1418                 /* fall through */
1419         case NL80211_CHAN_HT40PLUS:
1420                 if (chandef->_type == NL80211_CHAN_HT40PLUS) {
1421                         if (chandef->chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
1422                                 return -EINVAL;
1423                         offs = 20;
1424                 }
1425                 if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
1426                     ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT)
1427                         return -EINVAL;
1428
1429                 sc = ieee80211_get_channel(&rdev->wiphy,
1430                                            chandef->chan->center_freq + offs);
1431                 if (!sc || sc->flags & IEEE80211_CHAN_DISABLED)
1432                         return -EINVAL;
1433                 /* fall through */
1434         case NL80211_CHAN_HT20:
1435                 if (!ht_cap->ht_supported)
1436                         return -EINVAL;
1437                 break;
1438         }
1439
1440         return 0;
1441 }
1442
1443 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1444                                  struct wireless_dev *wdev,
1445                                  struct genl_info *info)
1446 {
1447         struct cfg80211_chan_def chandef;
1448         int result;
1449         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1450
1451         if (wdev)
1452                 iftype = wdev->iftype;
1453
1454         if (!nl80211_can_set_dev_channel(wdev))
1455                 return -EOPNOTSUPP;
1456
1457         result = nl80211_parse_chandef(rdev, info, &chandef);
1458         if (result)
1459                 return result;
1460
1461         mutex_lock(&rdev->devlist_mtx);
1462         switch (iftype) {
1463         case NL80211_IFTYPE_AP:
1464         case NL80211_IFTYPE_P2P_GO:
1465                 if (wdev->beacon_interval) {
1466                         result = -EBUSY;
1467                         break;
1468                 }
1469                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1470                         result = -EINVAL;
1471                         break;
1472                 }
1473                 wdev->preset_chandef = chandef;
1474                 result = 0;
1475                 break;
1476         case NL80211_IFTYPE_MESH_POINT:
1477                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1478                 break;
1479         case NL80211_IFTYPE_MONITOR:
1480                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1481                 break;
1482         default:
1483                 result = -EINVAL;
1484         }
1485         mutex_unlock(&rdev->devlist_mtx);
1486
1487         return result;
1488 }
1489
1490 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1491 {
1492         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1493         struct net_device *netdev = info->user_ptr[1];
1494
1495         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1496 }
1497
1498 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1499 {
1500         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1501         struct net_device *dev = info->user_ptr[1];
1502         struct wireless_dev *wdev = dev->ieee80211_ptr;
1503         const u8 *bssid;
1504
1505         if (!info->attrs[NL80211_ATTR_MAC])
1506                 return -EINVAL;
1507
1508         if (netif_running(dev))
1509                 return -EBUSY;
1510
1511         if (!rdev->ops->set_wds_peer)
1512                 return -EOPNOTSUPP;
1513
1514         if (wdev->iftype != NL80211_IFTYPE_WDS)
1515                 return -EOPNOTSUPP;
1516
1517         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1518         return rdev_set_wds_peer(rdev, dev, bssid);
1519 }
1520
1521
1522 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1523 {
1524         struct cfg80211_registered_device *rdev;
1525         struct net_device *netdev = NULL;
1526         struct wireless_dev *wdev;
1527         int result = 0, rem_txq_params = 0;
1528         struct nlattr *nl_txq_params;
1529         u32 changed;
1530         u8 retry_short = 0, retry_long = 0;
1531         u32 frag_threshold = 0, rts_threshold = 0;
1532         u8 coverage_class = 0;
1533
1534         /*
1535          * Try to find the wiphy and netdev. Normally this
1536          * function shouldn't need the netdev, but this is
1537          * done for backward compatibility -- previously
1538          * setting the channel was done per wiphy, but now
1539          * it is per netdev. Previous userland like hostapd
1540          * also passed a netdev to set_wiphy, so that it is
1541          * possible to let that go to the right netdev!
1542          */
1543         mutex_lock(&cfg80211_mutex);
1544
1545         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1546                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1547
1548                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1549                 if (netdev && netdev->ieee80211_ptr) {
1550                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1551                         mutex_lock(&rdev->mtx);
1552                 } else
1553                         netdev = NULL;
1554         }
1555
1556         if (!netdev) {
1557                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1558                                                   info->attrs);
1559                 if (IS_ERR(rdev)) {
1560                         mutex_unlock(&cfg80211_mutex);
1561                         return PTR_ERR(rdev);
1562                 }
1563                 wdev = NULL;
1564                 netdev = NULL;
1565                 result = 0;
1566
1567                 mutex_lock(&rdev->mtx);
1568         } else
1569                 wdev = netdev->ieee80211_ptr;
1570
1571         /*
1572          * end workaround code, by now the rdev is available
1573          * and locked, and wdev may or may not be NULL.
1574          */
1575
1576         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1577                 result = cfg80211_dev_rename(
1578                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1579
1580         mutex_unlock(&cfg80211_mutex);
1581
1582         if (result)
1583                 goto bad_res;
1584
1585         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1586                 struct ieee80211_txq_params txq_params;
1587                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1588
1589                 if (!rdev->ops->set_txq_params) {
1590                         result = -EOPNOTSUPP;
1591                         goto bad_res;
1592                 }
1593
1594                 if (!netdev) {
1595                         result = -EINVAL;
1596                         goto bad_res;
1597                 }
1598
1599                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1600                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1601                         result = -EINVAL;
1602                         goto bad_res;
1603                 }
1604
1605                 if (!netif_running(netdev)) {
1606                         result = -ENETDOWN;
1607                         goto bad_res;
1608                 }
1609
1610                 nla_for_each_nested(nl_txq_params,
1611                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1612                                     rem_txq_params) {
1613                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1614                                   nla_data(nl_txq_params),
1615                                   nla_len(nl_txq_params),
1616                                   txq_params_policy);
1617                         result = parse_txq_params(tb, &txq_params);
1618                         if (result)
1619                                 goto bad_res;
1620
1621                         result = rdev_set_txq_params(rdev, netdev,
1622                                                      &txq_params);
1623                         if (result)
1624                                 goto bad_res;
1625                 }
1626         }
1627
1628         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1629                 result = __nl80211_set_channel(rdev,
1630                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1631                                 info);
1632                 if (result)
1633                         goto bad_res;
1634         }
1635
1636         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1637                 struct wireless_dev *txp_wdev = wdev;
1638                 enum nl80211_tx_power_setting type;
1639                 int idx, mbm = 0;
1640
1641                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1642                         txp_wdev = NULL;
1643
1644                 if (!rdev->ops->set_tx_power) {
1645                         result = -EOPNOTSUPP;
1646                         goto bad_res;
1647                 }
1648
1649                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1650                 type = nla_get_u32(info->attrs[idx]);
1651
1652                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1653                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1654                         result = -EINVAL;
1655                         goto bad_res;
1656                 }
1657
1658                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1659                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1660                         mbm = nla_get_u32(info->attrs[idx]);
1661                 }
1662
1663                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1664                 if (result)
1665                         goto bad_res;
1666         }
1667
1668         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1669             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1670                 u32 tx_ant, rx_ant;
1671                 if ((!rdev->wiphy.available_antennas_tx &&
1672                      !rdev->wiphy.available_antennas_rx) ||
1673                     !rdev->ops->set_antenna) {
1674                         result = -EOPNOTSUPP;
1675                         goto bad_res;
1676                 }
1677
1678                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1679                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1680
1681                 /* reject antenna configurations which don't match the
1682                  * available antenna masks, except for the "all" mask */
1683                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1684                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1685                         result = -EINVAL;
1686                         goto bad_res;
1687                 }
1688
1689                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1690                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1691
1692                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
1693                 if (result)
1694                         goto bad_res;
1695         }
1696
1697         changed = 0;
1698
1699         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1700                 retry_short = nla_get_u8(
1701                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1702                 if (retry_short == 0) {
1703                         result = -EINVAL;
1704                         goto bad_res;
1705                 }
1706                 changed |= WIPHY_PARAM_RETRY_SHORT;
1707         }
1708
1709         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1710                 retry_long = nla_get_u8(
1711                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1712                 if (retry_long == 0) {
1713                         result = -EINVAL;
1714                         goto bad_res;
1715                 }
1716                 changed |= WIPHY_PARAM_RETRY_LONG;
1717         }
1718
1719         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1720                 frag_threshold = nla_get_u32(
1721                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1722                 if (frag_threshold < 256) {
1723                         result = -EINVAL;
1724                         goto bad_res;
1725                 }
1726                 if (frag_threshold != (u32) -1) {
1727                         /*
1728                          * Fragments (apart from the last one) are required to
1729                          * have even length. Make the fragmentation code
1730                          * simpler by stripping LSB should someone try to use
1731                          * odd threshold value.
1732                          */
1733                         frag_threshold &= ~0x1;
1734                 }
1735                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1736         }
1737
1738         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1739                 rts_threshold = nla_get_u32(
1740                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1741                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1742         }
1743
1744         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1745                 coverage_class = nla_get_u8(
1746                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1747                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1748         }
1749
1750         if (changed) {
1751                 u8 old_retry_short, old_retry_long;
1752                 u32 old_frag_threshold, old_rts_threshold;
1753                 u8 old_coverage_class;
1754
1755                 if (!rdev->ops->set_wiphy_params) {
1756                         result = -EOPNOTSUPP;
1757                         goto bad_res;
1758                 }
1759
1760                 old_retry_short = rdev->wiphy.retry_short;
1761                 old_retry_long = rdev->wiphy.retry_long;
1762                 old_frag_threshold = rdev->wiphy.frag_threshold;
1763                 old_rts_threshold = rdev->wiphy.rts_threshold;
1764                 old_coverage_class = rdev->wiphy.coverage_class;
1765
1766                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1767                         rdev->wiphy.retry_short = retry_short;
1768                 if (changed & WIPHY_PARAM_RETRY_LONG)
1769                         rdev->wiphy.retry_long = retry_long;
1770                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1771                         rdev->wiphy.frag_threshold = frag_threshold;
1772                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1773                         rdev->wiphy.rts_threshold = rts_threshold;
1774                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1775                         rdev->wiphy.coverage_class = coverage_class;
1776
1777                 result = rdev_set_wiphy_params(rdev, changed);
1778                 if (result) {
1779                         rdev->wiphy.retry_short = old_retry_short;
1780                         rdev->wiphy.retry_long = old_retry_long;
1781                         rdev->wiphy.frag_threshold = old_frag_threshold;
1782                         rdev->wiphy.rts_threshold = old_rts_threshold;
1783                         rdev->wiphy.coverage_class = old_coverage_class;
1784                 }
1785         }
1786
1787  bad_res:
1788         mutex_unlock(&rdev->mtx);
1789         if (netdev)
1790                 dev_put(netdev);
1791         return result;
1792 }
1793
1794 static inline u64 wdev_id(struct wireless_dev *wdev)
1795 {
1796         return (u64)wdev->identifier |
1797                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
1798 }
1799
1800 static int nl80211_send_chandef(struct sk_buff *msg,
1801                                  struct cfg80211_chan_def *chandef)
1802 {
1803         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
1804                         chandef->chan->center_freq))
1805                 return -ENOBUFS;
1806         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, chandef->_type))
1807                 return -ENOBUFS;
1808         return 0;
1809 }
1810
1811 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
1812                               struct cfg80211_registered_device *rdev,
1813                               struct wireless_dev *wdev)
1814 {
1815         struct net_device *dev = wdev->netdev;
1816         void *hdr;
1817
1818         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1819         if (!hdr)
1820                 return -1;
1821
1822         if (dev &&
1823             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
1824              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
1825                 goto nla_put_failure;
1826
1827         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1828             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
1829             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
1830             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
1831             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1832                         rdev->devlist_generation ^
1833                         (cfg80211_rdev_list_generation << 2)))
1834                 goto nla_put_failure;
1835
1836         if (rdev->ops->get_channel) {
1837                 int ret;
1838                 struct cfg80211_chan_def chandef;
1839
1840                 ret = rdev_get_channel(rdev, wdev, &chandef);
1841                 if (ret == 0) {
1842                         if (nl80211_send_chandef(msg, &chandef))
1843                                 goto nla_put_failure;
1844                 }
1845         }
1846
1847         if (wdev->ssid_len) {
1848                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
1849                         goto nla_put_failure;
1850         }
1851
1852         return genlmsg_end(msg, hdr);
1853
1854  nla_put_failure:
1855         genlmsg_cancel(msg, hdr);
1856         return -EMSGSIZE;
1857 }
1858
1859 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1860 {
1861         int wp_idx = 0;
1862         int if_idx = 0;
1863         int wp_start = cb->args[0];
1864         int if_start = cb->args[1];
1865         struct cfg80211_registered_device *rdev;
1866         struct wireless_dev *wdev;
1867
1868         mutex_lock(&cfg80211_mutex);
1869         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1870                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1871                         continue;
1872                 if (wp_idx < wp_start) {
1873                         wp_idx++;
1874                         continue;
1875                 }
1876                 if_idx = 0;
1877
1878                 mutex_lock(&rdev->devlist_mtx);
1879                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
1880                         if (if_idx < if_start) {
1881                                 if_idx++;
1882                                 continue;
1883                         }
1884                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
1885                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1886                                                rdev, wdev) < 0) {
1887                                 mutex_unlock(&rdev->devlist_mtx);
1888                                 goto out;
1889                         }
1890                         if_idx++;
1891                 }
1892                 mutex_unlock(&rdev->devlist_mtx);
1893
1894                 wp_idx++;
1895         }
1896  out:
1897         mutex_unlock(&cfg80211_mutex);
1898
1899         cb->args[0] = wp_idx;
1900         cb->args[1] = if_idx;
1901
1902         return skb->len;
1903 }
1904
1905 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1906 {
1907         struct sk_buff *msg;
1908         struct cfg80211_registered_device *dev = info->user_ptr[0];
1909         struct wireless_dev *wdev = info->user_ptr[1];
1910
1911         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1912         if (!msg)
1913                 return -ENOMEM;
1914
1915         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
1916                                dev, wdev) < 0) {
1917                 nlmsg_free(msg);
1918                 return -ENOBUFS;
1919         }
1920
1921         return genlmsg_reply(msg, info);
1922 }
1923
1924 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1925         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1926         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1927         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1928         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1929         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1930 };
1931
1932 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1933 {
1934         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1935         int flag;
1936
1937         *mntrflags = 0;
1938
1939         if (!nla)
1940                 return -EINVAL;
1941
1942         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1943                              nla, mntr_flags_policy))
1944                 return -EINVAL;
1945
1946         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1947                 if (flags[flag])
1948                         *mntrflags |= (1<<flag);
1949
1950         return 0;
1951 }
1952
1953 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1954                                struct net_device *netdev, u8 use_4addr,
1955                                enum nl80211_iftype iftype)
1956 {
1957         if (!use_4addr) {
1958                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1959                         return -EBUSY;
1960                 return 0;
1961         }
1962
1963         switch (iftype) {
1964         case NL80211_IFTYPE_AP_VLAN:
1965                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1966                         return 0;
1967                 break;
1968         case NL80211_IFTYPE_STATION:
1969                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1970                         return 0;
1971                 break;
1972         default:
1973                 break;
1974         }
1975
1976         return -EOPNOTSUPP;
1977 }
1978
1979 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1980 {
1981         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1982         struct vif_params params;
1983         int err;
1984         enum nl80211_iftype otype, ntype;
1985         struct net_device *dev = info->user_ptr[1];
1986         u32 _flags, *flags = NULL;
1987         bool change = false;
1988
1989         memset(&params, 0, sizeof(params));
1990
1991         otype = ntype = dev->ieee80211_ptr->iftype;
1992
1993         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1994                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1995                 if (otype != ntype)
1996                         change = true;
1997                 if (ntype > NL80211_IFTYPE_MAX)
1998                         return -EINVAL;
1999         }
2000
2001         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2002                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2003
2004                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2005                         return -EINVAL;
2006                 if (netif_running(dev))
2007                         return -EBUSY;
2008
2009                 wdev_lock(wdev);
2010                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2011                              IEEE80211_MAX_MESH_ID_LEN);
2012                 wdev->mesh_id_up_len =
2013                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2014                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2015                        wdev->mesh_id_up_len);
2016                 wdev_unlock(wdev);
2017         }
2018
2019         if (info->attrs[NL80211_ATTR_4ADDR]) {
2020                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2021                 change = true;
2022                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2023                 if (err)
2024                         return err;
2025         } else {
2026                 params.use_4addr = -1;
2027         }
2028
2029         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2030                 if (ntype != NL80211_IFTYPE_MONITOR)
2031                         return -EINVAL;
2032                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2033                                           &_flags);
2034                 if (err)
2035                         return err;
2036
2037                 flags = &_flags;
2038                 change = true;
2039         }
2040
2041         if (change)
2042                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2043         else
2044                 err = 0;
2045
2046         if (!err && params.use_4addr != -1)
2047                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2048
2049         return err;
2050 }
2051
2052 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2053 {
2054         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2055         struct vif_params params;
2056         struct wireless_dev *wdev;
2057         struct sk_buff *msg;
2058         int err;
2059         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2060         u32 flags;
2061
2062         memset(&params, 0, sizeof(params));
2063
2064         if (!info->attrs[NL80211_ATTR_IFNAME])
2065                 return -EINVAL;
2066
2067         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2068                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2069                 if (type > NL80211_IFTYPE_MAX)
2070                         return -EINVAL;
2071         }
2072
2073         if (!rdev->ops->add_virtual_intf ||
2074             !(rdev->wiphy.interface_modes & (1 << type)))
2075                 return -EOPNOTSUPP;
2076
2077         if (info->attrs[NL80211_ATTR_4ADDR]) {
2078                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2079                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2080                 if (err)
2081                         return err;
2082         }
2083
2084         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2085         if (!msg)
2086                 return -ENOMEM;
2087
2088         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2089                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2090                                   &flags);
2091         wdev = rdev_add_virtual_intf(rdev,
2092                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2093                                 type, err ? NULL : &flags, &params);
2094         if (IS_ERR(wdev)) {
2095                 nlmsg_free(msg);
2096                 return PTR_ERR(wdev);
2097         }
2098
2099         switch (type) {
2100         case NL80211_IFTYPE_MESH_POINT:
2101                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2102                         break;
2103                 wdev_lock(wdev);
2104                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2105                              IEEE80211_MAX_MESH_ID_LEN);
2106                 wdev->mesh_id_up_len =
2107                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2108                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2109                        wdev->mesh_id_up_len);
2110                 wdev_unlock(wdev);
2111                 break;
2112         case NL80211_IFTYPE_P2P_DEVICE:
2113                 /*
2114                  * P2P Device doesn't have a netdev, so doesn't go
2115                  * through the netdev notifier and must be added here
2116                  */
2117                 mutex_init(&wdev->mtx);
2118                 INIT_LIST_HEAD(&wdev->event_list);
2119                 spin_lock_init(&wdev->event_lock);
2120                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2121                 spin_lock_init(&wdev->mgmt_registrations_lock);
2122
2123                 mutex_lock(&rdev->devlist_mtx);
2124                 wdev->identifier = ++rdev->wdev_id;
2125                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2126                 rdev->devlist_generation++;
2127                 mutex_unlock(&rdev->devlist_mtx);
2128                 break;
2129         default:
2130                 break;
2131         }
2132
2133         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2134                                rdev, wdev) < 0) {
2135                 nlmsg_free(msg);
2136                 return -ENOBUFS;
2137         }
2138
2139         return genlmsg_reply(msg, info);
2140 }
2141
2142 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2143 {
2144         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2145         struct wireless_dev *wdev = info->user_ptr[1];
2146
2147         if (!rdev->ops->del_virtual_intf)
2148                 return -EOPNOTSUPP;
2149
2150         /*
2151          * If we remove a wireless device without a netdev then clear
2152          * user_ptr[1] so that nl80211_post_doit won't dereference it
2153          * to check if it needs to do dev_put(). Otherwise it crashes
2154          * since the wdev has been freed, unlike with a netdev where
2155          * we need the dev_put() for the netdev to really be freed.
2156          */
2157         if (!wdev->netdev)
2158                 info->user_ptr[1] = NULL;
2159
2160         return rdev_del_virtual_intf(rdev, wdev);
2161 }
2162
2163 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2164 {
2165         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2166         struct net_device *dev = info->user_ptr[1];
2167         u16 noack_map;
2168
2169         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2170                 return -EINVAL;
2171
2172         if (!rdev->ops->set_noack_map)
2173                 return -EOPNOTSUPP;
2174
2175         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2176
2177         return rdev_set_noack_map(rdev, dev, noack_map);
2178 }
2179
2180 struct get_key_cookie {
2181         struct sk_buff *msg;
2182         int error;
2183         int idx;
2184 };
2185
2186 static void get_key_callback(void *c, struct key_params *params)
2187 {
2188         struct nlattr *key;
2189         struct get_key_cookie *cookie = c;
2190
2191         if ((params->key &&
2192              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2193                      params->key_len, params->key)) ||
2194             (params->seq &&
2195              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2196                      params->seq_len, params->seq)) ||
2197             (params->cipher &&
2198              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2199                          params->cipher)))
2200                 goto nla_put_failure;
2201
2202         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2203         if (!key)
2204                 goto nla_put_failure;
2205
2206         if ((params->key &&
2207              nla_put(cookie->msg, NL80211_KEY_DATA,
2208                      params->key_len, params->key)) ||
2209             (params->seq &&
2210              nla_put(cookie->msg, NL80211_KEY_SEQ,
2211                      params->seq_len, params->seq)) ||
2212             (params->cipher &&
2213              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2214                          params->cipher)))
2215                 goto nla_put_failure;
2216
2217         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2218                 goto nla_put_failure;
2219
2220         nla_nest_end(cookie->msg, key);
2221
2222         return;
2223  nla_put_failure:
2224         cookie->error = 1;
2225 }
2226
2227 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2228 {
2229         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2230         int err;
2231         struct net_device *dev = info->user_ptr[1];
2232         u8 key_idx = 0;
2233         const u8 *mac_addr = NULL;
2234         bool pairwise;
2235         struct get_key_cookie cookie = {
2236                 .error = 0,
2237         };
2238         void *hdr;
2239         struct sk_buff *msg;
2240
2241         if (info->attrs[NL80211_ATTR_KEY_IDX])
2242                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2243
2244         if (key_idx > 5)
2245                 return -EINVAL;
2246
2247         if (info->attrs[NL80211_ATTR_MAC])
2248                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2249
2250         pairwise = !!mac_addr;
2251         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2252                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2253                 if (kt >= NUM_NL80211_KEYTYPES)
2254                         return -EINVAL;
2255                 if (kt != NL80211_KEYTYPE_GROUP &&
2256                     kt != NL80211_KEYTYPE_PAIRWISE)
2257                         return -EINVAL;
2258                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2259         }
2260
2261         if (!rdev->ops->get_key)
2262                 return -EOPNOTSUPP;
2263
2264         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2265         if (!msg)
2266                 return -ENOMEM;
2267
2268         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2269                              NL80211_CMD_NEW_KEY);
2270         if (IS_ERR(hdr))
2271                 return PTR_ERR(hdr);
2272
2273         cookie.msg = msg;
2274         cookie.idx = key_idx;
2275
2276         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2277             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2278                 goto nla_put_failure;
2279         if (mac_addr &&
2280             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2281                 goto nla_put_failure;
2282
2283         if (pairwise && mac_addr &&
2284             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2285                 return -ENOENT;
2286
2287         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2288                            get_key_callback);
2289
2290         if (err)
2291                 goto free_msg;
2292
2293         if (cookie.error)
2294                 goto nla_put_failure;
2295
2296         genlmsg_end(msg, hdr);
2297         return genlmsg_reply(msg, info);
2298
2299  nla_put_failure:
2300         err = -ENOBUFS;
2301  free_msg:
2302         nlmsg_free(msg);
2303         return err;
2304 }
2305
2306 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2307 {
2308         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2309         struct key_parse key;
2310         int err;
2311         struct net_device *dev = info->user_ptr[1];
2312
2313         err = nl80211_parse_key(info, &key);
2314         if (err)
2315                 return err;
2316
2317         if (key.idx < 0)
2318                 return -EINVAL;
2319
2320         /* only support setting default key */
2321         if (!key.def && !key.defmgmt)
2322                 return -EINVAL;
2323
2324         wdev_lock(dev->ieee80211_ptr);
2325
2326         if (key.def) {
2327                 if (!rdev->ops->set_default_key) {
2328                         err = -EOPNOTSUPP;
2329                         goto out;
2330                 }
2331
2332                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2333                 if (err)
2334                         goto out;
2335
2336                 err = rdev_set_default_key(rdev, dev, key.idx,
2337                                                  key.def_uni, key.def_multi);
2338
2339                 if (err)
2340                         goto out;
2341
2342 #ifdef CONFIG_CFG80211_WEXT
2343                 dev->ieee80211_ptr->wext.default_key = key.idx;
2344 #endif
2345         } else {
2346                 if (key.def_uni || !key.def_multi) {
2347                         err = -EINVAL;
2348                         goto out;
2349                 }
2350
2351                 if (!rdev->ops->set_default_mgmt_key) {
2352                         err = -EOPNOTSUPP;
2353                         goto out;
2354                 }
2355
2356                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2357                 if (err)
2358                         goto out;
2359
2360                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2361                 if (err)
2362                         goto out;
2363
2364 #ifdef CONFIG_CFG80211_WEXT
2365                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2366 #endif
2367         }
2368
2369  out:
2370         wdev_unlock(dev->ieee80211_ptr);
2371
2372         return err;
2373 }
2374
2375 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2376 {
2377         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2378         int err;
2379         struct net_device *dev = info->user_ptr[1];
2380         struct key_parse key;
2381         const u8 *mac_addr = NULL;
2382
2383         err = nl80211_parse_key(info, &key);
2384         if (err)
2385                 return err;
2386
2387         if (!key.p.key)
2388                 return -EINVAL;
2389
2390         if (info->attrs[NL80211_ATTR_MAC])
2391                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2392
2393         if (key.type == -1) {
2394                 if (mac_addr)
2395                         key.type = NL80211_KEYTYPE_PAIRWISE;
2396                 else
2397                         key.type = NL80211_KEYTYPE_GROUP;
2398         }
2399
2400         /* for now */
2401         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2402             key.type != NL80211_KEYTYPE_GROUP)
2403                 return -EINVAL;
2404
2405         if (!rdev->ops->add_key)
2406                 return -EOPNOTSUPP;
2407
2408         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2409                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2410                                            mac_addr))
2411                 return -EINVAL;
2412
2413         wdev_lock(dev->ieee80211_ptr);
2414         err = nl80211_key_allowed(dev->ieee80211_ptr);
2415         if (!err)
2416                 err = rdev_add_key(rdev, dev, key.idx,
2417                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2418                                     mac_addr, &key.p);
2419         wdev_unlock(dev->ieee80211_ptr);
2420
2421         return err;
2422 }
2423
2424 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2425 {
2426         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2427         int err;
2428         struct net_device *dev = info->user_ptr[1];
2429         u8 *mac_addr = NULL;
2430         struct key_parse key;
2431
2432         err = nl80211_parse_key(info, &key);
2433         if (err)
2434                 return err;
2435
2436         if (info->attrs[NL80211_ATTR_MAC])
2437                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2438
2439         if (key.type == -1) {
2440                 if (mac_addr)
2441                         key.type = NL80211_KEYTYPE_PAIRWISE;
2442                 else
2443                         key.type = NL80211_KEYTYPE_GROUP;
2444         }
2445
2446         /* for now */
2447         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2448             key.type != NL80211_KEYTYPE_GROUP)
2449                 return -EINVAL;
2450
2451         if (!rdev->ops->del_key)
2452                 return -EOPNOTSUPP;
2453
2454         wdev_lock(dev->ieee80211_ptr);
2455         err = nl80211_key_allowed(dev->ieee80211_ptr);
2456
2457         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2458             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2459                 err = -ENOENT;
2460
2461         if (!err)
2462                 err = rdev_del_key(rdev, dev, key.idx,
2463                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2464                                    mac_addr);
2465
2466 #ifdef CONFIG_CFG80211_WEXT
2467         if (!err) {
2468                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2469                         dev->ieee80211_ptr->wext.default_key = -1;
2470                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2471                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2472         }
2473 #endif
2474         wdev_unlock(dev->ieee80211_ptr);
2475
2476         return err;
2477 }
2478
2479 static int nl80211_parse_beacon(struct genl_info *info,
2480                                 struct cfg80211_beacon_data *bcn)
2481 {
2482         bool haveinfo = false;
2483
2484         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2485             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2486             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2487             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2488                 return -EINVAL;
2489
2490         memset(bcn, 0, sizeof(*bcn));
2491
2492         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2493                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2494                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2495                 if (!bcn->head_len)
2496                         return -EINVAL;
2497                 haveinfo = true;
2498         }
2499
2500         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2501                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2502                 bcn->tail_len =
2503                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2504                 haveinfo = true;
2505         }
2506
2507         if (!haveinfo)
2508                 return -EINVAL;
2509
2510         if (info->attrs[NL80211_ATTR_IE]) {
2511                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2512                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2513         }
2514
2515         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2516                 bcn->proberesp_ies =
2517                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2518                 bcn->proberesp_ies_len =
2519                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2520         }
2521
2522         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2523                 bcn->assocresp_ies =
2524                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2525                 bcn->assocresp_ies_len =
2526                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2527         }
2528
2529         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2530                 bcn->probe_resp =
2531                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2532                 bcn->probe_resp_len =
2533                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2534         }
2535
2536         return 0;
2537 }
2538
2539 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2540                                    struct cfg80211_ap_settings *params)
2541 {
2542         struct wireless_dev *wdev;
2543         bool ret = false;
2544
2545         mutex_lock(&rdev->devlist_mtx);
2546
2547         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2548                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2549                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2550                         continue;
2551
2552                 if (!wdev->preset_chandef.chan)
2553                         continue;
2554
2555                 params->chandef = wdev->preset_chandef;
2556                 ret = true;
2557                 break;
2558         }
2559
2560         mutex_unlock(&rdev->devlist_mtx);
2561
2562         return ret;
2563 }
2564
2565 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
2566                                     enum nl80211_auth_type auth_type,
2567                                     enum nl80211_commands cmd)
2568 {
2569         if (auth_type > NL80211_AUTHTYPE_MAX)
2570                 return false;
2571
2572         switch (cmd) {
2573         case NL80211_CMD_AUTHENTICATE:
2574                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
2575                     auth_type == NL80211_AUTHTYPE_SAE)
2576                         return false;
2577                 return true;
2578         case NL80211_CMD_CONNECT:
2579         case NL80211_CMD_START_AP:
2580                 /* SAE not supported yet */
2581                 if (auth_type == NL80211_AUTHTYPE_SAE)
2582                         return false;
2583                 return true;
2584         default:
2585                 return false;
2586         }
2587 }
2588
2589 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2590 {
2591         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2592         struct net_device *dev = info->user_ptr[1];
2593         struct wireless_dev *wdev = dev->ieee80211_ptr;
2594         struct cfg80211_ap_settings params;
2595         int err;
2596
2597         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2598             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2599                 return -EOPNOTSUPP;
2600
2601         if (!rdev->ops->start_ap)
2602                 return -EOPNOTSUPP;
2603
2604         if (wdev->beacon_interval)
2605                 return -EALREADY;
2606
2607         memset(&params, 0, sizeof(params));
2608
2609         /* these are required for START_AP */
2610         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2611             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2612             !info->attrs[NL80211_ATTR_BEACON_HEAD])
2613                 return -EINVAL;
2614
2615         err = nl80211_parse_beacon(info, &params.beacon);
2616         if (err)
2617                 return err;
2618
2619         params.beacon_interval =
2620                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2621         params.dtim_period =
2622                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2623
2624         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
2625         if (err)
2626                 return err;
2627
2628         /*
2629          * In theory, some of these attributes should be required here
2630          * but since they were not used when the command was originally
2631          * added, keep them optional for old user space programs to let
2632          * them continue to work with drivers that do not need the
2633          * additional information -- drivers must check!
2634          */
2635         if (info->attrs[NL80211_ATTR_SSID]) {
2636                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2637                 params.ssid_len =
2638                         nla_len(info->attrs[NL80211_ATTR_SSID]);
2639                 if (params.ssid_len == 0 ||
2640                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
2641                         return -EINVAL;
2642         }
2643
2644         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2645                 params.hidden_ssid = nla_get_u32(
2646                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2647                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
2648                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
2649                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2650                         return -EINVAL;
2651         }
2652
2653         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2654
2655         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2656                 params.auth_type = nla_get_u32(
2657                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
2658                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
2659                                              NL80211_CMD_START_AP))
2660                         return -EINVAL;
2661         } else
2662                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2663
2664         err = nl80211_crypto_settings(rdev, info, &params.crypto,
2665                                       NL80211_MAX_NR_CIPHER_SUITES);
2666         if (err)
2667                 return err;
2668
2669         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
2670                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
2671                         return -EOPNOTSUPP;
2672                 params.inactivity_timeout = nla_get_u16(
2673                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
2674         }
2675
2676         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2677                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
2678                 if (err)
2679                         return err;
2680         } else if (wdev->preset_chandef.chan) {
2681                 params.chandef = wdev->preset_chandef;
2682         } else if (!nl80211_get_ap_channel(rdev, &params))
2683                 return -EINVAL;
2684
2685         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
2686                 return -EINVAL;
2687
2688         mutex_lock(&rdev->devlist_mtx);
2689         err = cfg80211_can_use_chan(rdev, wdev, params.chandef.chan,
2690                                     CHAN_MODE_SHARED);
2691         mutex_unlock(&rdev->devlist_mtx);
2692
2693         if (err)
2694                 return err;
2695
2696         err = rdev_start_ap(rdev, dev, &params);
2697         if (!err) {
2698                 wdev->preset_chandef = params.chandef;
2699                 wdev->beacon_interval = params.beacon_interval;
2700                 wdev->channel = params.chandef.chan;
2701                 wdev->ssid_len = params.ssid_len;
2702                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
2703         }
2704         return err;
2705 }
2706
2707 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
2708 {
2709         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2710         struct net_device *dev = info->user_ptr[1];
2711         struct wireless_dev *wdev = dev->ieee80211_ptr;
2712         struct cfg80211_beacon_data params;
2713         int err;
2714
2715         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2716             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2717                 return -EOPNOTSUPP;
2718
2719         if (!rdev->ops->change_beacon)
2720                 return -EOPNOTSUPP;
2721
2722         if (!wdev->beacon_interval)
2723                 return -EINVAL;
2724
2725         err = nl80211_parse_beacon(info, &params);
2726         if (err)
2727                 return err;
2728
2729         return rdev_change_beacon(rdev, dev, &params);
2730 }
2731
2732 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
2733 {
2734         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2735         struct net_device *dev = info->user_ptr[1];
2736
2737         return cfg80211_stop_ap(rdev, dev);
2738 }
2739
2740 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2741         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2742         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2743         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2744         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2745         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2746         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2747 };
2748
2749 static int parse_station_flags(struct genl_info *info,
2750                                enum nl80211_iftype iftype,
2751                                struct station_parameters *params)
2752 {
2753         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2754         struct nlattr *nla;
2755         int flag;
2756
2757         /*
2758          * Try parsing the new attribute first so userspace
2759          * can specify both for older kernels.
2760          */
2761         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2762         if (nla) {
2763                 struct nl80211_sta_flag_update *sta_flags;
2764
2765                 sta_flags = nla_data(nla);
2766                 params->sta_flags_mask = sta_flags->mask;
2767                 params->sta_flags_set = sta_flags->set;
2768                 if ((params->sta_flags_mask |
2769                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2770                         return -EINVAL;
2771                 return 0;
2772         }
2773
2774         /* if present, parse the old attribute */
2775
2776         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2777         if (!nla)
2778                 return 0;
2779
2780         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2781                              nla, sta_flags_policy))
2782                 return -EINVAL;
2783
2784         /*
2785          * Only allow certain flags for interface types so that
2786          * other attributes are silently ignored. Remember that
2787          * this is backward compatibility code with old userspace
2788          * and shouldn't be hit in other cases anyway.
2789          */
2790         switch (iftype) {
2791         case NL80211_IFTYPE_AP:
2792         case NL80211_IFTYPE_AP_VLAN:
2793         case NL80211_IFTYPE_P2P_GO:
2794                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2795                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2796                                          BIT(NL80211_STA_FLAG_WME) |
2797                                          BIT(NL80211_STA_FLAG_MFP);
2798                 break;
2799         case NL80211_IFTYPE_P2P_CLIENT:
2800         case NL80211_IFTYPE_STATION:
2801                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2802                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
2803                 break;
2804         case NL80211_IFTYPE_MESH_POINT:
2805                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2806                                          BIT(NL80211_STA_FLAG_MFP) |
2807                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
2808         default:
2809                 return -EINVAL;
2810         }
2811
2812         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
2813                 if (flags[flag]) {
2814                         params->sta_flags_set |= (1<<flag);
2815
2816                         /* no longer support new API additions in old API */
2817                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
2818                                 return -EINVAL;
2819                 }
2820         }
2821
2822         return 0;
2823 }
2824
2825 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2826                                  int attr)
2827 {
2828         struct nlattr *rate;
2829         u32 bitrate;
2830         u16 bitrate_compat;
2831
2832         rate = nla_nest_start(msg, attr);
2833         if (!rate)
2834                 goto nla_put_failure;
2835
2836         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2837         bitrate = cfg80211_calculate_bitrate(info);
2838         /* report 16-bit bitrate only if we can */
2839         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
2840         if ((bitrate > 0 &&
2841              nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) ||
2842             (bitrate_compat > 0 &&
2843              nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) ||
2844             ((info->flags & RATE_INFO_FLAGS_MCS) &&
2845              nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) ||
2846             ((info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) &&
2847              nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH)) ||
2848             ((info->flags & RATE_INFO_FLAGS_SHORT_GI) &&
2849              nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)))
2850                 goto nla_put_failure;
2851
2852         nla_nest_end(msg, rate);
2853         return true;
2854
2855 nla_put_failure:
2856         return false;
2857 }
2858
2859 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
2860                                 int flags,
2861                                 struct cfg80211_registered_device *rdev,
2862                                 struct net_device *dev,
2863                                 const u8 *mac_addr, struct station_info *sinfo)
2864 {
2865         void *hdr;
2866         struct nlattr *sinfoattr, *bss_param;
2867
2868         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
2869         if (!hdr)
2870                 return -1;
2871
2872         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2873             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
2874             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
2875                 goto nla_put_failure;
2876
2877         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2878         if (!sinfoattr)
2879                 goto nla_put_failure;
2880         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
2881             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2882                         sinfo->connected_time))
2883                 goto nla_put_failure;
2884         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
2885             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2886                         sinfo->inactive_time))
2887                 goto nla_put_failure;
2888         if ((sinfo->filled & STATION_INFO_RX_BYTES) &&
2889             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
2890                         sinfo->rx_bytes))
2891                 goto nla_put_failure;
2892         if ((sinfo->filled & STATION_INFO_TX_BYTES) &&
2893             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
2894                         sinfo->tx_bytes))
2895                 goto nla_put_failure;
2896         if ((sinfo->filled & STATION_INFO_LLID) &&
2897             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
2898                 goto nla_put_failure;
2899         if ((sinfo->filled & STATION_INFO_PLID) &&
2900             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
2901                 goto nla_put_failure;
2902         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
2903             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
2904                        sinfo->plink_state))
2905                 goto nla_put_failure;
2906         switch (rdev->wiphy.signal_type) {
2907         case CFG80211_SIGNAL_TYPE_MBM:
2908                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
2909                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
2910                                sinfo->signal))
2911                         goto nla_put_failure;
2912                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
2913                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2914                                sinfo->signal_avg))
2915                         goto nla_put_failure;
2916                 break;
2917         default:
2918                 break;
2919         }
2920         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2921                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2922                                           NL80211_STA_INFO_TX_BITRATE))
2923                         goto nla_put_failure;
2924         }
2925         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2926                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2927                                           NL80211_STA_INFO_RX_BITRATE))
2928                         goto nla_put_failure;
2929         }
2930         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
2931             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
2932                         sinfo->rx_packets))
2933                 goto nla_put_failure;
2934         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
2935             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
2936                         sinfo->tx_packets))
2937                 goto nla_put_failure;
2938         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
2939             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
2940                         sinfo->tx_retries))
2941                 goto nla_put_failure;
2942         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
2943             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
2944                         sinfo->tx_failed))
2945                 goto nla_put_failure;
2946         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
2947             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
2948                         sinfo->beacon_loss_count))
2949                 goto nla_put_failure;
2950         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2951                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2952                 if (!bss_param)
2953                         goto nla_put_failure;
2954
2955                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
2956                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
2957                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
2958                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
2959                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
2960                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
2961                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2962                                sinfo->bss_param.dtim_period) ||
2963                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2964                                 sinfo->bss_param.beacon_interval))
2965                         goto nla_put_failure;
2966
2967                 nla_nest_end(msg, bss_param);
2968         }
2969         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
2970             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
2971                     sizeof(struct nl80211_sta_flag_update),
2972                     &sinfo->sta_flags))
2973                 goto nla_put_failure;
2974         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
2975                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
2976                             sinfo->t_offset))
2977                 goto nla_put_failure;
2978         nla_nest_end(msg, sinfoattr);
2979
2980         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
2981             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2982                     sinfo->assoc_req_ies))
2983                 goto nla_put_failure;
2984
2985         return genlmsg_end(msg, hdr);
2986
2987  nla_put_failure:
2988         genlmsg_cancel(msg, hdr);
2989         return -EMSGSIZE;
2990 }
2991
2992 static int nl80211_dump_station(struct sk_buff *skb,
2993                                 struct netlink_callback *cb)
2994 {
2995         struct station_info sinfo;
2996         struct cfg80211_registered_device *dev;
2997         struct net_device *netdev;
2998         u8 mac_addr[ETH_ALEN];
2999         int sta_idx = cb->args[1];
3000         int err;
3001
3002         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3003         if (err)
3004                 return err;
3005
3006         if (!dev->ops->dump_station) {
3007                 err = -EOPNOTSUPP;
3008                 goto out_err;
3009         }
3010
3011         while (1) {
3012                 memset(&sinfo, 0, sizeof(sinfo));
3013                 err = rdev_dump_station(dev, netdev, sta_idx,
3014                                         mac_addr, &sinfo);
3015                 if (err == -ENOENT)
3016                         break;
3017                 if (err)
3018                         goto out_err;
3019
3020                 if (nl80211_send_station(skb,
3021                                 NETLINK_CB(cb->skb).portid,
3022                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3023                                 dev, netdev, mac_addr,
3024                                 &sinfo) < 0)
3025                         goto out;
3026
3027                 sta_idx++;
3028         }
3029
3030
3031  out:
3032         cb->args[1] = sta_idx;
3033         err = skb->len;
3034  out_err:
3035         nl80211_finish_netdev_dump(dev);
3036
3037         return err;
3038 }
3039
3040 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3041 {
3042         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3043         struct net_device *dev = info->user_ptr[1];
3044         struct station_info sinfo;
3045         struct sk_buff *msg;
3046         u8 *mac_addr = NULL;
3047         int err;
3048
3049         memset(&sinfo, 0, sizeof(sinfo));
3050
3051         if (!info->attrs[NL80211_ATTR_MAC])
3052                 return -EINVAL;
3053
3054         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3055
3056         if (!rdev->ops->get_station)
3057                 return -EOPNOTSUPP;
3058
3059         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3060         if (err)
3061                 return err;
3062
3063         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3064         if (!msg)
3065                 return -ENOMEM;
3066
3067         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3068                                  rdev, dev, mac_addr, &sinfo) < 0) {
3069                 nlmsg_free(msg);
3070                 return -ENOBUFS;
3071         }
3072
3073         return genlmsg_reply(msg, info);
3074 }
3075
3076 /*
3077  * Get vlan interface making sure it is running and on the right wiphy.
3078  */
3079 static struct net_device *get_vlan(struct genl_info *info,
3080                                    struct cfg80211_registered_device *rdev)
3081 {
3082         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3083         struct net_device *v;
3084         int ret;
3085
3086         if (!vlanattr)
3087                 return NULL;
3088
3089         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3090         if (!v)
3091                 return ERR_PTR(-ENODEV);
3092
3093         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3094                 ret = -EINVAL;
3095                 goto error;
3096         }
3097
3098         if (!netif_running(v)) {
3099                 ret = -ENETDOWN;
3100                 goto error;
3101         }
3102
3103         return v;
3104  error:
3105         dev_put(v);
3106         return ERR_PTR(ret);
3107 }
3108
3109 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3110 {
3111         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3112         int err;
3113         struct net_device *dev = info->user_ptr[1];
3114         struct station_parameters params;
3115         u8 *mac_addr = NULL;
3116
3117         memset(&params, 0, sizeof(params));
3118
3119         params.listen_interval = -1;
3120         params.plink_state = -1;
3121
3122         if (info->attrs[NL80211_ATTR_STA_AID])
3123                 return -EINVAL;
3124
3125         if (!info->attrs[NL80211_ATTR_MAC])
3126                 return -EINVAL;
3127
3128         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3129
3130         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3131                 params.supported_rates =
3132                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3133                 params.supported_rates_len =
3134                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3135         }
3136
3137         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3138                 params.listen_interval =
3139                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3140
3141         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3142                 params.ht_capa =
3143                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3144
3145         if (!rdev->ops->change_station)
3146                 return -EOPNOTSUPP;
3147
3148         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3149                 return -EINVAL;
3150
3151         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3152                 params.plink_action =
3153                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3154
3155         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
3156                 params.plink_state =
3157                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3158
3159         switch (dev->ieee80211_ptr->iftype) {
3160         case NL80211_IFTYPE_AP:
3161         case NL80211_IFTYPE_AP_VLAN:
3162         case NL80211_IFTYPE_P2P_GO:
3163                 /* disallow mesh-specific things */
3164                 if (params.plink_action)
3165                         return -EINVAL;
3166
3167                 /* TDLS can't be set, ... */
3168                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3169                         return -EINVAL;
3170                 /*
3171                  * ... but don't bother the driver with it. This works around
3172                  * a hostapd/wpa_supplicant issue -- it always includes the
3173                  * TLDS_PEER flag in the mask even for AP mode.
3174                  */
3175                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3176
3177                 /* accept only the listed bits */
3178                 if (params.sta_flags_mask &
3179                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3180                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3181                                   BIT(NL80211_STA_FLAG_WME) |
3182                                   BIT(NL80211_STA_FLAG_MFP)))
3183                         return -EINVAL;
3184
3185                 /* must be last in here for error handling */
3186                 params.vlan = get_vlan(info, rdev);
3187                 if (IS_ERR(params.vlan))
3188                         return PTR_ERR(params.vlan);
3189                 break;
3190         case NL80211_IFTYPE_P2P_CLIENT:
3191         case NL80211_IFTYPE_STATION:
3192                 /*
3193                  * Don't allow userspace to change the TDLS_PEER flag,
3194                  * but silently ignore attempts to change it since we
3195                  * don't have state here to verify that it doesn't try
3196                  * to change the flag.
3197                  */
3198                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3199                 /* fall through */
3200         case NL80211_IFTYPE_ADHOC:
3201                 /* disallow things sta doesn't support */
3202                 if (params.plink_action)
3203                         return -EINVAL;
3204                 if (params.ht_capa)
3205                         return -EINVAL;
3206                 if (params.listen_interval >= 0)
3207                         return -EINVAL;
3208                 /* reject any changes other than AUTHORIZED */
3209                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3210                         return -EINVAL;
3211                 break;
3212         case NL80211_IFTYPE_MESH_POINT:
3213                 /* disallow things mesh doesn't support */
3214                 if (params.vlan)
3215                         return -EINVAL;
3216                 if (params.ht_capa)
3217                         return -EINVAL;
3218                 if (params.listen_interval >= 0)
3219                         return -EINVAL;
3220                 /*
3221                  * No special handling for TDLS here -- the userspace
3222                  * mesh code doesn't have this bug.
3223                  */
3224                 if (params.sta_flags_mask &
3225                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3226                                   BIT(NL80211_STA_FLAG_MFP) |
3227                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3228                         return -EINVAL;
3229                 break;
3230         default:
3231                 return -EOPNOTSUPP;
3232         }
3233
3234         /* be aware of params.vlan when changing code here */
3235
3236         err = rdev_change_station(rdev, dev, mac_addr, &params);
3237
3238         if (params.vlan)
3239                 dev_put(params.vlan);
3240
3241         return err;
3242 }
3243
3244 static struct nla_policy
3245 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3246         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3247         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3248 };
3249
3250 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3251 {
3252         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3253         int err;
3254         struct net_device *dev = info->user_ptr[1];
3255         struct station_parameters params;
3256         u8 *mac_addr = NULL;
3257
3258         memset(&params, 0, sizeof(params));
3259
3260         if (!info->attrs[NL80211_ATTR_MAC])
3261                 return -EINVAL;
3262
3263         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3264                 return -EINVAL;
3265
3266         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3267                 return -EINVAL;
3268
3269         if (!info->attrs[NL80211_ATTR_STA_AID])
3270                 return -EINVAL;
3271
3272         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3273         params.supported_rates =
3274                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3275         params.supported_rates_len =
3276                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3277         params.listen_interval =
3278                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3279
3280         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3281         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3282                 return -EINVAL;
3283
3284         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3285                 params.ht_capa =
3286                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3287
3288         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3289                 params.vht_capa =
3290                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3291
3292         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3293                 params.plink_action =
3294                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3295
3296         if (!rdev->ops->add_station)
3297                 return -EOPNOTSUPP;
3298
3299         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3300                 return -EINVAL;
3301
3302         switch (dev->ieee80211_ptr->iftype) {
3303         case NL80211_IFTYPE_AP:
3304         case NL80211_IFTYPE_AP_VLAN:
3305         case NL80211_IFTYPE_P2P_GO:
3306                 /* parse WME attributes if sta is WME capable */
3307                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
3308                     (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
3309                     info->attrs[NL80211_ATTR_STA_WME]) {
3310                         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3311                         struct nlattr *nla;
3312
3313                         nla = info->attrs[NL80211_ATTR_STA_WME];
3314                         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3315                                                nl80211_sta_wme_policy);
3316                         if (err)
3317                                 return err;
3318
3319                         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3320                                 params.uapsd_queues =
3321                                      nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
3322                         if (params.uapsd_queues &
3323                                         ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3324                                 return -EINVAL;
3325
3326                         if (tb[NL80211_STA_WME_MAX_SP])
3327                                 params.max_sp =
3328                                      nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3329
3330                         if (params.max_sp &
3331                                         ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3332                                 return -EINVAL;
3333
3334                         params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3335                 }
3336                 /* TDLS peers cannot be added */
3337                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3338                         return -EINVAL;
3339                 /* but don't bother the driver with it */
3340                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3341
3342                 /* must be last in here for error handling */
3343                 params.vlan = get_vlan(info, rdev);
3344                 if (IS_ERR(params.vlan))
3345                         return PTR_ERR(params.vlan);
3346                 break;
3347         case NL80211_IFTYPE_MESH_POINT:
3348                 /* TDLS peers cannot be added */
3349                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3350                         return -EINVAL;
3351                 break;
3352         case NL80211_IFTYPE_STATION:
3353                 /* Only TDLS peers can be added */
3354                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3355                         return -EINVAL;
3356                 /* Can only add if TDLS ... */
3357                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
3358                         return -EOPNOTSUPP;
3359                 /* ... with external setup is supported */
3360                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
3361                         return -EOPNOTSUPP;
3362                 break;
3363         default:
3364                 return -EOPNOTSUPP;
3365         }
3366
3367         /* be aware of params.vlan when changing code here */
3368
3369         err = rdev_add_station(rdev, dev, mac_addr, &params);
3370
3371         if (params.vlan)
3372                 dev_put(params.vlan);
3373         return err;
3374 }
3375
3376 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
3377 {
3378         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3379         struct net_device *dev = info->user_ptr[1];
3380         u8 *mac_addr = NULL;
3381
3382         if (info->attrs[NL80211_ATTR_MAC])
3383                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3384
3385         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3386             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3387             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
3388             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3389                 return -EINVAL;
3390
3391         if (!rdev->ops->del_station)
3392                 return -EOPNOTSUPP;
3393
3394         return rdev_del_station(rdev, dev, mac_addr);
3395 }
3396
3397 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
3398                                 int flags, struct net_device *dev,
3399                                 u8 *dst, u8 *next_hop,
3400                                 struct mpath_info *pinfo)
3401 {
3402         void *hdr;
3403         struct nlattr *pinfoattr;
3404
3405         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3406         if (!hdr)
3407                 return -1;
3408
3409         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3410             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
3411             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
3412             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
3413                 goto nla_put_failure;
3414
3415         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
3416         if (!pinfoattr)
3417                 goto nla_put_failure;
3418         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
3419             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
3420                         pinfo->frame_qlen))
3421                 goto nla_put_failure;
3422         if (((pinfo->filled & MPATH_INFO_SN) &&
3423              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
3424             ((pinfo->filled & MPATH_INFO_METRIC) &&
3425              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
3426                          pinfo->metric)) ||
3427             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
3428              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
3429                          pinfo->exptime)) ||
3430             ((pinfo->filled & MPATH_INFO_FLAGS) &&
3431              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
3432                         pinfo->flags)) ||
3433             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
3434              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
3435                          pinfo->discovery_timeout)) ||
3436             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
3437              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
3438                         pinfo->discovery_retries)))
3439                 goto nla_put_failure;
3440
3441         nla_nest_end(msg, pinfoattr);
3442
3443         return genlmsg_end(msg, hdr);
3444
3445  nla_put_failure:
3446         genlmsg_cancel(msg, hdr);
3447         return -EMSGSIZE;
3448 }
3449
3450 static int nl80211_dump_mpath(struct sk_buff *skb,
3451                               struct netlink_callback *cb)
3452 {
3453         struct mpath_info pinfo;
3454         struct cfg80211_registered_device *dev;
3455         struct net_device *netdev;
3456         u8 dst[ETH_ALEN];
3457         u8 next_hop[ETH_ALEN];
3458         int path_idx = cb->args[1];
3459         int err;
3460
3461         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3462         if (err)
3463                 return err;
3464
3465         if (!dev->ops->dump_mpath) {
3466                 err = -EOPNOTSUPP;
3467                 goto out_err;
3468         }
3469
3470         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
3471                 err = -EOPNOTSUPP;
3472                 goto out_err;
3473         }
3474
3475         while (1) {
3476                 err = rdev_dump_mpath(dev, netdev, path_idx, dst, next_hop,
3477                                       &pinfo);
3478                 if (err == -ENOENT)
3479                         break;
3480                 if (err)
3481                         goto out_err;
3482
3483                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
3484                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
3485                                        netdev, dst, next_hop,
3486                                        &pinfo) < 0)
3487                         goto out;
3488
3489                 path_idx++;
3490         }
3491
3492
3493  out:
3494         cb->args[1] = path_idx;
3495         err = skb->len;
3496  out_err:
3497         nl80211_finish_netdev_dump(dev);
3498         return err;
3499 }
3500
3501 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
3502 {
3503         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3504         int err;
3505         struct net_device *dev = info->user_ptr[1];
3506         struct mpath_info pinfo;
3507         struct sk_buff *msg;
3508         u8 *dst = NULL;
3509         u8 next_hop[ETH_ALEN];
3510
3511         memset(&pinfo, 0, sizeof(pinfo));
3512
3513         if (!info->attrs[NL80211_ATTR_MAC])
3514                 return -EINVAL;
3515
3516         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3517
3518         if (!rdev->ops->get_mpath)
3519                 return -EOPNOTSUPP;
3520
3521         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3522                 return -EOPNOTSUPP;
3523
3524         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
3525         if (err)
3526                 return err;
3527
3528         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3529         if (!msg)
3530                 return -ENOMEM;
3531
3532         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
3533                                  dev, dst, next_hop, &pinfo) < 0) {
3534                 nlmsg_free(msg);
3535                 return -ENOBUFS;
3536         }
3537
3538         return genlmsg_reply(msg, info);
3539 }
3540
3541 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
3542 {
3543         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3544         struct net_device *dev = info->user_ptr[1];
3545         u8 *dst = NULL;
3546         u8 *next_hop = NULL;
3547
3548         if (!info->attrs[NL80211_ATTR_MAC])
3549                 return -EINVAL;
3550
3551         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3552                 return -EINVAL;
3553
3554         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3555         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3556
3557         if (!rdev->ops->change_mpath)
3558                 return -EOPNOTSUPP;
3559
3560         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3561                 return -EOPNOTSUPP;
3562
3563         return rdev_change_mpath(rdev, dev, dst, next_hop);
3564 }
3565
3566 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3567 {
3568         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3569         struct net_device *dev = info->user_ptr[1];
3570         u8 *dst = NULL;
3571         u8 *next_hop = NULL;
3572
3573         if (!info->attrs[NL80211_ATTR_MAC])
3574                 return -EINVAL;
3575
3576         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3577                 return -EINVAL;
3578
3579         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3580         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3581
3582         if (!rdev->ops->add_mpath)
3583                 return -EOPNOTSUPP;
3584
3585         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3586                 return -EOPNOTSUPP;
3587
3588         return rdev_add_mpath(rdev, dev, dst, next_hop);
3589 }
3590
3591 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
3592 {
3593         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3594         struct net_device *dev = info->user_ptr[1];
3595         u8 *dst = NULL;
3596
3597         if (info->attrs[NL80211_ATTR_MAC])
3598                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3599
3600         if (!rdev->ops->del_mpath)
3601                 return -EOPNOTSUPP;
3602
3603         return rdev_del_mpath(rdev, dev, dst);
3604 }
3605
3606 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
3607 {
3608         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3609         struct net_device *dev = info->user_ptr[1];
3610         struct bss_parameters params;
3611
3612         memset(&params, 0, sizeof(params));
3613         /* default to not changing parameters */
3614         params.use_cts_prot = -1;
3615         params.use_short_preamble = -1;
3616         params.use_short_slot_time = -1;
3617         params.ap_isolate = -1;
3618         params.ht_opmode = -1;
3619
3620         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
3621                 params.use_cts_prot =
3622                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
3623         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
3624                 params.use_short_preamble =
3625                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
3626         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
3627                 params.use_short_slot_time =
3628                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
3629         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3630                 params.basic_rates =
3631                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3632                 params.basic_rates_len =
3633                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3634         }
3635         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
3636                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
3637         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
3638                 params.ht_opmode =
3639                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
3640
3641         if (!rdev->ops->change_bss)
3642                 return -EOPNOTSUPP;
3643
3644         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3645             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3646                 return -EOPNOTSUPP;
3647
3648         return rdev_change_bss(rdev, dev, &params);
3649 }
3650
3651 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
3652         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
3653         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
3654         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
3655         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
3656         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
3657         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
3658 };
3659
3660 static int parse_reg_rule(struct nlattr *tb[],
3661         struct ieee80211_reg_rule *reg_rule)
3662 {
3663         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
3664         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
3665
3666         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
3667                 return -EINVAL;
3668         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
3669                 return -EINVAL;
3670         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
3671                 return -EINVAL;
3672         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
3673                 return -EINVAL;
3674         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
3675                 return -EINVAL;
3676
3677         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
3678
3679         freq_range->start_freq_khz =
3680                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
3681         freq_range->end_freq_khz =
3682                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
3683         freq_range->max_bandwidth_khz =
3684                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
3685
3686         power_rule->max_eirp =
3687                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
3688
3689         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
3690                 power_rule->max_antenna_gain =
3691                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
3692
3693         return 0;
3694 }
3695
3696 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
3697 {
3698         int r;
3699         char *data = NULL;
3700         enum nl80211_user_reg_hint_type user_reg_hint_type;
3701
3702         /*
3703          * You should only get this when cfg80211 hasn't yet initialized
3704          * completely when built-in to the kernel right between the time
3705          * window between nl80211_init() and regulatory_init(), if that is
3706          * even possible.
3707          */
3708         mutex_lock(&cfg80211_mutex);
3709         if (unlikely(!cfg80211_regdomain)) {
3710                 mutex_unlock(&cfg80211_mutex);
3711                 return -EINPROGRESS;
3712         }
3713         mutex_unlock(&cfg80211_mutex);
3714
3715         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3716                 return -EINVAL;
3717
3718         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3719
3720         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
3721                 user_reg_hint_type =
3722                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
3723         else
3724                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
3725
3726         switch (user_reg_hint_type) {
3727         case NL80211_USER_REG_HINT_USER:
3728         case NL80211_USER_REG_HINT_CELL_BASE:
3729                 break;
3730         default:
3731                 return -EINVAL;
3732         }
3733
3734         r = regulatory_hint_user(data, user_reg_hint_type);
3735
3736         return r;
3737 }
3738
3739 static int nl80211_get_mesh_config(struct sk_buff *skb,
3740                                    struct genl_info *info)
3741 {
3742         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3743         struct net_device *dev = info->user_ptr[1];
3744         struct wireless_dev *wdev = dev->ieee80211_ptr;
3745         struct mesh_config cur_params;
3746         int err = 0;
3747         void *hdr;
3748         struct nlattr *pinfoattr;
3749         struct sk_buff *msg;
3750
3751         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3752                 return -EOPNOTSUPP;
3753
3754         if (!rdev->ops->get_mesh_config)
3755                 return -EOPNOTSUPP;
3756
3757         wdev_lock(wdev);
3758         /* If not connected, get default parameters */
3759         if (!wdev->mesh_id_len)
3760                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3761         else
3762                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
3763         wdev_unlock(wdev);
3764
3765         if (err)
3766                 return err;
3767
3768         /* Draw up a netlink message to send back */
3769         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3770         if (!msg)
3771                 return -ENOMEM;
3772         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3773                              NL80211_CMD_GET_MESH_CONFIG);
3774         if (!hdr)
3775                 goto out;
3776         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3777         if (!pinfoattr)
3778                 goto nla_put_failure;
3779         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3780             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3781                         cur_params.dot11MeshRetryTimeout) ||
3782             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3783                         cur_params.dot11MeshConfirmTimeout) ||
3784             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3785                         cur_params.dot11MeshHoldingTimeout) ||
3786             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3787                         cur_params.dot11MeshMaxPeerLinks) ||
3788             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
3789                        cur_params.dot11MeshMaxRetries) ||
3790             nla_put_u8(msg, NL80211_MESHCONF_TTL,
3791                        cur_params.dot11MeshTTL) ||
3792             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3793                        cur_params.element_ttl) ||
3794             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3795                        cur_params.auto_open_plinks) ||
3796             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3797                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
3798             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3799                        cur_params.dot11MeshHWMPmaxPREQretries) ||
3800             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3801                         cur_params.path_refresh_time) ||
3802             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3803                         cur_params.min_discovery_timeout) ||
3804             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3805                         cur_params.dot11MeshHWMPactivePathTimeout) ||
3806             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3807                         cur_params.dot11MeshHWMPpreqMinInterval) ||
3808             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3809                         cur_params.dot11MeshHWMPperrMinInterval) ||
3810             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3811                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
3812             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3813                        cur_params.dot11MeshHWMPRootMode) ||
3814             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3815                         cur_params.dot11MeshHWMPRannInterval) ||
3816             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3817                        cur_params.dot11MeshGateAnnouncementProtocol) ||
3818             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
3819                        cur_params.dot11MeshForwarding) ||
3820             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
3821                         cur_params.rssi_threshold) ||
3822             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
3823                         cur_params.ht_opmode) ||
3824             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3825                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
3826             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3827                         cur_params.dot11MeshHWMProotInterval) ||
3828             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3829                         cur_params.dot11MeshHWMPconfirmationInterval))
3830                 goto nla_put_failure;
3831         nla_nest_end(msg, pinfoattr);
3832         genlmsg_end(msg, hdr);
3833         return genlmsg_reply(msg, info);
3834
3835  nla_put_failure:
3836         genlmsg_cancel(msg, hdr);
3837  out:
3838         nlmsg_free(msg);
3839         return -ENOBUFS;
3840 }
3841
3842 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3843         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3844         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3845         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3846         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3847         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3848         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3849         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3850         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3851         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
3852         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3853         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3854         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3855         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3856         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3857         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
3858         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3859         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3860         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3861         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3862         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
3863         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
3864         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
3865         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
3866         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
3867         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
3868 };
3869
3870 static const struct nla_policy
3871         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3872         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
3873         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3874         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3875         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3876         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3877                                     .len = IEEE80211_MAX_DATA_LEN },
3878         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3879 };
3880
3881 static int nl80211_parse_mesh_config(struct genl_info *info,
3882                                      struct mesh_config *cfg,
3883                                      u32 *mask_out)
3884 {
3885         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3886         u32 mask = 0;
3887
3888 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3889 do {\
3890         if (table[attr_num]) {\
3891                 cfg->param = nla_fn(table[attr_num]); \
3892                 mask |= (1 << (attr_num - 1)); \
3893         } \
3894 } while (0);\
3895
3896
3897         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3898                 return -EINVAL;
3899         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3900                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3901                              nl80211_meshconf_params_policy))
3902                 return -EINVAL;
3903
3904         /* This makes sure that there aren't more than 32 mesh config
3905          * parameters (otherwise our bitfield scheme would not work.) */
3906         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3907
3908         /* Fill in the params struct */
3909         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3910                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
3911                                   nla_get_u16);
3912         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3913                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3914                                   nla_get_u16);
3915         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3916                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
3917                                   nla_get_u16);
3918         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3919                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
3920                                   nla_get_u16);
3921         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3922                                   mask, NL80211_MESHCONF_MAX_RETRIES,
3923                                   nla_get_u8);
3924         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3925                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
3926         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3927                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
3928                                   nla_get_u8);
3929         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3930                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3931                                   nla_get_u8);
3932         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, mask,
3933                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3934                                   nla_get_u32);
3935         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3936                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3937                                   nla_get_u8);
3938         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3939                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
3940                                   nla_get_u32);
3941         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3942                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3943                                   nla_get_u16);
3944         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, mask,
3945                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3946                                   nla_get_u32);
3947         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3948                                   mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3949                                   nla_get_u16);
3950         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
3951                                   mask, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3952                                   nla_get_u16);
3953         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3954                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
3955                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3956                                   nla_get_u16);
3957         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
3958                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
3959         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
3960                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3961                                   nla_get_u16);
3962         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3963                                   dot11MeshGateAnnouncementProtocol, mask,
3964                                   NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3965                                   nla_get_u8);
3966         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding,
3967                                   mask, NL80211_MESHCONF_FORWARDING,
3968                                   nla_get_u8);
3969         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold,
3970                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
3971                                   nla_get_u32);
3972         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode,
3973                                   mask, NL80211_MESHCONF_HT_OPMODE,
3974                                   nla_get_u16);
3975         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
3976                                   mask,
3977                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3978                                   nla_get_u32);
3979         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval,
3980                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3981                                   nla_get_u16);
3982         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3983                                   dot11MeshHWMPconfirmationInterval, mask,
3984                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3985                                   nla_get_u16);
3986         if (mask_out)
3987                 *mask_out = mask;
3988
3989         return 0;
3990
3991 #undef FILL_IN_MESH_PARAM_IF_SET
3992 }
3993
3994 static int nl80211_parse_mesh_setup(struct genl_info *info,
3995                                      struct mesh_setup *setup)
3996 {
3997         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3998
3999         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4000                 return -EINVAL;
4001         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4002                              info->attrs[NL80211_ATTR_MESH_SETUP],
4003                              nl80211_mesh_setup_params_policy))
4004                 return -EINVAL;
4005
4006         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4007                 setup->sync_method =
4008                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4009                  IEEE80211_SYNC_METHOD_VENDOR :
4010                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4011
4012         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4013                 setup->path_sel_proto =
4014                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4015                  IEEE80211_PATH_PROTOCOL_VENDOR :
4016                  IEEE80211_PATH_PROTOCOL_HWMP;
4017
4018         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4019                 setup->path_metric =
4020                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4021                  IEEE80211_PATH_METRIC_VENDOR :
4022                  IEEE80211_PATH_METRIC_AIRTIME;
4023
4024
4025         if (tb[NL80211_MESH_SETUP_IE]) {
4026                 struct nlattr *ieattr =
4027                         tb[NL80211_MESH_SETUP_IE];
4028                 if (!is_valid_ie_attr(ieattr))
4029                         return -EINVAL;
4030                 setup->ie = nla_data(ieattr);
4031                 setup->ie_len = nla_len(ieattr);
4032         }
4033         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
4034         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
4035
4036         return 0;
4037 }
4038
4039 static int nl80211_update_mesh_config(struct sk_buff *skb,
4040                                       struct genl_info *info)
4041 {
4042         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4043         struct net_device *dev = info->user_ptr[1];
4044         struct wireless_dev *wdev = dev->ieee80211_ptr;
4045         struct mesh_config cfg;
4046         u32 mask;
4047         int err;
4048
4049         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4050                 return -EOPNOTSUPP;
4051
4052         if (!rdev->ops->update_mesh_config)
4053                 return -EOPNOTSUPP;
4054
4055         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4056         if (err)
4057                 return err;
4058
4059         wdev_lock(wdev);
4060         if (!wdev->mesh_id_len)
4061                 err = -ENOLINK;
4062
4063         if (!err)
4064                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4065
4066         wdev_unlock(wdev);
4067
4068         return err;
4069 }
4070
4071 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4072 {
4073         struct sk_buff *msg;
4074         void *hdr = NULL;
4075         struct nlattr *nl_reg_rules;
4076         unsigned int i;
4077         int err = -EINVAL;
4078
4079         mutex_lock(&cfg80211_mutex);
4080
4081         if (!cfg80211_regdomain)
4082                 goto out;
4083
4084         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4085         if (!msg) {
4086                 err = -ENOBUFS;
4087                 goto out;
4088         }
4089
4090         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4091                              NL80211_CMD_GET_REG);
4092         if (!hdr)
4093                 goto put_failure;
4094
4095         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
4096                            cfg80211_regdomain->alpha2) ||
4097             (cfg80211_regdomain->dfs_region &&
4098              nla_put_u8(msg, NL80211_ATTR_DFS_REGION,
4099                         cfg80211_regdomain->dfs_region)))
4100                 goto nla_put_failure;
4101
4102         if (reg_last_request_cell_base() &&
4103             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4104                         NL80211_USER_REG_HINT_CELL_BASE))
4105                 goto nla_put_failure;
4106
4107         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4108         if (!nl_reg_rules)
4109                 goto nla_put_failure;
4110
4111         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
4112                 struct nlattr *nl_reg_rule;
4113                 const struct ieee80211_reg_rule *reg_rule;
4114                 const struct ieee80211_freq_range *freq_range;
4115                 const struct ieee80211_power_rule *power_rule;
4116
4117                 reg_rule = &cfg80211_regdomain->reg_rules[i];
4118                 freq_range = &reg_rule->freq_range;
4119                 power_rule = &reg_rule->power_rule;
4120
4121                 nl_reg_rule = nla_nest_start(msg, i);
4122                 if (!nl_reg_rule)
4123                         goto nla_put_failure;
4124
4125                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4126                                 reg_rule->flags) ||
4127                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4128                                 freq_range->start_freq_khz) ||
4129                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4130                                 freq_range->end_freq_khz) ||
4131                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4132                                 freq_range->max_bandwidth_khz) ||
4133                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4134                                 power_rule->max_antenna_gain) ||
4135                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4136                                 power_rule->max_eirp))
4137                         goto nla_put_failure;
4138
4139                 nla_nest_end(msg, nl_reg_rule);
4140         }
4141
4142         nla_nest_end(msg, nl_reg_rules);
4143
4144         genlmsg_end(msg, hdr);
4145         err = genlmsg_reply(msg, info);
4146         goto out;
4147
4148 nla_put_failure:
4149         genlmsg_cancel(msg, hdr);
4150 put_failure:
4151         nlmsg_free(msg);
4152         err = -EMSGSIZE;
4153 out:
4154         mutex_unlock(&cfg80211_mutex);
4155         return err;
4156 }
4157
4158 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4159 {
4160         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4161         struct nlattr *nl_reg_rule;
4162         char *alpha2 = NULL;
4163         int rem_reg_rules = 0, r = 0;
4164         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4165         u8 dfs_region = 0;
4166         struct ieee80211_regdomain *rd = NULL;
4167
4168         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4169                 return -EINVAL;
4170
4171         if (!info->attrs[NL80211_ATTR_REG_RULES])
4172                 return -EINVAL;
4173
4174         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4175
4176         if (info->attrs[NL80211_ATTR_DFS_REGION])
4177                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4178
4179         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4180                         rem_reg_rules) {
4181                 num_rules++;
4182                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4183                         return -EINVAL;
4184         }
4185
4186         mutex_lock(&cfg80211_mutex);
4187
4188         if (!reg_is_valid_request(alpha2)) {
4189                 r = -EINVAL;
4190                 goto bad_reg;
4191         }
4192
4193         size_of_regd = sizeof(struct ieee80211_regdomain) +
4194                 (num_rules * sizeof(struct ieee80211_reg_rule));
4195
4196         rd = kzalloc(size_of_regd, GFP_KERNEL);
4197         if (!rd) {
4198                 r = -ENOMEM;
4199                 goto bad_reg;
4200         }
4201
4202         rd->n_reg_rules = num_rules;
4203         rd->alpha2[0] = alpha2[0];
4204         rd->alpha2[1] = alpha2[1];
4205
4206         /*
4207          * Disable DFS master mode if the DFS region was
4208          * not supported or known on this kernel.
4209          */
4210         if (reg_supported_dfs_region(dfs_region))
4211                 rd->dfs_region = dfs_region;
4212
4213         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4214                         rem_reg_rules) {
4215                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4216                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4217                         reg_rule_policy);
4218                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4219                 if (r)
4220                         goto bad_reg;
4221
4222                 rule_idx++;
4223
4224                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
4225                         r = -EINVAL;
4226                         goto bad_reg;
4227                 }
4228         }
4229
4230         BUG_ON(rule_idx != num_rules);
4231
4232         r = set_regdom(rd);
4233
4234         mutex_unlock(&cfg80211_mutex);
4235
4236         return r;
4237
4238  bad_reg:
4239         mutex_unlock(&cfg80211_mutex);
4240         kfree(rd);
4241         return r;
4242 }
4243
4244 static int validate_scan_freqs(struct nlattr *freqs)
4245 {
4246         struct nlattr *attr1, *attr2;
4247         int n_channels = 0, tmp1, tmp2;
4248
4249         nla_for_each_nested(attr1, freqs, tmp1) {
4250                 n_channels++;
4251                 /*
4252                  * Some hardware has a limited channel list for
4253                  * scanning, and it is pretty much nonsensical
4254                  * to scan for a channel twice, so disallow that
4255                  * and don't require drivers to check that the
4256                  * channel list they get isn't longer than what
4257                  * they can scan, as long as they can scan all
4258                  * the channels they registered at once.
4259                  */
4260                 nla_for_each_nested(attr2, freqs, tmp2)
4261                         if (attr1 != attr2 &&
4262                             nla_get_u32(attr1) == nla_get_u32(attr2))
4263                                 return 0;
4264         }
4265
4266         return n_channels;
4267 }
4268
4269 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4270 {
4271         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4272         struct wireless_dev *wdev = info->user_ptr[1];
4273         struct cfg80211_scan_request *request;
4274         struct nlattr *attr;
4275         struct wiphy *wiphy;
4276         int err, tmp, n_ssids = 0, n_channels, i;
4277         size_t ie_len;
4278
4279         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4280                 return -EINVAL;
4281
4282         wiphy = &rdev->wiphy;
4283
4284         if (!rdev->ops->scan)
4285                 return -EOPNOTSUPP;
4286
4287         if (rdev->scan_req)
4288                 return -EBUSY;
4289
4290         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4291                 n_channels = validate_scan_freqs(
4292                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4293                 if (!n_channels)
4294                         return -EINVAL;
4295         } else {
4296                 enum ieee80211_band band;
4297                 n_channels = 0;
4298
4299                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4300                         if (wiphy->bands[band])
4301                                 n_channels += wiphy->bands[band]->n_channels;
4302         }
4303
4304         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4305                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4306                         n_ssids++;
4307
4308         if (n_ssids > wiphy->max_scan_ssids)
4309                 return -EINVAL;
4310
4311         if (info->attrs[NL80211_ATTR_IE])
4312                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4313         else
4314                 ie_len = 0;
4315
4316         if (ie_len > wiphy->max_scan_ie_len)
4317                 return -EINVAL;
4318
4319         request = kzalloc(sizeof(*request)
4320                         + sizeof(*request->ssids) * n_ssids
4321                         + sizeof(*request->channels) * n_channels
4322                         + ie_len, GFP_KERNEL);
4323         if (!request)
4324                 return -ENOMEM;
4325
4326         if (n_ssids)
4327                 request->ssids = (void *)&request->channels[n_channels];
4328         request->n_ssids = n_ssids;
4329         if (ie_len) {
4330                 if (request->ssids)
4331                         request->ie = (void *)(request->ssids + n_ssids);
4332                 else
4333                         request->ie = (void *)(request->channels + n_channels);
4334         }
4335
4336         i = 0;
4337         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4338                 /* user specified, bail out if channel not found */
4339                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
4340                         struct ieee80211_channel *chan;
4341
4342                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4343
4344                         if (!chan) {
4345                                 err = -EINVAL;
4346                                 goto out_free;
4347                         }
4348
4349                         /* ignore disabled channels */
4350                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4351                                 continue;
4352
4353                         request->channels[i] = chan;
4354                         i++;
4355                 }
4356         } else {
4357                 enum ieee80211_band band;
4358
4359                 /* all channels */
4360                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4361                         int j;
4362                         if (!wiphy->bands[band])
4363                                 continue;
4364                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4365                                 struct ieee80211_channel *chan;
4366
4367                                 chan = &wiphy->bands[band]->channels[j];
4368
4369                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4370                                         continue;
4371
4372                                 request->channels[i] = chan;
4373                                 i++;
4374                         }
4375                 }
4376         }
4377
4378         if (!i) {
4379                 err = -EINVAL;
4380                 goto out_free;
4381         }
4382
4383         request->n_channels = i;
4384
4385         i = 0;
4386         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4387                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
4388                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4389                                 err = -EINVAL;
4390                                 goto out_free;
4391                         }
4392                         request->ssids[i].ssid_len = nla_len(attr);
4393                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
4394                         i++;
4395                 }
4396         }
4397
4398         if (info->attrs[NL80211_ATTR_IE]) {
4399                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4400                 memcpy((void *)request->ie,
4401                        nla_data(info->attrs[NL80211_ATTR_IE]),
4402                        request->ie_len);
4403         }
4404
4405         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
4406                 if (wiphy->bands[i])
4407                         request->rates[i] =
4408                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
4409
4410         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
4411                 nla_for_each_nested(attr,
4412                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
4413                                     tmp) {
4414                         enum ieee80211_band band = nla_type(attr);
4415
4416                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4417                                 err = -EINVAL;
4418                                 goto out_free;
4419                         }
4420                         err = ieee80211_get_ratemask(wiphy->bands[band],
4421                                                      nla_data(attr),
4422                                                      nla_len(attr),
4423                                                      &request->rates[band]);
4424                         if (err)
4425                                 goto out_free;
4426                 }
4427         }
4428
4429         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4430                 request->flags = nla_get_u32(
4431                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4432                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4433                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4434                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4435                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4436                         err = -EOPNOTSUPP;
4437                         goto out_free;
4438                 }
4439         }
4440
4441         request->no_cck =
4442                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
4443
4444         request->wdev = wdev;
4445         request->wiphy = &rdev->wiphy;
4446         request->scan_start = jiffies;
4447
4448         rdev->scan_req = request;
4449         err = rdev_scan(rdev, request);
4450
4451         if (!err) {
4452                 nl80211_send_scan_start(rdev, wdev);
4453                 if (wdev->netdev)
4454                         dev_hold(wdev->netdev);
4455         } else {
4456  out_free:
4457                 rdev->scan_req = NULL;
4458                 kfree(request);
4459         }
4460
4461         return err;
4462 }
4463
4464 static int nl80211_start_sched_scan(struct sk_buff *skb,
4465                                     struct genl_info *info)
4466 {
4467         struct cfg80211_sched_scan_request *request;
4468         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4469         struct net_device *dev = info->user_ptr[1];
4470         struct nlattr *attr;
4471         struct wiphy *wiphy;
4472         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
4473         u32 interval;
4474         enum ieee80211_band band;
4475         size_t ie_len;
4476         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
4477
4478         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4479             !rdev->ops->sched_scan_start)
4480                 return -EOPNOTSUPP;
4481
4482         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4483                 return -EINVAL;
4484
4485         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
4486                 return -EINVAL;
4487
4488         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
4489         if (interval == 0)
4490                 return -EINVAL;
4491
4492         wiphy = &rdev->wiphy;
4493
4494         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4495                 n_channels = validate_scan_freqs(
4496                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4497                 if (!n_channels)
4498                         return -EINVAL;
4499         } else {
4500                 n_channels = 0;
4501
4502                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4503                         if (wiphy->bands[band])
4504                                 n_channels += wiphy->bands[band]->n_channels;
4505         }
4506
4507         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4508                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4509                                     tmp)
4510                         n_ssids++;
4511
4512         if (n_ssids > wiphy->max_sched_scan_ssids)
4513                 return -EINVAL;
4514
4515         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
4516                 nla_for_each_nested(attr,
4517                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4518                                     tmp)
4519                         n_match_sets++;
4520
4521         if (n_match_sets > wiphy->max_match_sets)
4522                 return -EINVAL;
4523
4524         if (info->attrs[NL80211_ATTR_IE])
4525                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4526         else
4527                 ie_len = 0;
4528
4529         if (ie_len > wiphy->max_sched_scan_ie_len)
4530                 return -EINVAL;
4531
4532         mutex_lock(&rdev->sched_scan_mtx);
4533
4534         if (rdev->sched_scan_req) {
4535                 err = -EINPROGRESS;
4536                 goto out;
4537         }
4538
4539         request = kzalloc(sizeof(*request)
4540                         + sizeof(*request->ssids) * n_ssids
4541                         + sizeof(*request->match_sets) * n_match_sets
4542                         + sizeof(*request->channels) * n_channels
4543                         + ie_len, GFP_KERNEL);
4544         if (!request) {
4545                 err = -ENOMEM;
4546                 goto out;
4547         }
4548
4549         if (n_ssids)
4550                 request->ssids = (void *)&request->channels[n_channels];
4551         request->n_ssids = n_ssids;
4552         if (ie_len) {
4553                 if (request->ssids)
4554                         request->ie = (void *)(request->ssids + n_ssids);
4555                 else
4556                         request->ie = (void *)(request->channels + n_channels);
4557         }
4558
4559         if (n_match_sets) {
4560                 if (request->ie)
4561                         request->match_sets = (void *)(request->ie + ie_len);
4562                 else if (request->ssids)
4563                         request->match_sets =
4564                                 (void *)(request->ssids + n_ssids);
4565                 else
4566                         request->match_sets =
4567                                 (void *)(request->channels + n_channels);
4568         }
4569         request->n_match_sets = n_match_sets;
4570
4571         i = 0;
4572         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4573                 /* user specified, bail out if channel not found */
4574                 nla_for_each_nested(attr,
4575                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
4576                                     tmp) {
4577                         struct ieee80211_channel *chan;
4578
4579                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4580
4581                         if (!chan) {
4582                                 err = -EINVAL;
4583                                 goto out_free;
4584                         }
4585
4586                         /* ignore disabled channels */
4587                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4588                                 continue;
4589
4590                         request->channels[i] = chan;
4591                         i++;
4592                 }
4593         } else {
4594                 /* all channels */
4595                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4596                         int j;
4597                         if (!wiphy->bands[band])
4598                                 continue;
4599                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4600                                 struct ieee80211_channel *chan;
4601
4602                                 chan = &wiphy->bands[band]->channels[j];
4603
4604                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4605                                         continue;
4606
4607                                 request->channels[i] = chan;
4608                                 i++;
4609                         }
4610                 }
4611         }
4612
4613         if (!i) {
4614                 err = -EINVAL;
4615                 goto out_free;
4616         }
4617
4618         request->n_channels = i;
4619
4620         i = 0;
4621         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4622                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4623                                     tmp) {
4624                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4625                                 err = -EINVAL;
4626                                 goto out_free;
4627                         }
4628                         request->ssids[i].ssid_len = nla_len(attr);
4629                         memcpy(request->ssids[i].ssid, nla_data(attr),
4630                                nla_len(attr));
4631                         i++;
4632                 }
4633         }
4634
4635         i = 0;
4636         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
4637                 nla_for_each_nested(attr,
4638                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4639                                     tmp) {
4640                         struct nlattr *ssid, *rssi;
4641
4642                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
4643                                   nla_data(attr), nla_len(attr),
4644                                   nl80211_match_policy);
4645                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
4646                         if (ssid) {
4647                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
4648                                         err = -EINVAL;
4649                                         goto out_free;
4650                                 }
4651                                 memcpy(request->match_sets[i].ssid.ssid,
4652                                        nla_data(ssid), nla_len(ssid));
4653                                 request->match_sets[i].ssid.ssid_len =
4654                                         nla_len(ssid);
4655                         }
4656                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
4657                         if (rssi)
4658                                 request->rssi_thold = nla_get_u32(rssi);
4659                         else
4660                                 request->rssi_thold =
4661                                                    NL80211_SCAN_RSSI_THOLD_OFF;
4662                         i++;
4663                 }
4664         }
4665
4666         if (info->attrs[NL80211_ATTR_IE]) {
4667                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4668                 memcpy((void *)request->ie,
4669                        nla_data(info->attrs[NL80211_ATTR_IE]),
4670                        request->ie_len);
4671         }
4672
4673         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4674                 request->flags = nla_get_u32(
4675                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4676                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4677                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4678                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4679                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4680                         err = -EOPNOTSUPP;
4681                         goto out_free;
4682                 }
4683         }
4684
4685         request->dev = dev;
4686         request->wiphy = &rdev->wiphy;
4687         request->interval = interval;
4688         request->scan_start = jiffies;
4689
4690         err = rdev_sched_scan_start(rdev, dev, request);
4691         if (!err) {
4692                 rdev->sched_scan_req = request;
4693                 nl80211_send_sched_scan(rdev, dev,
4694                                         NL80211_CMD_START_SCHED_SCAN);
4695                 goto out;
4696         }
4697
4698 out_free:
4699         kfree(request);
4700 out:
4701         mutex_unlock(&rdev->sched_scan_mtx);
4702         return err;
4703 }
4704
4705 static int nl80211_stop_sched_scan(struct sk_buff *skb,
4706                                    struct genl_info *info)
4707 {
4708         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4709         int err;
4710
4711         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4712             !rdev->ops->sched_scan_stop)
4713                 return -EOPNOTSUPP;
4714
4715         mutex_lock(&rdev->sched_scan_mtx);
4716         err = __cfg80211_stop_sched_scan(rdev, false);
4717         mutex_unlock(&rdev->sched_scan_mtx);
4718
4719         return err;
4720 }
4721
4722 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
4723                             u32 seq, int flags,
4724                             struct cfg80211_registered_device *rdev,
4725                             struct wireless_dev *wdev,
4726                             struct cfg80211_internal_bss *intbss)
4727 {
4728         struct cfg80211_bss *res = &intbss->pub;
4729         void *hdr;
4730         struct nlattr *bss;
4731
4732         ASSERT_WDEV_LOCK(wdev);
4733
4734         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
4735                              NL80211_CMD_NEW_SCAN_RESULTS);
4736         if (!hdr)
4737                 return -1;
4738
4739         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
4740
4741         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
4742             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
4743                 goto nla_put_failure;
4744
4745         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
4746         if (!bss)
4747                 goto nla_put_failure;
4748         if ((!is_zero_ether_addr(res->bssid) &&
4749              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)) ||
4750             (res->information_elements && res->len_information_elements &&
4751              nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
4752                      res->len_information_elements,
4753                      res->information_elements)) ||
4754             (res->beacon_ies && res->len_beacon_ies &&
4755              res->beacon_ies != res->information_elements &&
4756              nla_put(msg, NL80211_BSS_BEACON_IES,
4757                      res->len_beacon_ies, res->beacon_ies)))
4758                 goto nla_put_failure;
4759         if (res->tsf &&
4760             nla_put_u64(msg, NL80211_BSS_TSF, res->tsf))
4761                 goto nla_put_failure;
4762         if (res->beacon_interval &&
4763             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
4764                 goto nla_put_failure;
4765         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
4766             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
4767             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
4768                         jiffies_to_msecs(jiffies - intbss->ts)))
4769                 goto nla_put_failure;
4770
4771         switch (rdev->wiphy.signal_type) {
4772         case CFG80211_SIGNAL_TYPE_MBM:
4773                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
4774                         goto nla_put_failure;
4775                 break;
4776         case CFG80211_SIGNAL_TYPE_UNSPEC:
4777                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
4778                         goto nla_put_failure;
4779                 break;
4780         default:
4781                 break;
4782         }
4783
4784         switch (wdev->iftype) {
4785         case NL80211_IFTYPE_P2P_CLIENT:
4786         case NL80211_IFTYPE_STATION:
4787                 if (intbss == wdev->current_bss &&
4788                     nla_put_u32(msg, NL80211_BSS_STATUS,
4789                                 NL80211_BSS_STATUS_ASSOCIATED))
4790                         goto nla_put_failure;
4791                 break;
4792         case NL80211_IFTYPE_ADHOC:
4793                 if (intbss == wdev->current_bss &&
4794                     nla_put_u32(msg, NL80211_BSS_STATUS,
4795                                 NL80211_BSS_STATUS_IBSS_JOINED))
4796                         goto nla_put_failure;
4797                 break;
4798         default:
4799                 break;
4800         }
4801
4802         nla_nest_end(msg, bss);
4803
4804         return genlmsg_end(msg, hdr);
4805
4806  nla_put_failure:
4807         genlmsg_cancel(msg, hdr);
4808         return -EMSGSIZE;
4809 }
4810
4811 static int nl80211_dump_scan(struct sk_buff *skb,
4812                              struct netlink_callback *cb)
4813 {
4814         struct cfg80211_registered_device *rdev;
4815         struct net_device *dev;
4816         struct cfg80211_internal_bss *scan;
4817         struct wireless_dev *wdev;
4818         int start = cb->args[1], idx = 0;
4819         int err;
4820
4821         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
4822         if (err)
4823                 return err;
4824
4825         wdev = dev->ieee80211_ptr;
4826
4827         wdev_lock(wdev);
4828         spin_lock_bh(&rdev->bss_lock);
4829         cfg80211_bss_expire(rdev);
4830
4831         cb->seq = rdev->bss_generation;
4832
4833         list_for_each_entry(scan, &rdev->bss_list, list) {
4834                 if (++idx <= start)
4835                         continue;
4836                 if (nl80211_send_bss(skb, cb,
4837                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4838                                 rdev, wdev, scan) < 0) {
4839                         idx--;
4840                         break;
4841                 }
4842         }
4843
4844         spin_unlock_bh(&rdev->bss_lock);
4845         wdev_unlock(wdev);
4846
4847         cb->args[1] = idx;
4848         nl80211_finish_netdev_dump(rdev);
4849
4850         return skb->len;
4851 }
4852
4853 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
4854                                 int flags, struct net_device *dev,
4855                                 struct survey_info *survey)
4856 {
4857         void *hdr;
4858         struct nlattr *infoattr;
4859
4860         hdr = nl80211hdr_put(msg, portid, seq, flags,
4861                              NL80211_CMD_NEW_SURVEY_RESULTS);
4862         if (!hdr)
4863                 return -ENOMEM;
4864
4865         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
4866                 goto nla_put_failure;
4867
4868         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
4869         if (!infoattr)
4870                 goto nla_put_failure;
4871
4872         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
4873                         survey->channel->center_freq))
4874                 goto nla_put_failure;
4875
4876         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
4877             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
4878                 goto nla_put_failure;
4879         if ((survey->filled & SURVEY_INFO_IN_USE) &&
4880             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
4881                 goto nla_put_failure;
4882         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
4883             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
4884                         survey->channel_time))
4885                 goto nla_put_failure;
4886         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
4887             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
4888                         survey->channel_time_busy))
4889                 goto nla_put_failure;
4890         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
4891             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
4892                         survey->channel_time_ext_busy))
4893                 goto nla_put_failure;
4894         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
4895             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
4896                         survey->channel_time_rx))
4897                 goto nla_put_failure;
4898         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
4899             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
4900                         survey->channel_time_tx))
4901                 goto nla_put_failure;
4902
4903         nla_nest_end(msg, infoattr);
4904
4905         return genlmsg_end(msg, hdr);
4906
4907  nla_put_failure:
4908         genlmsg_cancel(msg, hdr);
4909         return -EMSGSIZE;
4910 }
4911
4912 static int nl80211_dump_survey(struct sk_buff *skb,
4913                         struct netlink_callback *cb)
4914 {
4915         struct survey_info survey;
4916         struct cfg80211_registered_device *dev;
4917         struct net_device *netdev;
4918         int survey_idx = cb->args[1];
4919         int res;
4920
4921         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4922         if (res)
4923                 return res;
4924
4925         if (!dev->ops->dump_survey) {
4926                 res = -EOPNOTSUPP;
4927                 goto out_err;
4928         }
4929
4930         while (1) {
4931                 struct ieee80211_channel *chan;
4932
4933                 res = rdev_dump_survey(dev, netdev, survey_idx, &survey);
4934                 if (res == -ENOENT)
4935                         break;
4936                 if (res)
4937                         goto out_err;
4938
4939                 /* Survey without a channel doesn't make sense */
4940                 if (!survey.channel) {
4941                         res = -EINVAL;
4942                         goto out;
4943                 }
4944
4945                 chan = ieee80211_get_channel(&dev->wiphy,
4946                                              survey.channel->center_freq);
4947                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4948                         survey_idx++;
4949                         continue;
4950                 }
4951
4952                 if (nl80211_send_survey(skb,
4953                                 NETLINK_CB(cb->skb).portid,
4954                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4955                                 netdev,
4956                                 &survey) < 0)
4957                         goto out;
4958                 survey_idx++;
4959         }
4960
4961  out:
4962         cb->args[1] = survey_idx;
4963         res = skb->len;
4964  out_err:
4965         nl80211_finish_netdev_dump(dev);
4966         return res;
4967 }
4968
4969 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4970 {
4971         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4972                                   NL80211_WPA_VERSION_2));
4973 }
4974
4975 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4976 {
4977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4978         struct net_device *dev = info->user_ptr[1];
4979         struct ieee80211_channel *chan;
4980         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
4981         int err, ssid_len, ie_len = 0, sae_data_len = 0;
4982         enum nl80211_auth_type auth_type;
4983         struct key_parse key;
4984         bool local_state_change;
4985
4986         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4987                 return -EINVAL;
4988
4989         if (!info->attrs[NL80211_ATTR_MAC])
4990                 return -EINVAL;
4991
4992         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4993                 return -EINVAL;
4994
4995         if (!info->attrs[NL80211_ATTR_SSID])
4996                 return -EINVAL;
4997
4998         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4999                 return -EINVAL;
5000
5001         err = nl80211_parse_key(info, &key);
5002         if (err)
5003                 return err;
5004
5005         if (key.idx >= 0) {
5006                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
5007                         return -EINVAL;
5008                 if (!key.p.key || !key.p.key_len)
5009                         return -EINVAL;
5010                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
5011                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
5012                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
5013                      key.p.key_len != WLAN_KEY_LEN_WEP104))
5014                         return -EINVAL;
5015                 if (key.idx > 4)
5016                         return -EINVAL;
5017         } else {
5018                 key.p.key_len = 0;
5019                 key.p.key = NULL;
5020         }
5021
5022         if (key.idx >= 0) {
5023                 int i;
5024                 bool ok = false;
5025                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
5026                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
5027                                 ok = true;
5028                                 break;
5029                         }
5030                 }
5031                 if (!ok)
5032                         return -EINVAL;
5033         }
5034
5035         if (!rdev->ops->auth)
5036                 return -EOPNOTSUPP;
5037
5038         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5039             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5040                 return -EOPNOTSUPP;
5041
5042         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5043         chan = ieee80211_get_channel(&rdev->wiphy,
5044                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5045         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5046                 return -EINVAL;
5047
5048         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5049         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5050
5051         if (info->attrs[NL80211_ATTR_IE]) {
5052                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5053                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5054         }
5055
5056         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5057         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5058                 return -EINVAL;
5059
5060         if (auth_type == NL80211_AUTHTYPE_SAE &&
5061             !info->attrs[NL80211_ATTR_SAE_DATA])
5062                 return -EINVAL;
5063
5064         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5065                 if (auth_type != NL80211_AUTHTYPE_SAE)
5066                         return -EINVAL;
5067                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5068                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5069                 /* need to include at least Auth Transaction and Status Code */
5070                 if (sae_data_len < 4)
5071                         return -EINVAL;
5072         }
5073
5074         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5075
5076         /*
5077          * Since we no longer track auth state, ignore
5078          * requests to only change local state.
5079          */
5080         if (local_state_change)
5081                 return 0;
5082
5083         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5084                                   ssid, ssid_len, ie, ie_len,
5085                                   key.p.key, key.p.key_len, key.idx,
5086                                   sae_data, sae_data_len);
5087 }
5088
5089 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5090                                    struct genl_info *info,
5091                                    struct cfg80211_crypto_settings *settings,
5092                                    int cipher_limit)
5093 {
5094         memset(settings, 0, sizeof(*settings));
5095
5096         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5097
5098         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5099                 u16 proto;
5100                 proto = nla_get_u16(
5101                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5102                 settings->control_port_ethertype = cpu_to_be16(proto);
5103                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5104                     proto != ETH_P_PAE)
5105                         return -EINVAL;
5106                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5107                         settings->control_port_no_encrypt = true;
5108         } else
5109                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5110
5111         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5112                 void *data;
5113                 int len, i;
5114
5115                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5116                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5117                 settings->n_ciphers_pairwise = len / sizeof(u32);
5118
5119                 if (len % sizeof(u32))
5120                         return -EINVAL;
5121
5122                 if (settings->n_ciphers_pairwise > cipher_limit)
5123                         return -EINVAL;
5124
5125                 memcpy(settings->ciphers_pairwise, data, len);
5126
5127                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5128                         if (!cfg80211_supported_cipher_suite(
5129                                         &rdev->wiphy,
5130                                         settings->ciphers_pairwise[i]))
5131                                 return -EINVAL;
5132         }
5133
5134         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5135                 settings->cipher_group =
5136                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5137                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5138                                                      settings->cipher_group))
5139                         return -EINVAL;
5140         }
5141
5142         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5143                 settings->wpa_versions =
5144                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5145                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5146                         return -EINVAL;
5147         }
5148
5149         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5150                 void *data;
5151                 int len;
5152
5153                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5154                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5155                 settings->n_akm_suites = len / sizeof(u32);
5156
5157                 if (len % sizeof(u32))
5158                         return -EINVAL;
5159
5160                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
5161                         return -EINVAL;
5162
5163                 memcpy(settings->akm_suites, data, len);
5164         }
5165
5166         return 0;
5167 }
5168
5169 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
5170 {
5171         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5172         struct net_device *dev = info->user_ptr[1];
5173         struct cfg80211_crypto_settings crypto;
5174         struct ieee80211_channel *chan;
5175         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
5176         int err, ssid_len, ie_len = 0;
5177         bool use_mfp = false;
5178         u32 flags = 0;
5179         struct ieee80211_ht_cap *ht_capa = NULL;
5180         struct ieee80211_ht_cap *ht_capa_mask = NULL;
5181
5182         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5183                 return -EINVAL;
5184
5185         if (!info->attrs[NL80211_ATTR_MAC] ||
5186             !info->attrs[NL80211_ATTR_SSID] ||
5187             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5188                 return -EINVAL;
5189
5190         if (!rdev->ops->assoc)
5191                 return -EOPNOTSUPP;
5192
5193         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5194             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5195                 return -EOPNOTSUPP;
5196
5197         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5198
5199         chan = ieee80211_get_channel(&rdev->wiphy,
5200                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5201         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5202                 return -EINVAL;
5203
5204         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5205         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5206
5207         if (info->attrs[NL80211_ATTR_IE]) {
5208                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5209                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5210         }
5211
5212         if (info->attrs[NL80211_ATTR_USE_MFP]) {
5213                 enum nl80211_mfp mfp =
5214                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
5215                 if (mfp == NL80211_MFP_REQUIRED)
5216                         use_mfp = true;
5217                 else if (mfp != NL80211_MFP_NO)
5218                         return -EINVAL;
5219         }
5220
5221         if (info->attrs[NL80211_ATTR_PREV_BSSID])
5222                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
5223
5224         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5225                 flags |= ASSOC_REQ_DISABLE_HT;
5226
5227         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5228                 ht_capa_mask =
5229                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
5230
5231         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5232                 if (!ht_capa_mask)
5233                         return -EINVAL;
5234                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5235         }
5236
5237         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
5238         if (!err)
5239                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
5240                                           ssid, ssid_len, ie, ie_len, use_mfp,
5241                                           &crypto, flags, ht_capa,
5242                                           ht_capa_mask);
5243
5244         return err;
5245 }
5246
5247 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
5248 {
5249         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5250         struct net_device *dev = info->user_ptr[1];
5251         const u8 *ie = NULL, *bssid;
5252         int ie_len = 0;
5253         u16 reason_code;
5254         bool local_state_change;
5255
5256         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5257                 return -EINVAL;
5258
5259         if (!info->attrs[NL80211_ATTR_MAC])
5260                 return -EINVAL;
5261
5262         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5263                 return -EINVAL;
5264
5265         if (!rdev->ops->deauth)
5266                 return -EOPNOTSUPP;
5267
5268         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5269             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5270                 return -EOPNOTSUPP;
5271
5272         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5273
5274         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5275         if (reason_code == 0) {
5276                 /* Reason Code 0 is reserved */
5277                 return -EINVAL;
5278         }
5279
5280         if (info->attrs[NL80211_ATTR_IE]) {
5281                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5282                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5283         }
5284
5285         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5286
5287         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
5288                                     local_state_change);
5289 }
5290
5291 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
5292 {
5293         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5294         struct net_device *dev = info->user_ptr[1];
5295         const u8 *ie = NULL, *bssid;
5296         int ie_len = 0;
5297         u16 reason_code;
5298         bool local_state_change;
5299
5300         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5301                 return -EINVAL;
5302
5303         if (!info->attrs[NL80211_ATTR_MAC])
5304                 return -EINVAL;
5305
5306         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5307                 return -EINVAL;
5308
5309         if (!rdev->ops->disassoc)
5310                 return -EOPNOTSUPP;
5311
5312         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5313             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5314                 return -EOPNOTSUPP;
5315
5316         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5317
5318         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5319         if (reason_code == 0) {
5320                 /* Reason Code 0 is reserved */
5321                 return -EINVAL;
5322         }
5323
5324         if (info->attrs[NL80211_ATTR_IE]) {
5325                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5326                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5327         }
5328
5329         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5330
5331         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
5332                                       local_state_change);
5333 }
5334
5335 static bool
5336 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
5337                          int mcast_rate[IEEE80211_NUM_BANDS],
5338                          int rateval)
5339 {
5340         struct wiphy *wiphy = &rdev->wiphy;
5341         bool found = false;
5342         int band, i;
5343
5344         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5345                 struct ieee80211_supported_band *sband;
5346
5347                 sband = wiphy->bands[band];
5348                 if (!sband)
5349                         continue;
5350
5351                 for (i = 0; i < sband->n_bitrates; i++) {
5352                         if (sband->bitrates[i].bitrate == rateval) {
5353                                 mcast_rate[band] = i + 1;
5354                                 found = true;
5355                                 break;
5356                         }
5357                 }
5358         }
5359
5360         return found;
5361 }
5362
5363 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
5364 {
5365         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5366         struct net_device *dev = info->user_ptr[1];
5367         struct cfg80211_ibss_params ibss;
5368         struct wiphy *wiphy;
5369         struct cfg80211_cached_keys *connkeys = NULL;
5370         int err;
5371
5372         memset(&ibss, 0, sizeof(ibss));
5373
5374         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5375                 return -EINVAL;
5376
5377         if (!info->attrs[NL80211_ATTR_SSID] ||
5378             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5379                 return -EINVAL;
5380
5381         ibss.beacon_interval = 100;
5382
5383         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
5384                 ibss.beacon_interval =
5385                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5386                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
5387                         return -EINVAL;
5388         }
5389
5390         if (!rdev->ops->join_ibss)
5391                 return -EOPNOTSUPP;
5392
5393         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5394                 return -EOPNOTSUPP;
5395
5396         wiphy = &rdev->wiphy;
5397
5398         if (info->attrs[NL80211_ATTR_MAC]) {
5399                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5400
5401                 if (!is_valid_ether_addr(ibss.bssid))
5402                         return -EINVAL;
5403         }
5404         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5405         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5406
5407         if (info->attrs[NL80211_ATTR_IE]) {
5408                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5409                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5410         }
5411
5412         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
5413         if (err)
5414                 return err;
5415
5416         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
5417                 return -EINVAL;
5418
5419         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
5420         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5421
5422         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5423                 u8 *rates =
5424                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5425                 int n_rates =
5426                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5427                 struct ieee80211_supported_band *sband =
5428                         wiphy->bands[ibss.chandef.chan->band];
5429
5430                 err = ieee80211_get_ratemask(sband, rates, n_rates,
5431                                              &ibss.basic_rates);
5432                 if (err)
5433                         return err;
5434         }
5435
5436         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5437             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
5438                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5439                 return -EINVAL;
5440
5441         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5442                 bool no_ht = false;
5443
5444                 connkeys = nl80211_parse_connkeys(rdev,
5445                                           info->attrs[NL80211_ATTR_KEYS],
5446                                           &no_ht);
5447                 if (IS_ERR(connkeys))
5448                         return PTR_ERR(connkeys);
5449
5450                 if ((ibss.chandef._type != NL80211_CHAN_NO_HT) && no_ht) {
5451                         kfree(connkeys);
5452                         return -EINVAL;
5453                 }
5454         }
5455
5456         ibss.control_port =
5457                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
5458
5459         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
5460         if (err)
5461                 kfree(connkeys);
5462         return err;
5463 }
5464
5465 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
5466 {
5467         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5468         struct net_device *dev = info->user_ptr[1];
5469
5470         if (!rdev->ops->leave_ibss)
5471                 return -EOPNOTSUPP;
5472
5473         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5474                 return -EOPNOTSUPP;
5475
5476         return cfg80211_leave_ibss(rdev, dev, false);
5477 }
5478
5479 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
5480 {
5481         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5482         struct net_device *dev = info->user_ptr[1];
5483         int mcast_rate[IEEE80211_NUM_BANDS];
5484         u32 nla_rate;
5485         int err;
5486
5487         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
5488             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5489                 return -EOPNOTSUPP;
5490
5491         if (!rdev->ops->set_mcast_rate)
5492                 return -EOPNOTSUPP;
5493
5494         memset(mcast_rate, 0, sizeof(mcast_rate));
5495
5496         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
5497                 return -EINVAL;
5498
5499         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
5500         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
5501                 return -EINVAL;
5502
5503         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
5504
5505         return err;
5506 }
5507
5508
5509 #ifdef CONFIG_NL80211_TESTMODE
5510 static struct genl_multicast_group nl80211_testmode_mcgrp = {
5511         .name = "testmode",
5512 };
5513
5514 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
5515 {
5516         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5517         int err;
5518
5519         if (!info->attrs[NL80211_ATTR_TESTDATA])
5520                 return -EINVAL;
5521
5522         err = -EOPNOTSUPP;
5523         if (rdev->ops->testmode_cmd) {
5524                 rdev->testmode_info = info;
5525                 err = rdev_testmode_cmd(rdev,
5526                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
5527                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
5528                 rdev->testmode_info = NULL;
5529         }
5530
5531         return err;
5532 }
5533
5534 static int nl80211_testmode_dump(struct sk_buff *skb,
5535                                  struct netlink_callback *cb)
5536 {
5537         struct cfg80211_registered_device *rdev;
5538         int err;
5539         long phy_idx;
5540         void *data = NULL;
5541         int data_len = 0;
5542
5543         if (cb->args[0]) {
5544                 /*
5545                  * 0 is a valid index, but not valid for args[0],
5546                  * so we need to offset by 1.
5547                  */
5548                 phy_idx = cb->args[0] - 1;
5549         } else {
5550                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
5551                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
5552                                   nl80211_policy);
5553                 if (err)
5554                         return err;
5555
5556                 mutex_lock(&cfg80211_mutex);
5557                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
5558                                                   nl80211_fam.attrbuf);
5559                 if (IS_ERR(rdev)) {
5560                         mutex_unlock(&cfg80211_mutex);
5561                         return PTR_ERR(rdev);
5562                 }
5563                 phy_idx = rdev->wiphy_idx;
5564                 rdev = NULL;
5565                 mutex_unlock(&cfg80211_mutex);
5566
5567                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
5568                         cb->args[1] =
5569                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
5570         }
5571
5572         if (cb->args[1]) {
5573                 data = nla_data((void *)cb->args[1]);
5574                 data_len = nla_len((void *)cb->args[1]);
5575         }
5576
5577         mutex_lock(&cfg80211_mutex);
5578         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
5579         if (!rdev) {
5580                 mutex_unlock(&cfg80211_mutex);
5581                 return -ENOENT;
5582         }
5583         cfg80211_lock_rdev(rdev);
5584         mutex_unlock(&cfg80211_mutex);
5585
5586         if (!rdev->ops->testmode_dump) {
5587                 err = -EOPNOTSUPP;
5588                 goto out_err;
5589         }
5590
5591         while (1) {
5592                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
5593                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
5594                                            NL80211_CMD_TESTMODE);
5595                 struct nlattr *tmdata;
5596
5597                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
5598                         genlmsg_cancel(skb, hdr);
5599                         break;
5600                 }
5601
5602                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5603                 if (!tmdata) {
5604                         genlmsg_cancel(skb, hdr);
5605                         break;
5606                 }
5607                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
5608                 nla_nest_end(skb, tmdata);
5609
5610                 if (err == -ENOBUFS || err == -ENOENT) {
5611                         genlmsg_cancel(skb, hdr);
5612                         break;
5613                 } else if (err) {
5614                         genlmsg_cancel(skb, hdr);
5615                         goto out_err;
5616                 }
5617
5618                 genlmsg_end(skb, hdr);
5619         }
5620
5621         err = skb->len;
5622         /* see above */
5623         cb->args[0] = phy_idx + 1;
5624  out_err:
5625         cfg80211_unlock_rdev(rdev);
5626         return err;
5627 }
5628
5629 static struct sk_buff *
5630 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
5631                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
5632 {
5633         struct sk_buff *skb;
5634         void *hdr;
5635         struct nlattr *data;
5636
5637         skb = nlmsg_new(approxlen + 100, gfp);
5638         if (!skb)
5639                 return NULL;
5640
5641         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
5642         if (!hdr) {
5643                 kfree_skb(skb);
5644                 return NULL;
5645         }
5646
5647         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
5648                 goto nla_put_failure;
5649         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5650
5651         ((void **)skb->cb)[0] = rdev;
5652         ((void **)skb->cb)[1] = hdr;
5653         ((void **)skb->cb)[2] = data;
5654
5655         return skb;
5656
5657  nla_put_failure:
5658         kfree_skb(skb);
5659         return NULL;
5660 }
5661
5662 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
5663                                                   int approxlen)
5664 {
5665         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5666
5667         if (WARN_ON(!rdev->testmode_info))
5668                 return NULL;
5669
5670         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
5671                                 rdev->testmode_info->snd_portid,
5672                                 rdev->testmode_info->snd_seq,
5673                                 GFP_KERNEL);
5674 }
5675 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
5676
5677 int cfg80211_testmode_reply(struct sk_buff *skb)
5678 {
5679         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
5680         void *hdr = ((void **)skb->cb)[1];
5681         struct nlattr *data = ((void **)skb->cb)[2];
5682
5683         if (WARN_ON(!rdev->testmode_info)) {
5684                 kfree_skb(skb);
5685                 return -EINVAL;
5686         }
5687
5688         nla_nest_end(skb, data);
5689         genlmsg_end(skb, hdr);
5690         return genlmsg_reply(skb, rdev->testmode_info);
5691 }
5692 EXPORT_SYMBOL(cfg80211_testmode_reply);
5693
5694 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
5695                                                   int approxlen, gfp_t gfp)
5696 {
5697         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5698
5699         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
5700 }
5701 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
5702
5703 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
5704 {
5705         void *hdr = ((void **)skb->cb)[1];
5706         struct nlattr *data = ((void **)skb->cb)[2];
5707
5708         nla_nest_end(skb, data);
5709         genlmsg_end(skb, hdr);
5710         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
5711 }
5712 EXPORT_SYMBOL(cfg80211_testmode_event);
5713 #endif
5714
5715 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
5716 {
5717         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5718         struct net_device *dev = info->user_ptr[1];
5719         struct cfg80211_connect_params connect;
5720         struct wiphy *wiphy;
5721         struct cfg80211_cached_keys *connkeys = NULL;
5722         int err;
5723
5724         memset(&connect, 0, sizeof(connect));
5725
5726         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5727                 return -EINVAL;
5728
5729         if (!info->attrs[NL80211_ATTR_SSID] ||
5730             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5731                 return -EINVAL;
5732
5733         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5734                 connect.auth_type =
5735                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5736                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
5737                                              NL80211_CMD_CONNECT))
5738                         return -EINVAL;
5739         } else
5740                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5741
5742         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
5743
5744         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
5745                                       NL80211_MAX_NR_CIPHER_SUITES);
5746         if (err)
5747                 return err;
5748
5749         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5750             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5751                 return -EOPNOTSUPP;
5752
5753         wiphy = &rdev->wiphy;
5754
5755         connect.bg_scan_period = -1;
5756         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
5757                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
5758                 connect.bg_scan_period =
5759                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
5760         }
5761
5762         if (info->attrs[NL80211_ATTR_MAC])
5763                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5764         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5765         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5766
5767         if (info->attrs[NL80211_ATTR_IE]) {
5768                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5769                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5770         }
5771
5772         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5773                 connect.channel =
5774                         ieee80211_get_channel(wiphy,
5775                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5776                 if (!connect.channel ||
5777                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
5778                         return -EINVAL;
5779         }
5780
5781         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5782                 connkeys = nl80211_parse_connkeys(rdev,
5783                                           info->attrs[NL80211_ATTR_KEYS], NULL);
5784                 if (IS_ERR(connkeys))
5785                         return PTR_ERR(connkeys);
5786         }
5787
5788         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5789                 connect.flags |= ASSOC_REQ_DISABLE_HT;
5790
5791         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5792                 memcpy(&connect.ht_capa_mask,
5793                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
5794                        sizeof(connect.ht_capa_mask));
5795
5796         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5797                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
5798                         kfree(connkeys);
5799                         return -EINVAL;
5800                 }
5801                 memcpy(&connect.ht_capa,
5802                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
5803                        sizeof(connect.ht_capa));
5804         }
5805
5806         err = cfg80211_connect(rdev, dev, &connect, connkeys);
5807         if (err)
5808                 kfree(connkeys);
5809         return err;
5810 }
5811
5812 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
5813 {
5814         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5815         struct net_device *dev = info->user_ptr[1];
5816         u16 reason;
5817
5818         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5819                 reason = WLAN_REASON_DEAUTH_LEAVING;
5820         else
5821                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5822
5823         if (reason == 0)
5824                 return -EINVAL;
5825
5826         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5827             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5828                 return -EOPNOTSUPP;
5829
5830         return cfg80211_disconnect(rdev, dev, reason, true);
5831 }
5832
5833 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
5834 {
5835         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5836         struct net *net;
5837         int err;
5838         u32 pid;
5839
5840         if (!info->attrs[NL80211_ATTR_PID])
5841                 return -EINVAL;
5842
5843         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
5844
5845         net = get_net_ns_by_pid(pid);
5846         if (IS_ERR(net))
5847                 return PTR_ERR(net);
5848
5849         err = 0;
5850
5851         /* check if anything to do */
5852         if (!net_eq(wiphy_net(&rdev->wiphy), net))
5853                 err = cfg80211_switch_netns(rdev, net);
5854
5855         put_net(net);
5856         return err;
5857 }
5858
5859 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
5860 {
5861         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5862         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
5863                         struct cfg80211_pmksa *pmksa) = NULL;
5864         struct net_device *dev = info->user_ptr[1];
5865         struct cfg80211_pmksa pmksa;
5866
5867         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
5868
5869         if (!info->attrs[NL80211_ATTR_MAC])
5870                 return -EINVAL;
5871
5872         if (!info->attrs[NL80211_ATTR_PMKID])
5873                 return -EINVAL;
5874
5875         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
5876         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5877
5878         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5879             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5880                 return -EOPNOTSUPP;
5881
5882         switch (info->genlhdr->cmd) {
5883         case NL80211_CMD_SET_PMKSA:
5884                 rdev_ops = rdev->ops->set_pmksa;
5885                 break;
5886         case NL80211_CMD_DEL_PMKSA:
5887                 rdev_ops = rdev->ops->del_pmksa;
5888                 break;
5889         default:
5890                 WARN_ON(1);
5891                 break;
5892         }
5893
5894         if (!rdev_ops)
5895                 return -EOPNOTSUPP;
5896
5897         return rdev_ops(&rdev->wiphy, dev, &pmksa);
5898 }
5899
5900 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
5901 {
5902         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5903         struct net_device *dev = info->user_ptr[1];
5904
5905         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5906             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5907                 return -EOPNOTSUPP;
5908
5909         if (!rdev->ops->flush_pmksa)
5910                 return -EOPNOTSUPP;
5911
5912         return rdev_flush_pmksa(rdev, dev);
5913 }
5914
5915 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
5916 {
5917         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5918         struct net_device *dev = info->user_ptr[1];
5919         u8 action_code, dialog_token;
5920         u16 status_code;
5921         u8 *peer;
5922
5923         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5924             !rdev->ops->tdls_mgmt)
5925                 return -EOPNOTSUPP;
5926
5927         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
5928             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
5929             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
5930             !info->attrs[NL80211_ATTR_IE] ||
5931             !info->attrs[NL80211_ATTR_MAC])
5932                 return -EINVAL;
5933
5934         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5935         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
5936         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
5937         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
5938
5939         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
5940                               dialog_token, status_code,
5941                               nla_data(info->attrs[NL80211_ATTR_IE]),
5942                               nla_len(info->attrs[NL80211_ATTR_IE]));
5943 }
5944
5945 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
5946 {
5947         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5948         struct net_device *dev = info->user_ptr[1];
5949         enum nl80211_tdls_operation operation;
5950         u8 *peer;
5951
5952         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5953             !rdev->ops->tdls_oper)
5954                 return -EOPNOTSUPP;
5955
5956         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
5957             !info->attrs[NL80211_ATTR_MAC])
5958                 return -EINVAL;
5959
5960         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
5961         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5962
5963         return rdev_tdls_oper(rdev, dev, peer, operation);
5964 }
5965
5966 static int nl80211_remain_on_channel(struct sk_buff *skb,
5967                                      struct genl_info *info)
5968 {
5969         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5970         struct wireless_dev *wdev = info->user_ptr[1];
5971         struct cfg80211_chan_def chandef;
5972         struct sk_buff *msg;
5973         void *hdr;
5974         u64 cookie;
5975         u32 duration;
5976         int err;
5977
5978         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5979             !info->attrs[NL80211_ATTR_DURATION])
5980                 return -EINVAL;
5981
5982         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5983
5984         if (!rdev->ops->remain_on_channel ||
5985             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
5986                 return -EOPNOTSUPP;
5987
5988         /*
5989          * We should be on that channel for at least a minimum amount of
5990          * time (10ms) but no longer than the driver supports.
5991          */
5992         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
5993             duration > rdev->wiphy.max_remain_on_channel_duration)
5994                 return -EINVAL;
5995
5996         err = nl80211_parse_chandef(rdev, info, &chandef);
5997         if (err)
5998                 return err;
5999
6000         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6001         if (!msg)
6002                 return -ENOMEM;
6003
6004         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6005                              NL80211_CMD_REMAIN_ON_CHANNEL);
6006
6007         if (IS_ERR(hdr)) {
6008                 err = PTR_ERR(hdr);
6009                 goto free_msg;
6010         }
6011
6012         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
6013                                      duration, &cookie);
6014
6015         if (err)
6016                 goto free_msg;
6017
6018         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6019                 goto nla_put_failure;
6020
6021         genlmsg_end(msg, hdr);
6022
6023         return genlmsg_reply(msg, info);
6024
6025  nla_put_failure:
6026         err = -ENOBUFS;
6027  free_msg:
6028         nlmsg_free(msg);
6029         return err;
6030 }
6031
6032 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
6033                                             struct genl_info *info)
6034 {
6035         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6036         struct wireless_dev *wdev = info->user_ptr[1];
6037         u64 cookie;
6038
6039         if (!info->attrs[NL80211_ATTR_COOKIE])
6040                 return -EINVAL;
6041
6042         if (!rdev->ops->cancel_remain_on_channel)
6043                 return -EOPNOTSUPP;
6044
6045         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6046
6047         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
6048 }
6049
6050 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
6051                            u8 *rates, u8 rates_len)
6052 {
6053         u8 i;
6054         u32 mask = 0;
6055
6056         for (i = 0; i < rates_len; i++) {
6057                 int rate = (rates[i] & 0x7f) * 5;
6058                 int ridx;
6059                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6060                         struct ieee80211_rate *srate =
6061                                 &sband->bitrates[ridx];
6062                         if (rate == srate->bitrate) {
6063                                 mask |= 1 << ridx;
6064                                 break;
6065                         }
6066                 }
6067                 if (ridx == sband->n_bitrates)
6068                         return 0; /* rate not found */
6069         }
6070
6071         return mask;
6072 }
6073
6074 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6075                                u8 *rates, u8 rates_len,
6076                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6077 {
6078         u8 i;
6079
6080         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6081
6082         for (i = 0; i < rates_len; i++) {
6083                 int ridx, rbit;
6084
6085                 ridx = rates[i] / 8;
6086                 rbit = BIT(rates[i] % 8);
6087
6088                 /* check validity */
6089                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6090                         return false;
6091
6092                 /* check availability */
6093                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
6094                         mcs[ridx] |= rbit;
6095                 else
6096                         return false;
6097         }
6098
6099         return true;
6100 }
6101
6102 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
6103         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
6104                                     .len = NL80211_MAX_SUPP_RATES },
6105         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
6106                                  .len = NL80211_MAX_SUPP_HT_RATES },
6107 };
6108
6109 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
6110                                        struct genl_info *info)
6111 {
6112         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
6113         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6114         struct cfg80211_bitrate_mask mask;
6115         int rem, i;
6116         struct net_device *dev = info->user_ptr[1];
6117         struct nlattr *tx_rates;
6118         struct ieee80211_supported_band *sband;
6119
6120         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
6121                 return -EINVAL;
6122
6123         if (!rdev->ops->set_bitrate_mask)
6124                 return -EOPNOTSUPP;
6125
6126         memset(&mask, 0, sizeof(mask));
6127         /* Default to all rates enabled */
6128         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
6129                 sband = rdev->wiphy.bands[i];
6130                 mask.control[i].legacy =
6131                         sband ? (1 << sband->n_bitrates) - 1 : 0;
6132                 if (sband)
6133                         memcpy(mask.control[i].mcs,
6134                                sband->ht_cap.mcs.rx_mask,
6135                                sizeof(mask.control[i].mcs));
6136                 else
6137                         memset(mask.control[i].mcs, 0,
6138                                sizeof(mask.control[i].mcs));
6139         }
6140
6141         /*
6142          * The nested attribute uses enum nl80211_band as the index. This maps
6143          * directly to the enum ieee80211_band values used in cfg80211.
6144          */
6145         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
6146         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
6147         {
6148                 enum ieee80211_band band = nla_type(tx_rates);
6149                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
6150                         return -EINVAL;
6151                 sband = rdev->wiphy.bands[band];
6152                 if (sband == NULL)
6153                         return -EINVAL;
6154                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
6155                           nla_len(tx_rates), nl80211_txattr_policy);
6156                 if (tb[NL80211_TXRATE_LEGACY]) {
6157                         mask.control[band].legacy = rateset_to_mask(
6158                                 sband,
6159                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
6160                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
6161                         if ((mask.control[band].legacy == 0) &&
6162                             nla_len(tb[NL80211_TXRATE_LEGACY]))
6163                                 return -EINVAL;
6164                 }
6165                 if (tb[NL80211_TXRATE_MCS]) {
6166                         if (!ht_rateset_to_mask(
6167                                         sband,
6168                                         nla_data(tb[NL80211_TXRATE_MCS]),
6169                                         nla_len(tb[NL80211_TXRATE_MCS]),
6170                                         mask.control[band].mcs))
6171                                 return -EINVAL;
6172                 }
6173
6174                 if (mask.control[band].legacy == 0) {
6175                         /* don't allow empty legacy rates if HT
6176                          * is not even supported. */
6177                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
6178                                 return -EINVAL;
6179
6180                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
6181                                 if (mask.control[band].mcs[i])
6182                                         break;
6183
6184                         /* legacy and mcs rates may not be both empty */
6185                         if (i == IEEE80211_HT_MCS_MASK_LEN)
6186                                 return -EINVAL;
6187                 }
6188         }
6189
6190         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
6191 }
6192
6193 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
6194 {
6195         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6196         struct wireless_dev *wdev = info->user_ptr[1];
6197         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
6198
6199         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
6200                 return -EINVAL;
6201
6202         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
6203                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
6204
6205         switch (wdev->iftype) {
6206         case NL80211_IFTYPE_STATION:
6207         case NL80211_IFTYPE_ADHOC:
6208         case NL80211_IFTYPE_P2P_CLIENT:
6209         case NL80211_IFTYPE_AP:
6210         case NL80211_IFTYPE_AP_VLAN:
6211         case NL80211_IFTYPE_MESH_POINT:
6212         case NL80211_IFTYPE_P2P_GO:
6213         case NL80211_IFTYPE_P2P_DEVICE:
6214                 break;
6215         default:
6216                 return -EOPNOTSUPP;
6217         }
6218
6219         /* not much point in registering if we can't reply */
6220         if (!rdev->ops->mgmt_tx)
6221                 return -EOPNOTSUPP;
6222
6223         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
6224                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
6225                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
6226 }
6227
6228 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
6229 {
6230         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6231         struct wireless_dev *wdev = info->user_ptr[1];
6232         struct cfg80211_chan_def chandef;
6233         int err;
6234         void *hdr = NULL;
6235         u64 cookie;
6236         struct sk_buff *msg = NULL;
6237         unsigned int wait = 0;
6238         bool offchan, no_cck, dont_wait_for_ack;
6239
6240         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
6241
6242         if (!info->attrs[NL80211_ATTR_FRAME])
6243                 return -EINVAL;
6244
6245         if (!rdev->ops->mgmt_tx)
6246                 return -EOPNOTSUPP;
6247
6248         switch (wdev->iftype) {
6249         case NL80211_IFTYPE_STATION:
6250         case NL80211_IFTYPE_ADHOC:
6251         case NL80211_IFTYPE_P2P_CLIENT:
6252         case NL80211_IFTYPE_AP:
6253         case NL80211_IFTYPE_AP_VLAN:
6254         case NL80211_IFTYPE_MESH_POINT:
6255         case NL80211_IFTYPE_P2P_GO:
6256         case NL80211_IFTYPE_P2P_DEVICE:
6257                 break;
6258         default:
6259                 return -EOPNOTSUPP;
6260         }
6261
6262         if (info->attrs[NL80211_ATTR_DURATION]) {
6263                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6264                         return -EINVAL;
6265                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6266
6267                 /*
6268                  * We should wait on the channel for at least a minimum amount
6269                  * of time (10ms) but no longer than the driver supports.
6270                  */
6271                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6272                     wait > rdev->wiphy.max_remain_on_channel_duration)
6273                         return -EINVAL;
6274
6275         }
6276
6277         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
6278
6279         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6280                 return -EINVAL;
6281
6282         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6283
6284         err = nl80211_parse_chandef(rdev, info, &chandef);
6285         if (err)
6286                 return err;
6287
6288         if (!dont_wait_for_ack) {
6289                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6290                 if (!msg)
6291                         return -ENOMEM;
6292
6293                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6294                                      NL80211_CMD_FRAME);
6295
6296                 if (IS_ERR(hdr)) {
6297                         err = PTR_ERR(hdr);
6298                         goto free_msg;
6299                 }
6300         }
6301
6302         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chandef.chan, offchan, wait,
6303                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
6304                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
6305                                     no_cck, dont_wait_for_ack, &cookie);
6306         if (err)
6307                 goto free_msg;
6308
6309         if (msg) {
6310                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6311                         goto nla_put_failure;
6312
6313                 genlmsg_end(msg, hdr);
6314                 return genlmsg_reply(msg, info);
6315         }
6316
6317         return 0;
6318
6319  nla_put_failure:
6320         err = -ENOBUFS;
6321  free_msg:
6322         nlmsg_free(msg);
6323         return err;
6324 }
6325
6326 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
6327 {
6328         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6329         struct wireless_dev *wdev = info->user_ptr[1];
6330         u64 cookie;
6331
6332         if (!info->attrs[NL80211_ATTR_COOKIE])
6333                 return -EINVAL;
6334
6335         if (!rdev->ops->mgmt_tx_cancel_wait)
6336                 return -EOPNOTSUPP;
6337
6338         switch (wdev->iftype) {
6339         case NL80211_IFTYPE_STATION:
6340         case NL80211_IFTYPE_ADHOC:
6341         case NL80211_IFTYPE_P2P_CLIENT:
6342         case NL80211_IFTYPE_AP:
6343         case NL80211_IFTYPE_AP_VLAN:
6344         case NL80211_IFTYPE_P2P_GO:
6345         case NL80211_IFTYPE_P2P_DEVICE:
6346                 break;
6347         default:
6348                 return -EOPNOTSUPP;
6349         }
6350
6351         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6352
6353         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
6354 }
6355
6356 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
6357 {
6358         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6359         struct wireless_dev *wdev;
6360         struct net_device *dev = info->user_ptr[1];
6361         u8 ps_state;
6362         bool state;
6363         int err;
6364
6365         if (!info->attrs[NL80211_ATTR_PS_STATE])
6366                 return -EINVAL;
6367
6368         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
6369
6370         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
6371                 return -EINVAL;
6372
6373         wdev = dev->ieee80211_ptr;
6374
6375         if (!rdev->ops->set_power_mgmt)
6376                 return -EOPNOTSUPP;
6377
6378         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
6379
6380         if (state == wdev->ps)
6381                 return 0;
6382
6383         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
6384         if (!err)
6385                 wdev->ps = state;
6386         return err;
6387 }
6388
6389 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
6390 {
6391         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6392         enum nl80211_ps_state ps_state;
6393         struct wireless_dev *wdev;
6394         struct net_device *dev = info->user_ptr[1];
6395         struct sk_buff *msg;
6396         void *hdr;
6397         int err;
6398
6399         wdev = dev->ieee80211_ptr;
6400
6401         if (!rdev->ops->set_power_mgmt)
6402                 return -EOPNOTSUPP;
6403
6404         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6405         if (!msg)
6406                 return -ENOMEM;
6407
6408         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6409                              NL80211_CMD_GET_POWER_SAVE);
6410         if (!hdr) {
6411                 err = -ENOBUFS;
6412                 goto free_msg;
6413         }
6414
6415         if (wdev->ps)
6416                 ps_state = NL80211_PS_ENABLED;
6417         else
6418                 ps_state = NL80211_PS_DISABLED;
6419
6420         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
6421                 goto nla_put_failure;
6422
6423         genlmsg_end(msg, hdr);
6424         return genlmsg_reply(msg, info);
6425
6426  nla_put_failure:
6427         err = -ENOBUFS;
6428  free_msg:
6429         nlmsg_free(msg);
6430         return err;
6431 }
6432
6433 static struct nla_policy
6434 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
6435         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
6436         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
6437         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
6438         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
6439         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
6440         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
6441 };
6442
6443 static int nl80211_set_cqm_txe(struct genl_info *info,
6444                                 u32 rate, u32 pkts, u32 intvl)
6445 {
6446         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6447         struct wireless_dev *wdev;
6448         struct net_device *dev = info->user_ptr[1];
6449
6450         if ((rate < 0 || rate > 100) ||
6451             (intvl < 0 || intvl > NL80211_CQM_TXE_MAX_INTVL))
6452                 return -EINVAL;
6453
6454         wdev = dev->ieee80211_ptr;
6455
6456         if (!rdev->ops->set_cqm_txe_config)
6457                 return -EOPNOTSUPP;
6458
6459         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6460             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6461                 return -EOPNOTSUPP;
6462
6463         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
6464 }
6465
6466 static int nl80211_set_cqm_rssi(struct genl_info *info,
6467                                 s32 threshold, u32 hysteresis)
6468 {
6469         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6470         struct wireless_dev *wdev;
6471         struct net_device *dev = info->user_ptr[1];
6472
6473         if (threshold > 0)
6474                 return -EINVAL;
6475
6476         wdev = dev->ieee80211_ptr;
6477
6478         if (!rdev->ops->set_cqm_rssi_config)
6479                 return -EOPNOTSUPP;
6480
6481         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6482             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6483                 return -EOPNOTSUPP;
6484
6485         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
6486 }
6487
6488 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
6489 {
6490         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
6491         struct nlattr *cqm;
6492         int err;
6493
6494         cqm = info->attrs[NL80211_ATTR_CQM];
6495         if (!cqm) {
6496                 err = -EINVAL;
6497                 goto out;
6498         }
6499
6500         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
6501                                nl80211_attr_cqm_policy);
6502         if (err)
6503                 goto out;
6504
6505         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
6506             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
6507                 s32 threshold;
6508                 u32 hysteresis;
6509                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
6510                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
6511                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
6512         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
6513                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
6514                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
6515                 u32 rate, pkts, intvl;
6516                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
6517                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
6518                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
6519                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
6520         } else
6521                 err = -EINVAL;
6522
6523 out:
6524         return err;
6525 }
6526
6527 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
6528 {
6529         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6530         struct net_device *dev = info->user_ptr[1];
6531         struct mesh_config cfg;
6532         struct mesh_setup setup;
6533         int err;
6534
6535         /* start with default */
6536         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
6537         memcpy(&setup, &default_mesh_setup, sizeof(setup));
6538
6539         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
6540                 /* and parse parameters if given */
6541                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
6542                 if (err)
6543                         return err;
6544         }
6545
6546         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
6547             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
6548                 return -EINVAL;
6549
6550         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
6551         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
6552
6553         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6554             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
6555                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6556                         return -EINVAL;
6557
6558         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
6559                 /* parse additional setup parameters if given */
6560                 err = nl80211_parse_mesh_setup(info, &setup);
6561                 if (err)
6562                         return err;
6563         }
6564
6565         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6566                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
6567                 if (err)
6568                         return err;
6569         } else {
6570                 /* cfg80211_join_mesh() will sort it out */
6571                 setup.chandef.chan = NULL;
6572         }
6573
6574         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
6575 }
6576
6577 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
6578 {
6579         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6580         struct net_device *dev = info->user_ptr[1];
6581
6582         return cfg80211_leave_mesh(rdev, dev);
6583 }
6584
6585 #ifdef CONFIG_PM
6586 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
6587 {
6588         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6589         struct sk_buff *msg;
6590         void *hdr;
6591
6592         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6593                 return -EOPNOTSUPP;
6594
6595         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6596         if (!msg)
6597                 return -ENOMEM;
6598
6599         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6600                              NL80211_CMD_GET_WOWLAN);
6601         if (!hdr)
6602                 goto nla_put_failure;
6603
6604         if (rdev->wowlan) {
6605                 struct nlattr *nl_wowlan;
6606
6607                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
6608                 if (!nl_wowlan)
6609                         goto nla_put_failure;
6610
6611                 if ((rdev->wowlan->any &&
6612                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
6613                     (rdev->wowlan->disconnect &&
6614                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
6615                     (rdev->wowlan->magic_pkt &&
6616                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
6617                     (rdev->wowlan->gtk_rekey_failure &&
6618                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
6619                     (rdev->wowlan->eap_identity_req &&
6620                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
6621                     (rdev->wowlan->four_way_handshake &&
6622                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
6623                     (rdev->wowlan->rfkill_release &&
6624                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
6625                         goto nla_put_failure;
6626                 if (rdev->wowlan->n_patterns) {
6627                         struct nlattr *nl_pats, *nl_pat;
6628                         int i, pat_len;
6629
6630                         nl_pats = nla_nest_start(msg,
6631                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
6632                         if (!nl_pats)
6633                                 goto nla_put_failure;
6634
6635                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
6636                                 nl_pat = nla_nest_start(msg, i + 1);
6637                                 if (!nl_pat)
6638                                         goto nla_put_failure;
6639                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
6640                                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
6641                                             DIV_ROUND_UP(pat_len, 8),
6642                                             rdev->wowlan->patterns[i].mask) ||
6643                                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
6644                                             pat_len,
6645                                             rdev->wowlan->patterns[i].pattern))
6646                                         goto nla_put_failure;
6647                                 nla_nest_end(msg, nl_pat);
6648                         }
6649                         nla_nest_end(msg, nl_pats);
6650                 }
6651
6652                 nla_nest_end(msg, nl_wowlan);
6653         }
6654
6655         genlmsg_end(msg, hdr);
6656         return genlmsg_reply(msg, info);
6657
6658 nla_put_failure:
6659         nlmsg_free(msg);
6660         return -ENOBUFS;
6661 }
6662
6663 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
6664 {
6665         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6666         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
6667         struct cfg80211_wowlan new_triggers = {};
6668         struct cfg80211_wowlan *ntrig;
6669         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
6670         int err, i;
6671         bool prev_enabled = rdev->wowlan;
6672
6673         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6674                 return -EOPNOTSUPP;
6675
6676         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
6677                 cfg80211_rdev_free_wowlan(rdev);
6678                 rdev->wowlan = NULL;
6679                 goto set_wakeup;
6680         }
6681
6682         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
6683                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6684                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6685                         nl80211_wowlan_policy);
6686         if (err)
6687                 return err;
6688
6689         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
6690                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
6691                         return -EINVAL;
6692                 new_triggers.any = true;
6693         }
6694
6695         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
6696                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
6697                         return -EINVAL;
6698                 new_triggers.disconnect = true;
6699         }
6700
6701         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
6702                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
6703                         return -EINVAL;
6704                 new_triggers.magic_pkt = true;
6705         }
6706
6707         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
6708                 return -EINVAL;
6709
6710         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
6711                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
6712                         return -EINVAL;
6713                 new_triggers.gtk_rekey_failure = true;
6714         }
6715
6716         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
6717                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
6718                         return -EINVAL;
6719                 new_triggers.eap_identity_req = true;
6720         }
6721
6722         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
6723                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
6724                         return -EINVAL;
6725                 new_triggers.four_way_handshake = true;
6726         }
6727
6728         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
6729                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
6730                         return -EINVAL;
6731                 new_triggers.rfkill_release = true;
6732         }
6733
6734         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
6735                 struct nlattr *pat;
6736                 int n_patterns = 0;
6737                 int rem, pat_len, mask_len;
6738                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
6739
6740                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6741                                     rem)
6742                         n_patterns++;
6743                 if (n_patterns > wowlan->n_patterns)
6744                         return -EINVAL;
6745
6746                 new_triggers.patterns = kcalloc(n_patterns,
6747                                                 sizeof(new_triggers.patterns[0]),
6748                                                 GFP_KERNEL);
6749                 if (!new_triggers.patterns)
6750                         return -ENOMEM;
6751
6752                 new_triggers.n_patterns = n_patterns;
6753                 i = 0;
6754
6755                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6756                                     rem) {
6757                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
6758                                   nla_data(pat), nla_len(pat), NULL);
6759                         err = -EINVAL;
6760                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
6761                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
6762                                 goto error;
6763                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
6764                         mask_len = DIV_ROUND_UP(pat_len, 8);
6765                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
6766                             mask_len)
6767                                 goto error;
6768                         if (pat_len > wowlan->pattern_max_len ||
6769                             pat_len < wowlan->pattern_min_len)
6770                                 goto error;
6771
6772                         new_triggers.patterns[i].mask =
6773                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
6774                         if (!new_triggers.patterns[i].mask) {
6775                                 err = -ENOMEM;
6776                                 goto error;
6777                         }
6778                         new_triggers.patterns[i].pattern =
6779                                 new_triggers.patterns[i].mask + mask_len;
6780                         memcpy(new_triggers.patterns[i].mask,
6781                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
6782                                mask_len);
6783                         new_triggers.patterns[i].pattern_len = pat_len;
6784                         memcpy(new_triggers.patterns[i].pattern,
6785                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
6786                                pat_len);
6787                         i++;
6788                 }
6789         }
6790
6791         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
6792         if (!ntrig) {
6793                 err = -ENOMEM;
6794                 goto error;
6795         }
6796         cfg80211_rdev_free_wowlan(rdev);
6797         rdev->wowlan = ntrig;
6798
6799  set_wakeup:
6800         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
6801                 rdev_set_wakeup(rdev, rdev->wowlan);
6802
6803         return 0;
6804  error:
6805         for (i = 0; i < new_triggers.n_patterns; i++)
6806                 kfree(new_triggers.patterns[i].mask);
6807         kfree(new_triggers.patterns);
6808         return err;
6809 }
6810 #endif
6811
6812 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
6813 {
6814         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6815         struct net_device *dev = info->user_ptr[1];
6816         struct wireless_dev *wdev = dev->ieee80211_ptr;
6817         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
6818         struct cfg80211_gtk_rekey_data rekey_data;
6819         int err;
6820
6821         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
6822                 return -EINVAL;
6823
6824         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
6825                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
6826                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
6827                         nl80211_rekey_policy);
6828         if (err)
6829                 return err;
6830
6831         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
6832                 return -ERANGE;
6833         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
6834                 return -ERANGE;
6835         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
6836                 return -ERANGE;
6837
6838         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
6839                NL80211_KEK_LEN);
6840         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
6841                NL80211_KCK_LEN);
6842         memcpy(rekey_data.replay_ctr,
6843                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
6844                NL80211_REPLAY_CTR_LEN);
6845
6846         wdev_lock(wdev);
6847         if (!wdev->current_bss) {
6848                 err = -ENOTCONN;
6849                 goto out;
6850         }
6851
6852         if (!rdev->ops->set_rekey_data) {
6853                 err = -EOPNOTSUPP;
6854                 goto out;
6855         }
6856
6857         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
6858  out:
6859         wdev_unlock(wdev);
6860         return err;
6861 }
6862
6863 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
6864                                              struct genl_info *info)
6865 {
6866         struct net_device *dev = info->user_ptr[1];
6867         struct wireless_dev *wdev = dev->ieee80211_ptr;
6868
6869         if (wdev->iftype != NL80211_IFTYPE_AP &&
6870             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6871                 return -EINVAL;
6872
6873         if (wdev->ap_unexpected_nlportid)
6874                 return -EBUSY;
6875
6876         wdev->ap_unexpected_nlportid = info->snd_portid;
6877         return 0;
6878 }
6879
6880 static int nl80211_probe_client(struct sk_buff *skb,
6881                                 struct genl_info *info)
6882 {
6883         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6884         struct net_device *dev = info->user_ptr[1];
6885         struct wireless_dev *wdev = dev->ieee80211_ptr;
6886         struct sk_buff *msg;
6887         void *hdr;
6888         const u8 *addr;
6889         u64 cookie;
6890         int err;
6891
6892         if (wdev->iftype != NL80211_IFTYPE_AP &&
6893             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6894                 return -EOPNOTSUPP;
6895
6896         if (!info->attrs[NL80211_ATTR_MAC])
6897                 return -EINVAL;
6898
6899         if (!rdev->ops->probe_client)
6900                 return -EOPNOTSUPP;
6901
6902         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6903         if (!msg)
6904                 return -ENOMEM;
6905
6906         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6907                              NL80211_CMD_PROBE_CLIENT);
6908
6909         if (IS_ERR(hdr)) {
6910                 err = PTR_ERR(hdr);
6911                 goto free_msg;
6912         }
6913
6914         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6915
6916         err = rdev_probe_client(rdev, dev, addr, &cookie);
6917         if (err)
6918                 goto free_msg;
6919
6920         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6921                 goto nla_put_failure;
6922
6923         genlmsg_end(msg, hdr);
6924
6925         return genlmsg_reply(msg, info);
6926
6927  nla_put_failure:
6928         err = -ENOBUFS;
6929  free_msg:
6930         nlmsg_free(msg);
6931         return err;
6932 }
6933
6934 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
6935 {
6936         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6937         struct cfg80211_beacon_registration *reg, *nreg;
6938         int rv;
6939
6940         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
6941                 return -EOPNOTSUPP;
6942
6943         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
6944         if (!nreg)
6945                 return -ENOMEM;
6946
6947         /* First, check if already registered. */
6948         spin_lock_bh(&rdev->beacon_registrations_lock);
6949         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
6950                 if (reg->nlportid == info->snd_portid) {
6951                         rv = -EALREADY;
6952                         goto out_err;
6953                 }
6954         }
6955         /* Add it to the list */
6956         nreg->nlportid = info->snd_portid;
6957         list_add(&nreg->list, &rdev->beacon_registrations);
6958
6959         spin_unlock_bh(&rdev->beacon_registrations_lock);
6960
6961         return 0;
6962 out_err:
6963         spin_unlock_bh(&rdev->beacon_registrations_lock);
6964         kfree(nreg);
6965         return rv;
6966 }
6967
6968 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
6969 {
6970         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6971         struct wireless_dev *wdev = info->user_ptr[1];
6972         int err;
6973
6974         if (!rdev->ops->start_p2p_device)
6975                 return -EOPNOTSUPP;
6976
6977         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
6978                 return -EOPNOTSUPP;
6979
6980         if (wdev->p2p_started)
6981                 return 0;
6982
6983         mutex_lock(&rdev->devlist_mtx);
6984         err = cfg80211_can_add_interface(rdev, wdev->iftype);
6985         mutex_unlock(&rdev->devlist_mtx);
6986         if (err)
6987                 return err;
6988
6989         err = rdev_start_p2p_device(rdev, wdev);
6990         if (err)
6991                 return err;
6992
6993         wdev->p2p_started = true;
6994         mutex_lock(&rdev->devlist_mtx);
6995         rdev->opencount++;
6996         mutex_unlock(&rdev->devlist_mtx);
6997
6998         return 0;
6999 }
7000
7001 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
7002 {
7003         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7004         struct wireless_dev *wdev = info->user_ptr[1];
7005
7006         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
7007                 return -EOPNOTSUPP;
7008
7009         if (!rdev->ops->stop_p2p_device)
7010                 return -EOPNOTSUPP;
7011
7012         if (!wdev->p2p_started)
7013                 return 0;
7014
7015         rdev_stop_p2p_device(rdev, wdev);
7016         wdev->p2p_started = false;
7017
7018         mutex_lock(&rdev->devlist_mtx);
7019         rdev->opencount--;
7020         mutex_unlock(&rdev->devlist_mtx);
7021
7022         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
7023                 rdev->scan_req->aborted = true;
7024                 ___cfg80211_scan_done(rdev, true);
7025         }
7026
7027         return 0;
7028 }
7029
7030 #define NL80211_FLAG_NEED_WIPHY         0x01
7031 #define NL80211_FLAG_NEED_NETDEV        0x02
7032 #define NL80211_FLAG_NEED_RTNL          0x04
7033 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
7034 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
7035                                          NL80211_FLAG_CHECK_NETDEV_UP)
7036 #define NL80211_FLAG_NEED_WDEV          0x10
7037 /* If a netdev is associated, it must be UP, P2P must be started */
7038 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
7039                                          NL80211_FLAG_CHECK_NETDEV_UP)
7040
7041 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
7042                             struct genl_info *info)
7043 {
7044         struct cfg80211_registered_device *rdev;
7045         struct wireless_dev *wdev;
7046         struct net_device *dev;
7047         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
7048
7049         if (rtnl)
7050                 rtnl_lock();
7051
7052         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
7053                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7054                 if (IS_ERR(rdev)) {
7055                         if (rtnl)
7056                                 rtnl_unlock();
7057                         return PTR_ERR(rdev);
7058                 }
7059                 info->user_ptr[0] = rdev;
7060         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
7061                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7062                 mutex_lock(&cfg80211_mutex);
7063                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
7064                                                   info->attrs);
7065                 if (IS_ERR(wdev)) {
7066                         mutex_unlock(&cfg80211_mutex);
7067                         if (rtnl)
7068                                 rtnl_unlock();
7069                         return PTR_ERR(wdev);
7070                 }
7071
7072                 dev = wdev->netdev;
7073                 rdev = wiphy_to_dev(wdev->wiphy);
7074
7075                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
7076                         if (!dev) {
7077                                 mutex_unlock(&cfg80211_mutex);
7078                                 if (rtnl)
7079                                         rtnl_unlock();
7080                                 return -EINVAL;
7081                         }
7082
7083                         info->user_ptr[1] = dev;
7084                 } else {
7085                         info->user_ptr[1] = wdev;
7086                 }
7087
7088                 if (dev) {
7089                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
7090                             !netif_running(dev)) {
7091                                 mutex_unlock(&cfg80211_mutex);
7092                                 if (rtnl)
7093                                         rtnl_unlock();
7094                                 return -ENETDOWN;
7095                         }
7096
7097                         dev_hold(dev);
7098                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
7099                         if (!wdev->p2p_started) {
7100                                 mutex_unlock(&cfg80211_mutex);
7101                                 if (rtnl)
7102                                         rtnl_unlock();
7103                                 return -ENETDOWN;
7104                         }
7105                 }
7106
7107                 cfg80211_lock_rdev(rdev);
7108
7109                 mutex_unlock(&cfg80211_mutex);
7110
7111                 info->user_ptr[0] = rdev;
7112         }
7113
7114         return 0;
7115 }
7116
7117 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
7118                               struct genl_info *info)
7119 {
7120         if (info->user_ptr[0])
7121                 cfg80211_unlock_rdev(info->user_ptr[0]);
7122         if (info->user_ptr[1]) {
7123                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7124                         struct wireless_dev *wdev = info->user_ptr[1];
7125
7126                         if (wdev->netdev)
7127                                 dev_put(wdev->netdev);
7128                 } else {
7129                         dev_put(info->user_ptr[1]);
7130                 }
7131         }
7132         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
7133                 rtnl_unlock();
7134 }
7135
7136 static struct genl_ops nl80211_ops[] = {
7137         {
7138                 .cmd = NL80211_CMD_GET_WIPHY,
7139                 .doit = nl80211_get_wiphy,
7140                 .dumpit = nl80211_dump_wiphy,
7141                 .policy = nl80211_policy,
7142                 /* can be retrieved by unprivileged users */
7143                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
7144         },
7145         {
7146                 .cmd = NL80211_CMD_SET_WIPHY,
7147                 .doit = nl80211_set_wiphy,
7148                 .policy = nl80211_policy,
7149                 .flags = GENL_ADMIN_PERM,
7150                 .internal_flags = NL80211_FLAG_NEED_RTNL,
7151         },
7152         {
7153                 .cmd = NL80211_CMD_GET_INTERFACE,
7154                 .doit = nl80211_get_interface,
7155                 .dumpit = nl80211_dump_interface,
7156                 .policy = nl80211_policy,
7157                 /* can be retrieved by unprivileged users */
7158                 .internal_flags = NL80211_FLAG_NEED_WDEV,
7159         },
7160         {
7161                 .cmd = NL80211_CMD_SET_INTERFACE,
7162                 .doit = nl80211_set_interface,
7163                 .policy = nl80211_policy,
7164                 .flags = GENL_ADMIN_PERM,
7165                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7166                                   NL80211_FLAG_NEED_RTNL,
7167         },
7168         {
7169                 .cmd = NL80211_CMD_NEW_INTERFACE,
7170                 .doit = nl80211_new_interface,
7171                 .policy = nl80211_policy,
7172                 .flags = GENL_ADMIN_PERM,
7173                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7174                                   NL80211_FLAG_NEED_RTNL,
7175         },
7176         {
7177                 .cmd = NL80211_CMD_DEL_INTERFACE,
7178                 .doit = nl80211_del_interface,
7179                 .policy = nl80211_policy,
7180                 .flags = GENL_ADMIN_PERM,
7181                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7182                                   NL80211_FLAG_NEED_RTNL,
7183         },
7184         {
7185                 .cmd = NL80211_CMD_GET_KEY,
7186                 .doit = nl80211_get_key,
7187                 .policy = nl80211_policy,
7188                 .flags = GENL_ADMIN_PERM,
7189                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7190                                   NL80211_FLAG_NEED_RTNL,
7191         },
7192         {
7193                 .cmd = NL80211_CMD_SET_KEY,
7194                 .doit = nl80211_set_key,
7195                 .policy = nl80211_policy,
7196                 .flags = GENL_ADMIN_PERM,
7197                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7198                                   NL80211_FLAG_NEED_RTNL,
7199         },
7200         {
7201                 .cmd = NL80211_CMD_NEW_KEY,
7202                 .doit = nl80211_new_key,
7203                 .policy = nl80211_policy,
7204                 .flags = GENL_ADMIN_PERM,
7205                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7206                                   NL80211_FLAG_NEED_RTNL,
7207         },
7208         {
7209                 .cmd = NL80211_CMD_DEL_KEY,
7210                 .doit = nl80211_del_key,
7211                 .policy = nl80211_policy,
7212                 .flags = GENL_ADMIN_PERM,
7213                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7214                                   NL80211_FLAG_NEED_RTNL,
7215         },
7216         {
7217                 .cmd = NL80211_CMD_SET_BEACON,
7218                 .policy = nl80211_policy,
7219                 .flags = GENL_ADMIN_PERM,
7220                 .doit = nl80211_set_beacon,
7221                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7222                                   NL80211_FLAG_NEED_RTNL,
7223         },
7224         {
7225                 .cmd = NL80211_CMD_START_AP,
7226                 .policy = nl80211_policy,
7227                 .flags = GENL_ADMIN_PERM,
7228                 .doit = nl80211_start_ap,
7229                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7230                                   NL80211_FLAG_NEED_RTNL,
7231         },
7232         {
7233                 .cmd = NL80211_CMD_STOP_AP,
7234                 .policy = nl80211_policy,
7235                 .flags = GENL_ADMIN_PERM,
7236                 .doit = nl80211_stop_ap,
7237                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7238                                   NL80211_FLAG_NEED_RTNL,
7239         },
7240         {
7241                 .cmd = NL80211_CMD_GET_STATION,
7242                 .doit = nl80211_get_station,
7243                 .dumpit = nl80211_dump_station,
7244                 .policy = nl80211_policy,
7245                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7246                                   NL80211_FLAG_NEED_RTNL,
7247         },
7248         {
7249                 .cmd = NL80211_CMD_SET_STATION,
7250                 .doit = nl80211_set_station,
7251                 .policy = nl80211_policy,
7252                 .flags = GENL_ADMIN_PERM,
7253                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7254                                   NL80211_FLAG_NEED_RTNL,
7255         },
7256         {
7257                 .cmd = NL80211_CMD_NEW_STATION,
7258                 .doit = nl80211_new_station,
7259                 .policy = nl80211_policy,
7260                 .flags = GENL_ADMIN_PERM,
7261                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7262                                   NL80211_FLAG_NEED_RTNL,
7263         },
7264         {
7265                 .cmd = NL80211_CMD_DEL_STATION,
7266                 .doit = nl80211_del_station,
7267                 .policy = nl80211_policy,
7268                 .flags = GENL_ADMIN_PERM,
7269                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7270                                   NL80211_FLAG_NEED_RTNL,
7271         },
7272         {
7273                 .cmd = NL80211_CMD_GET_MPATH,
7274                 .doit = nl80211_get_mpath,
7275                 .dumpit = nl80211_dump_mpath,
7276                 .policy = nl80211_policy,
7277                 .flags = GENL_ADMIN_PERM,
7278                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7279                                   NL80211_FLAG_NEED_RTNL,
7280         },
7281         {
7282                 .cmd = NL80211_CMD_SET_MPATH,
7283                 .doit = nl80211_set_mpath,
7284                 .policy = nl80211_policy,
7285                 .flags = GENL_ADMIN_PERM,
7286                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7287                                   NL80211_FLAG_NEED_RTNL,
7288         },
7289         {
7290                 .cmd = NL80211_CMD_NEW_MPATH,
7291                 .doit = nl80211_new_mpath,
7292                 .policy = nl80211_policy,
7293                 .flags = GENL_ADMIN_PERM,
7294                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7295                                   NL80211_FLAG_NEED_RTNL,
7296         },
7297         {
7298                 .cmd = NL80211_CMD_DEL_MPATH,
7299                 .doit = nl80211_del_mpath,
7300                 .policy = nl80211_policy,
7301                 .flags = GENL_ADMIN_PERM,
7302                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7303                                   NL80211_FLAG_NEED_RTNL,
7304         },
7305         {
7306                 .cmd = NL80211_CMD_SET_BSS,
7307                 .doit = nl80211_set_bss,
7308                 .policy = nl80211_policy,
7309                 .flags = GENL_ADMIN_PERM,
7310                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7311                                   NL80211_FLAG_NEED_RTNL,
7312         },
7313         {
7314                 .cmd = NL80211_CMD_GET_REG,
7315                 .doit = nl80211_get_reg,
7316                 .policy = nl80211_policy,
7317                 /* can be retrieved by unprivileged users */
7318         },
7319         {
7320                 .cmd = NL80211_CMD_SET_REG,
7321                 .doit = nl80211_set_reg,
7322                 .policy = nl80211_policy,
7323                 .flags = GENL_ADMIN_PERM,
7324         },
7325         {
7326                 .cmd = NL80211_CMD_REQ_SET_REG,
7327                 .doit = nl80211_req_set_reg,
7328                 .policy = nl80211_policy,
7329                 .flags = GENL_ADMIN_PERM,
7330         },
7331         {
7332                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
7333                 .doit = nl80211_get_mesh_config,
7334                 .policy = nl80211_policy,
7335                 /* can be retrieved by unprivileged users */
7336                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7337                                   NL80211_FLAG_NEED_RTNL,
7338         },
7339         {
7340                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
7341                 .doit = nl80211_update_mesh_config,
7342                 .policy = nl80211_policy,
7343                 .flags = GENL_ADMIN_PERM,
7344                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7345                                   NL80211_FLAG_NEED_RTNL,
7346         },
7347         {
7348                 .cmd = NL80211_CMD_TRIGGER_SCAN,
7349                 .doit = nl80211_trigger_scan,
7350                 .policy = nl80211_policy,
7351                 .flags = GENL_ADMIN_PERM,
7352                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7353                                   NL80211_FLAG_NEED_RTNL,
7354         },
7355         {
7356                 .cmd = NL80211_CMD_GET_SCAN,
7357                 .policy = nl80211_policy,
7358                 .dumpit = nl80211_dump_scan,
7359         },
7360         {
7361                 .cmd = NL80211_CMD_START_SCHED_SCAN,
7362                 .doit = nl80211_start_sched_scan,
7363                 .policy = nl80211_policy,
7364                 .flags = GENL_ADMIN_PERM,
7365                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7366                                   NL80211_FLAG_NEED_RTNL,
7367         },
7368         {
7369                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
7370                 .doit = nl80211_stop_sched_scan,
7371                 .policy = nl80211_policy,
7372                 .flags = GENL_ADMIN_PERM,
7373                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7374                                   NL80211_FLAG_NEED_RTNL,
7375         },
7376         {
7377                 .cmd = NL80211_CMD_AUTHENTICATE,
7378                 .doit = nl80211_authenticate,
7379                 .policy = nl80211_policy,
7380                 .flags = GENL_ADMIN_PERM,
7381                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7382                                   NL80211_FLAG_NEED_RTNL,
7383         },
7384         {
7385                 .cmd = NL80211_CMD_ASSOCIATE,
7386                 .doit = nl80211_associate,
7387                 .policy = nl80211_policy,
7388                 .flags = GENL_ADMIN_PERM,
7389                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7390                                   NL80211_FLAG_NEED_RTNL,
7391         },
7392         {
7393                 .cmd = NL80211_CMD_DEAUTHENTICATE,
7394                 .doit = nl80211_deauthenticate,
7395                 .policy = nl80211_policy,
7396                 .flags = GENL_ADMIN_PERM,
7397                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7398                                   NL80211_FLAG_NEED_RTNL,
7399         },
7400         {
7401                 .cmd = NL80211_CMD_DISASSOCIATE,
7402                 .doit = nl80211_disassociate,
7403                 .policy = nl80211_policy,
7404                 .flags = GENL_ADMIN_PERM,
7405                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7406                                   NL80211_FLAG_NEED_RTNL,
7407         },
7408         {
7409                 .cmd = NL80211_CMD_JOIN_IBSS,
7410                 .doit = nl80211_join_ibss,
7411                 .policy = nl80211_policy,
7412                 .flags = GENL_ADMIN_PERM,
7413                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7414                                   NL80211_FLAG_NEED_RTNL,
7415         },
7416         {
7417                 .cmd = NL80211_CMD_LEAVE_IBSS,
7418                 .doit = nl80211_leave_ibss,
7419                 .policy = nl80211_policy,
7420                 .flags = GENL_ADMIN_PERM,
7421                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7422                                   NL80211_FLAG_NEED_RTNL,
7423         },
7424 #ifdef CONFIG_NL80211_TESTMODE
7425         {
7426                 .cmd = NL80211_CMD_TESTMODE,
7427                 .doit = nl80211_testmode_do,
7428                 .dumpit = nl80211_testmode_dump,
7429                 .policy = nl80211_policy,
7430                 .flags = GENL_ADMIN_PERM,
7431                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7432                                   NL80211_FLAG_NEED_RTNL,
7433         },
7434 #endif
7435         {
7436                 .cmd = NL80211_CMD_CONNECT,
7437                 .doit = nl80211_connect,
7438                 .policy = nl80211_policy,
7439                 .flags = GENL_ADMIN_PERM,
7440                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7441                                   NL80211_FLAG_NEED_RTNL,
7442         },
7443         {
7444                 .cmd = NL80211_CMD_DISCONNECT,
7445                 .doit = nl80211_disconnect,
7446                 .policy = nl80211_policy,
7447                 .flags = GENL_ADMIN_PERM,
7448                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7449                                   NL80211_FLAG_NEED_RTNL,
7450         },
7451         {
7452                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
7453                 .doit = nl80211_wiphy_netns,
7454                 .policy = nl80211_policy,
7455                 .flags = GENL_ADMIN_PERM,
7456                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7457                                   NL80211_FLAG_NEED_RTNL,
7458         },
7459         {
7460                 .cmd = NL80211_CMD_GET_SURVEY,
7461                 .policy = nl80211_policy,
7462                 .dumpit = nl80211_dump_survey,
7463         },
7464         {
7465                 .cmd = NL80211_CMD_SET_PMKSA,
7466                 .doit = nl80211_setdel_pmksa,
7467                 .policy = nl80211_policy,
7468                 .flags = GENL_ADMIN_PERM,
7469                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7470                                   NL80211_FLAG_NEED_RTNL,
7471         },
7472         {
7473                 .cmd = NL80211_CMD_DEL_PMKSA,
7474                 .doit = nl80211_setdel_pmksa,
7475                 .policy = nl80211_policy,
7476                 .flags = GENL_ADMIN_PERM,
7477                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7478                                   NL80211_FLAG_NEED_RTNL,
7479         },
7480         {
7481                 .cmd = NL80211_CMD_FLUSH_PMKSA,
7482                 .doit = nl80211_flush_pmksa,
7483                 .policy = nl80211_policy,
7484                 .flags = GENL_ADMIN_PERM,
7485                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7486                                   NL80211_FLAG_NEED_RTNL,
7487         },
7488         {
7489                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
7490                 .doit = nl80211_remain_on_channel,
7491                 .policy = nl80211_policy,
7492                 .flags = GENL_ADMIN_PERM,
7493                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7494                                   NL80211_FLAG_NEED_RTNL,
7495         },
7496         {
7497                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
7498                 .doit = nl80211_cancel_remain_on_channel,
7499                 .policy = nl80211_policy,
7500                 .flags = GENL_ADMIN_PERM,
7501                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7502                                   NL80211_FLAG_NEED_RTNL,
7503         },
7504         {
7505                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
7506                 .doit = nl80211_set_tx_bitrate_mask,
7507                 .policy = nl80211_policy,
7508                 .flags = GENL_ADMIN_PERM,
7509                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7510                                   NL80211_FLAG_NEED_RTNL,
7511         },
7512         {
7513                 .cmd = NL80211_CMD_REGISTER_FRAME,
7514                 .doit = nl80211_register_mgmt,
7515                 .policy = nl80211_policy,
7516                 .flags = GENL_ADMIN_PERM,
7517                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7518                                   NL80211_FLAG_NEED_RTNL,
7519         },
7520         {
7521                 .cmd = NL80211_CMD_FRAME,
7522                 .doit = nl80211_tx_mgmt,
7523                 .policy = nl80211_policy,
7524                 .flags = GENL_ADMIN_PERM,
7525                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7526                                   NL80211_FLAG_NEED_RTNL,
7527         },
7528         {
7529                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
7530                 .doit = nl80211_tx_mgmt_cancel_wait,
7531                 .policy = nl80211_policy,
7532                 .flags = GENL_ADMIN_PERM,
7533                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7534                                   NL80211_FLAG_NEED_RTNL,
7535         },
7536         {
7537                 .cmd = NL80211_CMD_SET_POWER_SAVE,
7538                 .doit = nl80211_set_power_save,
7539                 .policy = nl80211_policy,
7540                 .flags = GENL_ADMIN_PERM,
7541                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7542                                   NL80211_FLAG_NEED_RTNL,
7543         },
7544         {
7545                 .cmd = NL80211_CMD_GET_POWER_SAVE,
7546                 .doit = nl80211_get_power_save,
7547                 .policy = nl80211_policy,
7548                 /* can be retrieved by unprivileged users */
7549                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7550                                   NL80211_FLAG_NEED_RTNL,
7551         },
7552         {
7553                 .cmd = NL80211_CMD_SET_CQM,
7554                 .doit = nl80211_set_cqm,
7555                 .policy = nl80211_policy,
7556                 .flags = GENL_ADMIN_PERM,
7557                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7558                                   NL80211_FLAG_NEED_RTNL,
7559         },
7560         {
7561                 .cmd = NL80211_CMD_SET_CHANNEL,
7562                 .doit = nl80211_set_channel,
7563                 .policy = nl80211_policy,
7564                 .flags = GENL_ADMIN_PERM,
7565                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7566                                   NL80211_FLAG_NEED_RTNL,
7567         },
7568         {
7569                 .cmd = NL80211_CMD_SET_WDS_PEER,
7570                 .doit = nl80211_set_wds_peer,
7571                 .policy = nl80211_policy,
7572                 .flags = GENL_ADMIN_PERM,
7573                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7574                                   NL80211_FLAG_NEED_RTNL,
7575         },
7576         {
7577                 .cmd = NL80211_CMD_JOIN_MESH,
7578                 .doit = nl80211_join_mesh,
7579                 .policy = nl80211_policy,
7580                 .flags = GENL_ADMIN_PERM,
7581                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7582                                   NL80211_FLAG_NEED_RTNL,
7583         },
7584         {
7585                 .cmd = NL80211_CMD_LEAVE_MESH,
7586                 .doit = nl80211_leave_mesh,
7587                 .policy = nl80211_policy,
7588                 .flags = GENL_ADMIN_PERM,
7589                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7590                                   NL80211_FLAG_NEED_RTNL,
7591         },
7592 #ifdef CONFIG_PM
7593         {
7594                 .cmd = NL80211_CMD_GET_WOWLAN,
7595                 .doit = nl80211_get_wowlan,
7596                 .policy = nl80211_policy,
7597                 /* can be retrieved by unprivileged users */
7598                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7599                                   NL80211_FLAG_NEED_RTNL,
7600         },
7601         {
7602                 .cmd = NL80211_CMD_SET_WOWLAN,
7603                 .doit = nl80211_set_wowlan,
7604                 .policy = nl80211_policy,
7605                 .flags = GENL_ADMIN_PERM,
7606                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7607                                   NL80211_FLAG_NEED_RTNL,
7608         },
7609 #endif
7610         {
7611                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
7612                 .doit = nl80211_set_rekey_data,
7613                 .policy = nl80211_policy,
7614                 .flags = GENL_ADMIN_PERM,
7615                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7616                                   NL80211_FLAG_NEED_RTNL,
7617         },
7618         {
7619                 .cmd = NL80211_CMD_TDLS_MGMT,
7620                 .doit = nl80211_tdls_mgmt,
7621                 .policy = nl80211_policy,
7622                 .flags = GENL_ADMIN_PERM,
7623                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7624                                   NL80211_FLAG_NEED_RTNL,
7625         },
7626         {
7627                 .cmd = NL80211_CMD_TDLS_OPER,
7628                 .doit = nl80211_tdls_oper,
7629                 .policy = nl80211_policy,
7630                 .flags = GENL_ADMIN_PERM,
7631                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7632                                   NL80211_FLAG_NEED_RTNL,
7633         },
7634         {
7635                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
7636                 .doit = nl80211_register_unexpected_frame,
7637                 .policy = nl80211_policy,
7638                 .flags = GENL_ADMIN_PERM,
7639                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7640                                   NL80211_FLAG_NEED_RTNL,
7641         },
7642         {
7643                 .cmd = NL80211_CMD_PROBE_CLIENT,
7644                 .doit = nl80211_probe_client,
7645                 .policy = nl80211_policy,
7646                 .flags = GENL_ADMIN_PERM,
7647                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7648                                   NL80211_FLAG_NEED_RTNL,
7649         },
7650         {
7651                 .cmd = NL80211_CMD_REGISTER_BEACONS,
7652                 .doit = nl80211_register_beacons,
7653                 .policy = nl80211_policy,
7654                 .flags = GENL_ADMIN_PERM,
7655                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7656                                   NL80211_FLAG_NEED_RTNL,
7657         },
7658         {
7659                 .cmd = NL80211_CMD_SET_NOACK_MAP,
7660                 .doit = nl80211_set_noack_map,
7661                 .policy = nl80211_policy,
7662                 .flags = GENL_ADMIN_PERM,
7663                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7664                                   NL80211_FLAG_NEED_RTNL,
7665         },
7666         {
7667                 .cmd = NL80211_CMD_START_P2P_DEVICE,
7668                 .doit = nl80211_start_p2p_device,
7669                 .policy = nl80211_policy,
7670                 .flags = GENL_ADMIN_PERM,
7671                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7672                                   NL80211_FLAG_NEED_RTNL,
7673         },
7674         {
7675                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
7676                 .doit = nl80211_stop_p2p_device,
7677                 .policy = nl80211_policy,
7678                 .flags = GENL_ADMIN_PERM,
7679                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7680                                   NL80211_FLAG_NEED_RTNL,
7681         },
7682         {
7683                 .cmd = NL80211_CMD_SET_MCAST_RATE,
7684                 .doit = nl80211_set_mcast_rate,
7685                 .policy = nl80211_policy,
7686                 .flags = GENL_ADMIN_PERM,
7687                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7688                                   NL80211_FLAG_NEED_RTNL,
7689         },
7690 };
7691
7692 static struct genl_multicast_group nl80211_mlme_mcgrp = {
7693         .name = "mlme",
7694 };
7695
7696 /* multicast groups */
7697 static struct genl_multicast_group nl80211_config_mcgrp = {
7698         .name = "config",
7699 };
7700 static struct genl_multicast_group nl80211_scan_mcgrp = {
7701         .name = "scan",
7702 };
7703 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
7704         .name = "regulatory",
7705 };
7706
7707 /* notification functions */
7708
7709 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
7710 {
7711         struct sk_buff *msg;
7712
7713         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7714         if (!msg)
7715                 return;
7716
7717         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
7718                 nlmsg_free(msg);
7719                 return;
7720         }
7721
7722         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7723                                 nl80211_config_mcgrp.id, GFP_KERNEL);
7724 }
7725
7726 static int nl80211_add_scan_req(struct sk_buff *msg,
7727                                 struct cfg80211_registered_device *rdev)
7728 {
7729         struct cfg80211_scan_request *req = rdev->scan_req;
7730         struct nlattr *nest;
7731         int i;
7732
7733         ASSERT_RDEV_LOCK(rdev);
7734
7735         if (WARN_ON(!req))
7736                 return 0;
7737
7738         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
7739         if (!nest)
7740                 goto nla_put_failure;
7741         for (i = 0; i < req->n_ssids; i++) {
7742                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
7743                         goto nla_put_failure;
7744         }
7745         nla_nest_end(msg, nest);
7746
7747         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
7748         if (!nest)
7749                 goto nla_put_failure;
7750         for (i = 0; i < req->n_channels; i++) {
7751                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
7752                         goto nla_put_failure;
7753         }
7754         nla_nest_end(msg, nest);
7755
7756         if (req->ie &&
7757             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
7758                 goto nla_put_failure;
7759
7760         if (req->flags)
7761                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
7762
7763         return 0;
7764  nla_put_failure:
7765         return -ENOBUFS;
7766 }
7767
7768 static int nl80211_send_scan_msg(struct sk_buff *msg,
7769                                  struct cfg80211_registered_device *rdev,
7770                                  struct wireless_dev *wdev,
7771                                  u32 portid, u32 seq, int flags,
7772                                  u32 cmd)
7773 {
7774         void *hdr;
7775
7776         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7777         if (!hdr)
7778                 return -1;
7779
7780         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7781             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
7782                                          wdev->netdev->ifindex)) ||
7783             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
7784                 goto nla_put_failure;
7785
7786         /* ignore errors and send incomplete event anyway */
7787         nl80211_add_scan_req(msg, rdev);
7788
7789         return genlmsg_end(msg, hdr);
7790
7791  nla_put_failure:
7792         genlmsg_cancel(msg, hdr);
7793         return -EMSGSIZE;
7794 }
7795
7796 static int
7797 nl80211_send_sched_scan_msg(struct sk_buff *msg,
7798                             struct cfg80211_registered_device *rdev,
7799                             struct net_device *netdev,
7800                             u32 portid, u32 seq, int flags, u32 cmd)
7801 {
7802         void *hdr;
7803
7804         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7805         if (!hdr)
7806                 return -1;
7807
7808         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7809             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
7810                 goto nla_put_failure;
7811
7812         return genlmsg_end(msg, hdr);
7813
7814  nla_put_failure:
7815         genlmsg_cancel(msg, hdr);
7816         return -EMSGSIZE;
7817 }
7818
7819 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
7820                              struct wireless_dev *wdev)
7821 {
7822         struct sk_buff *msg;
7823
7824         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7825         if (!msg)
7826                 return;
7827
7828         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7829                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
7830                 nlmsg_free(msg);
7831                 return;
7832         }
7833
7834         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7835                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7836 }
7837
7838 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
7839                             struct wireless_dev *wdev)
7840 {
7841         struct sk_buff *msg;
7842
7843         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7844         if (!msg)
7845                 return;
7846
7847         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7848                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
7849                 nlmsg_free(msg);
7850                 return;
7851         }
7852
7853         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7854                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7855 }
7856
7857 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
7858                                struct wireless_dev *wdev)
7859 {
7860         struct sk_buff *msg;
7861
7862         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7863         if (!msg)
7864                 return;
7865
7866         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7867                                   NL80211_CMD_SCAN_ABORTED) < 0) {
7868                 nlmsg_free(msg);
7869                 return;
7870         }
7871
7872         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7873                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7874 }
7875
7876 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
7877                                      struct net_device *netdev)
7878 {
7879         struct sk_buff *msg;
7880
7881         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7882         if (!msg)
7883                 return;
7884
7885         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
7886                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
7887                 nlmsg_free(msg);
7888                 return;
7889         }
7890
7891         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7892                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7893 }
7894
7895 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
7896                              struct net_device *netdev, u32 cmd)
7897 {
7898         struct sk_buff *msg;
7899
7900         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7901         if (!msg)
7902                 return;
7903
7904         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
7905                 nlmsg_free(msg);
7906                 return;
7907         }
7908
7909         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7910                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7911 }
7912
7913 /*
7914  * This can happen on global regulatory changes or device specific settings
7915  * based on custom world regulatory domains.
7916  */
7917 void nl80211_send_reg_change_event(struct regulatory_request *request)
7918 {
7919         struct sk_buff *msg;
7920         void *hdr;
7921
7922         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7923         if (!msg)
7924                 return;
7925
7926         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
7927         if (!hdr) {
7928                 nlmsg_free(msg);
7929                 return;
7930         }
7931
7932         /* Userspace can always count this one always being set */
7933         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
7934                 goto nla_put_failure;
7935
7936         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
7937                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7938                                NL80211_REGDOM_TYPE_WORLD))
7939                         goto nla_put_failure;
7940         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
7941                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7942                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
7943                         goto nla_put_failure;
7944         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
7945                    request->intersect) {
7946                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7947                                NL80211_REGDOM_TYPE_INTERSECTION))
7948                         goto nla_put_failure;
7949         } else {
7950                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7951                                NL80211_REGDOM_TYPE_COUNTRY) ||
7952                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
7953                                    request->alpha2))
7954                         goto nla_put_failure;
7955         }
7956
7957         if (wiphy_idx_valid(request->wiphy_idx) &&
7958             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
7959                 goto nla_put_failure;
7960
7961         genlmsg_end(msg, hdr);
7962
7963         rcu_read_lock();
7964         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
7965                                 GFP_ATOMIC);
7966         rcu_read_unlock();
7967
7968         return;
7969
7970 nla_put_failure:
7971         genlmsg_cancel(msg, hdr);
7972         nlmsg_free(msg);
7973 }
7974
7975 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
7976                                     struct net_device *netdev,
7977                                     const u8 *buf, size_t len,
7978                                     enum nl80211_commands cmd, gfp_t gfp)
7979 {
7980         struct sk_buff *msg;
7981         void *hdr;
7982
7983         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7984         if (!msg)
7985                 return;
7986
7987         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7988         if (!hdr) {
7989                 nlmsg_free(msg);
7990                 return;
7991         }
7992
7993         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7994             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7995             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
7996                 goto nla_put_failure;
7997
7998         genlmsg_end(msg, hdr);
7999
8000         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8001                                 nl80211_mlme_mcgrp.id, gfp);
8002         return;
8003
8004  nla_put_failure:
8005         genlmsg_cancel(msg, hdr);
8006         nlmsg_free(msg);
8007 }
8008
8009 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
8010                           struct net_device *netdev, const u8 *buf,
8011                           size_t len, gfp_t gfp)
8012 {
8013         nl80211_send_mlme_event(rdev, netdev, buf, len,
8014                                 NL80211_CMD_AUTHENTICATE, gfp);
8015 }
8016
8017 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
8018                            struct net_device *netdev, const u8 *buf,
8019                            size_t len, gfp_t gfp)
8020 {
8021         nl80211_send_mlme_event(rdev, netdev, buf, len,
8022                                 NL80211_CMD_ASSOCIATE, gfp);
8023 }
8024
8025 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
8026                          struct net_device *netdev, const u8 *buf,
8027                          size_t len, gfp_t gfp)
8028 {
8029         nl80211_send_mlme_event(rdev, netdev, buf, len,
8030                                 NL80211_CMD_DEAUTHENTICATE, gfp);
8031 }
8032
8033 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
8034                            struct net_device *netdev, const u8 *buf,
8035                            size_t len, gfp_t gfp)
8036 {
8037         nl80211_send_mlme_event(rdev, netdev, buf, len,
8038                                 NL80211_CMD_DISASSOCIATE, gfp);
8039 }
8040
8041 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
8042                                 struct net_device *netdev, const u8 *buf,
8043                                 size_t len, gfp_t gfp)
8044 {
8045         nl80211_send_mlme_event(rdev, netdev, buf, len,
8046                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
8047 }
8048
8049 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
8050                                   struct net_device *netdev, const u8 *buf,
8051                                   size_t len, gfp_t gfp)
8052 {
8053         nl80211_send_mlme_event(rdev, netdev, buf, len,
8054                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
8055 }
8056
8057 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
8058                                       struct net_device *netdev, int cmd,
8059                                       const u8 *addr, gfp_t gfp)
8060 {
8061         struct sk_buff *msg;
8062         void *hdr;
8063
8064         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8065         if (!msg)
8066                 return;
8067
8068         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8069         if (!hdr) {
8070                 nlmsg_free(msg);
8071                 return;
8072         }
8073
8074         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8075             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8076             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
8077             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8078                 goto nla_put_failure;
8079
8080         genlmsg_end(msg, hdr);
8081
8082         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8083                                 nl80211_mlme_mcgrp.id, gfp);
8084         return;
8085
8086  nla_put_failure:
8087         genlmsg_cancel(msg, hdr);
8088         nlmsg_free(msg);
8089 }
8090
8091 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
8092                                struct net_device *netdev, const u8 *addr,
8093                                gfp_t gfp)
8094 {
8095         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
8096                                   addr, gfp);
8097 }
8098
8099 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
8100                                 struct net_device *netdev, const u8 *addr,
8101                                 gfp_t gfp)
8102 {
8103         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
8104                                   addr, gfp);
8105 }
8106
8107 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
8108                                  struct net_device *netdev, const u8 *bssid,
8109                                  const u8 *req_ie, size_t req_ie_len,
8110                                  const u8 *resp_ie, size_t resp_ie_len,
8111                                  u16 status, gfp_t gfp)
8112 {
8113         struct sk_buff *msg;
8114         void *hdr;
8115
8116         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8117         if (!msg)
8118                 return;
8119
8120         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
8121         if (!hdr) {
8122                 nlmsg_free(msg);
8123                 return;
8124         }
8125
8126         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8127             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8128             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
8129             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
8130             (req_ie &&
8131              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8132             (resp_ie &&
8133              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8134                 goto nla_put_failure;
8135
8136         genlmsg_end(msg, hdr);
8137
8138         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8139                                 nl80211_mlme_mcgrp.id, gfp);
8140         return;
8141
8142  nla_put_failure:
8143         genlmsg_cancel(msg, hdr);
8144         nlmsg_free(msg);
8145
8146 }
8147
8148 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
8149                          struct net_device *netdev, const u8 *bssid,
8150                          const u8 *req_ie, size_t req_ie_len,
8151                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
8152 {
8153         struct sk_buff *msg;
8154         void *hdr;
8155
8156         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8157         if (!msg)
8158                 return;
8159
8160         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
8161         if (!hdr) {
8162                 nlmsg_free(msg);
8163                 return;
8164         }
8165
8166         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8167             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8168             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
8169             (req_ie &&
8170              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8171             (resp_ie &&
8172              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8173                 goto nla_put_failure;
8174
8175         genlmsg_end(msg, hdr);
8176
8177         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8178                                 nl80211_mlme_mcgrp.id, gfp);
8179         return;
8180
8181  nla_put_failure:
8182         genlmsg_cancel(msg, hdr);
8183         nlmsg_free(msg);
8184
8185 }
8186
8187 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
8188                                struct net_device *netdev, u16 reason,
8189                                const u8 *ie, size_t ie_len, bool from_ap)
8190 {
8191         struct sk_buff *msg;
8192         void *hdr;
8193
8194         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8195         if (!msg)
8196                 return;
8197
8198         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
8199         if (!hdr) {
8200                 nlmsg_free(msg);
8201                 return;
8202         }
8203
8204         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8205             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8206             (from_ap && reason &&
8207              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
8208             (from_ap &&
8209              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
8210             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
8211                 goto nla_put_failure;
8212
8213         genlmsg_end(msg, hdr);
8214
8215         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8216                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
8217         return;
8218
8219  nla_put_failure:
8220         genlmsg_cancel(msg, hdr);
8221         nlmsg_free(msg);
8222
8223 }
8224
8225 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
8226                              struct net_device *netdev, const u8 *bssid,
8227                              gfp_t gfp)
8228 {
8229         struct sk_buff *msg;
8230         void *hdr;
8231
8232         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8233         if (!msg)
8234                 return;
8235
8236         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
8237         if (!hdr) {
8238                 nlmsg_free(msg);
8239                 return;
8240         }
8241
8242         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8243             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8244             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8245                 goto nla_put_failure;
8246
8247         genlmsg_end(msg, hdr);
8248
8249         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8250                                 nl80211_mlme_mcgrp.id, gfp);
8251         return;
8252
8253  nla_put_failure:
8254         genlmsg_cancel(msg, hdr);
8255         nlmsg_free(msg);
8256 }
8257
8258 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
8259                 struct net_device *netdev,
8260                 const u8 *macaddr, const u8* ie, u8 ie_len,
8261                 gfp_t gfp)
8262 {
8263         struct sk_buff *msg;
8264         void *hdr;
8265
8266         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8267         if (!msg)
8268                 return;
8269
8270         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
8271         if (!hdr) {
8272                 nlmsg_free(msg);
8273                 return;
8274         }
8275
8276         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8277             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8278             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
8279             (ie_len && ie &&
8280              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
8281                 goto nla_put_failure;
8282
8283         genlmsg_end(msg, hdr);
8284
8285         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8286                                 nl80211_mlme_mcgrp.id, gfp);
8287         return;
8288
8289  nla_put_failure:
8290         genlmsg_cancel(msg, hdr);
8291         nlmsg_free(msg);
8292 }
8293
8294 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
8295                                  struct net_device *netdev, const u8 *addr,
8296                                  enum nl80211_key_type key_type, int key_id,
8297                                  const u8 *tsc, gfp_t gfp)
8298 {
8299         struct sk_buff *msg;
8300         void *hdr;
8301
8302         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8303         if (!msg)
8304                 return;
8305
8306         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
8307         if (!hdr) {
8308                 nlmsg_free(msg);
8309                 return;
8310         }
8311
8312         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8313             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8314             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
8315             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
8316             (key_id != -1 &&
8317              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
8318             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
8319                 goto nla_put_failure;
8320
8321         genlmsg_end(msg, hdr);
8322
8323         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8324                                 nl80211_mlme_mcgrp.id, gfp);
8325         return;
8326
8327  nla_put_failure:
8328         genlmsg_cancel(msg, hdr);
8329         nlmsg_free(msg);
8330 }
8331
8332 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
8333                                     struct ieee80211_channel *channel_before,
8334                                     struct ieee80211_channel *channel_after)
8335 {
8336         struct sk_buff *msg;
8337         void *hdr;
8338         struct nlattr *nl_freq;
8339
8340         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
8341         if (!msg)
8342                 return;
8343
8344         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
8345         if (!hdr) {
8346                 nlmsg_free(msg);
8347                 return;
8348         }
8349
8350         /*
8351          * Since we are applying the beacon hint to a wiphy we know its
8352          * wiphy_idx is valid
8353          */
8354         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8355                 goto nla_put_failure;
8356
8357         /* Before */
8358         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
8359         if (!nl_freq)
8360                 goto nla_put_failure;
8361         if (nl80211_msg_put_channel(msg, channel_before))
8362                 goto nla_put_failure;
8363         nla_nest_end(msg, nl_freq);
8364
8365         /* After */
8366         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
8367         if (!nl_freq)
8368                 goto nla_put_failure;
8369         if (nl80211_msg_put_channel(msg, channel_after))
8370                 goto nla_put_failure;
8371         nla_nest_end(msg, nl_freq);
8372
8373         genlmsg_end(msg, hdr);
8374
8375         rcu_read_lock();
8376         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
8377                                 GFP_ATOMIC);
8378         rcu_read_unlock();
8379
8380         return;
8381
8382 nla_put_failure:
8383         genlmsg_cancel(msg, hdr);
8384         nlmsg_free(msg);
8385 }
8386
8387 static void nl80211_send_remain_on_chan_event(
8388         int cmd, struct cfg80211_registered_device *rdev,
8389         struct wireless_dev *wdev, u64 cookie,
8390         struct ieee80211_channel *chan,
8391         unsigned int duration, gfp_t gfp)
8392 {
8393         struct sk_buff *msg;
8394         void *hdr;
8395
8396         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8397         if (!msg)
8398                 return;
8399
8400         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8401         if (!hdr) {
8402                 nlmsg_free(msg);
8403                 return;
8404         }
8405
8406         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8407             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8408                                          wdev->netdev->ifindex)) ||
8409             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
8410             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
8411             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
8412                         NL80211_CHAN_NO_HT) ||
8413             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8414                 goto nla_put_failure;
8415
8416         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
8417             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
8418                 goto nla_put_failure;
8419
8420         genlmsg_end(msg, hdr);
8421
8422         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8423                                 nl80211_mlme_mcgrp.id, gfp);
8424         return;
8425
8426  nla_put_failure:
8427         genlmsg_cancel(msg, hdr);
8428         nlmsg_free(msg);
8429 }
8430
8431 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
8432                                     struct wireless_dev *wdev, u64 cookie,
8433                                     struct ieee80211_channel *chan,
8434                                     unsigned int duration, gfp_t gfp)
8435 {
8436         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
8437                                           rdev, wdev, cookie, chan,
8438                                           duration, gfp);
8439 }
8440
8441 void nl80211_send_remain_on_channel_cancel(
8442         struct cfg80211_registered_device *rdev,
8443         struct wireless_dev *wdev,
8444         u64 cookie, struct ieee80211_channel *chan, gfp_t gfp)
8445 {
8446         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8447                                           rdev, wdev, cookie, chan, 0, gfp);
8448 }
8449
8450 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
8451                             struct net_device *dev, const u8 *mac_addr,
8452                             struct station_info *sinfo, gfp_t gfp)
8453 {
8454         struct sk_buff *msg;
8455
8456         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8457         if (!msg)
8458                 return;
8459
8460         if (nl80211_send_station(msg, 0, 0, 0,
8461                                  rdev, dev, mac_addr, sinfo) < 0) {
8462                 nlmsg_free(msg);
8463                 return;
8464         }
8465
8466         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8467                                 nl80211_mlme_mcgrp.id, gfp);
8468 }
8469
8470 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
8471                                 struct net_device *dev, const u8 *mac_addr,
8472                                 gfp_t gfp)
8473 {
8474         struct sk_buff *msg;
8475         void *hdr;
8476
8477         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8478         if (!msg)
8479                 return;
8480
8481         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
8482         if (!hdr) {
8483                 nlmsg_free(msg);
8484                 return;
8485         }
8486
8487         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8488             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
8489                 goto nla_put_failure;
8490
8491         genlmsg_end(msg, hdr);
8492
8493         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8494                                 nl80211_mlme_mcgrp.id, gfp);
8495         return;
8496
8497  nla_put_failure:
8498         genlmsg_cancel(msg, hdr);
8499         nlmsg_free(msg);
8500 }
8501
8502 void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
8503                                     struct net_device *dev, const u8 *mac_addr,
8504                                     enum nl80211_connect_failed_reason reason,
8505                                     gfp_t gfp)
8506 {
8507         struct sk_buff *msg;
8508         void *hdr;
8509
8510         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8511         if (!msg)
8512                 return;
8513
8514         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
8515         if (!hdr) {
8516                 nlmsg_free(msg);
8517                 return;
8518         }
8519
8520         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8521             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
8522             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
8523                 goto nla_put_failure;
8524
8525         genlmsg_end(msg, hdr);
8526
8527         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8528                                 nl80211_mlme_mcgrp.id, gfp);
8529         return;
8530
8531  nla_put_failure:
8532         genlmsg_cancel(msg, hdr);
8533         nlmsg_free(msg);
8534 }
8535
8536 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
8537                                        const u8 *addr, gfp_t gfp)
8538 {
8539         struct wireless_dev *wdev = dev->ieee80211_ptr;
8540         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8541         struct sk_buff *msg;
8542         void *hdr;
8543         int err;
8544         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
8545
8546         if (!nlportid)
8547                 return false;
8548
8549         msg = nlmsg_new(100, gfp);
8550         if (!msg)
8551                 return true;
8552
8553         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8554         if (!hdr) {
8555                 nlmsg_free(msg);
8556                 return true;
8557         }
8558
8559         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8560             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8561             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8562                 goto nla_put_failure;
8563
8564         err = genlmsg_end(msg, hdr);
8565         if (err < 0) {
8566                 nlmsg_free(msg);
8567                 return true;
8568         }
8569
8570         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8571         return true;
8572
8573  nla_put_failure:
8574         genlmsg_cancel(msg, hdr);
8575         nlmsg_free(msg);
8576         return true;
8577 }
8578
8579 bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
8580 {
8581         return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
8582                                           addr, gfp);
8583 }
8584
8585 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
8586                                     const u8 *addr, gfp_t gfp)
8587 {
8588         return __nl80211_unexpected_frame(dev,
8589                                           NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
8590                                           addr, gfp);
8591 }
8592
8593 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
8594                       struct wireless_dev *wdev, u32 nlportid,
8595                       int freq, int sig_dbm,
8596                       const u8 *buf, size_t len, gfp_t gfp)
8597 {
8598         struct net_device *netdev = wdev->netdev;
8599         struct sk_buff *msg;
8600         void *hdr;
8601
8602         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8603         if (!msg)
8604                 return -ENOMEM;
8605
8606         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
8607         if (!hdr) {
8608                 nlmsg_free(msg);
8609                 return -ENOMEM;
8610         }
8611
8612         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8613             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8614                                         netdev->ifindex)) ||
8615             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
8616             (sig_dbm &&
8617              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
8618             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
8619                 goto nla_put_failure;
8620
8621         genlmsg_end(msg, hdr);
8622
8623         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8624
8625  nla_put_failure:
8626         genlmsg_cancel(msg, hdr);
8627         nlmsg_free(msg);
8628         return -ENOBUFS;
8629 }
8630
8631 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
8632                                  struct wireless_dev *wdev, u64 cookie,
8633                                  const u8 *buf, size_t len, bool ack,
8634                                  gfp_t gfp)
8635 {
8636         struct net_device *netdev = wdev->netdev;
8637         struct sk_buff *msg;
8638         void *hdr;
8639
8640         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8641         if (!msg)
8642                 return;
8643
8644         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
8645         if (!hdr) {
8646                 nlmsg_free(msg);
8647                 return;
8648         }
8649
8650         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8651             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8652                                    netdev->ifindex)) ||
8653             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
8654             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8655             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
8656                 goto nla_put_failure;
8657
8658         genlmsg_end(msg, hdr);
8659
8660         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
8661         return;
8662
8663  nla_put_failure:
8664         genlmsg_cancel(msg, hdr);
8665         nlmsg_free(msg);
8666 }
8667
8668 void
8669 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
8670                              struct net_device *netdev,
8671                              enum nl80211_cqm_rssi_threshold_event rssi_event,
8672                              gfp_t gfp)
8673 {
8674         struct sk_buff *msg;
8675         struct nlattr *pinfoattr;
8676         void *hdr;
8677
8678         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8679         if (!msg)
8680                 return;
8681
8682         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8683         if (!hdr) {
8684                 nlmsg_free(msg);
8685                 return;
8686         }
8687
8688         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8689             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8690                 goto nla_put_failure;
8691
8692         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8693         if (!pinfoattr)
8694                 goto nla_put_failure;
8695
8696         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
8697                         rssi_event))
8698                 goto nla_put_failure;
8699
8700         nla_nest_end(msg, pinfoattr);
8701
8702         genlmsg_end(msg, hdr);
8703
8704         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8705                                 nl80211_mlme_mcgrp.id, gfp);
8706         return;
8707
8708  nla_put_failure:
8709         genlmsg_cancel(msg, hdr);
8710         nlmsg_free(msg);
8711 }
8712
8713 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
8714                               struct net_device *netdev, const u8 *bssid,
8715                               const u8 *replay_ctr, gfp_t gfp)
8716 {
8717         struct sk_buff *msg;
8718         struct nlattr *rekey_attr;
8719         void *hdr;
8720
8721         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8722         if (!msg)
8723                 return;
8724
8725         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
8726         if (!hdr) {
8727                 nlmsg_free(msg);
8728                 return;
8729         }
8730
8731         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8732             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8733             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8734                 goto nla_put_failure;
8735
8736         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
8737         if (!rekey_attr)
8738                 goto nla_put_failure;
8739
8740         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
8741                     NL80211_REPLAY_CTR_LEN, replay_ctr))
8742                 goto nla_put_failure;
8743
8744         nla_nest_end(msg, rekey_attr);
8745
8746         genlmsg_end(msg, hdr);
8747
8748         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8749                                 nl80211_mlme_mcgrp.id, gfp);
8750         return;
8751
8752  nla_put_failure:
8753         genlmsg_cancel(msg, hdr);
8754         nlmsg_free(msg);
8755 }
8756
8757 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
8758                                     struct net_device *netdev, int index,
8759                                     const u8 *bssid, bool preauth, gfp_t gfp)
8760 {
8761         struct sk_buff *msg;
8762         struct nlattr *attr;
8763         void *hdr;
8764
8765         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8766         if (!msg)
8767                 return;
8768
8769         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
8770         if (!hdr) {
8771                 nlmsg_free(msg);
8772                 return;
8773         }
8774
8775         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8776             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8777                 goto nla_put_failure;
8778
8779         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
8780         if (!attr)
8781                 goto nla_put_failure;
8782
8783         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
8784             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
8785             (preauth &&
8786              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
8787                 goto nla_put_failure;
8788
8789         nla_nest_end(msg, attr);
8790
8791         genlmsg_end(msg, hdr);
8792
8793         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8794                                 nl80211_mlme_mcgrp.id, gfp);
8795         return;
8796
8797  nla_put_failure:
8798         genlmsg_cancel(msg, hdr);
8799         nlmsg_free(msg);
8800 }
8801
8802 void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
8803                               struct net_device *netdev,
8804                               struct cfg80211_chan_def *chandef, gfp_t gfp)
8805 {
8806         struct sk_buff *msg;
8807         void *hdr;
8808
8809         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8810         if (!msg)
8811                 return;
8812
8813         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
8814         if (!hdr) {
8815                 nlmsg_free(msg);
8816                 return;
8817         }
8818
8819         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8820                 goto nla_put_failure;
8821
8822         if (nl80211_send_chandef(msg, chandef))
8823                 goto nla_put_failure;
8824
8825         genlmsg_end(msg, hdr);
8826
8827         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8828                                 nl80211_mlme_mcgrp.id, gfp);
8829         return;
8830
8831  nla_put_failure:
8832         genlmsg_cancel(msg, hdr);
8833         nlmsg_free(msg);
8834 }
8835
8836 void
8837 nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
8838                             struct net_device *netdev, const u8 *peer,
8839                             u32 num_packets, u32 rate, u32 intvl, gfp_t gfp)
8840 {
8841         struct sk_buff *msg;
8842         struct nlattr *pinfoattr;
8843         void *hdr;
8844
8845         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8846         if (!msg)
8847                 return;
8848
8849         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8850         if (!hdr) {
8851                 nlmsg_free(msg);
8852                 return;
8853         }
8854
8855         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8856             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8857             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
8858                 goto nla_put_failure;
8859
8860         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8861         if (!pinfoattr)
8862                 goto nla_put_failure;
8863
8864         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
8865                 goto nla_put_failure;
8866
8867         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
8868                 goto nla_put_failure;
8869
8870         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
8871                 goto nla_put_failure;
8872
8873         nla_nest_end(msg, pinfoattr);
8874
8875         genlmsg_end(msg, hdr);
8876
8877         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8878                                 nl80211_mlme_mcgrp.id, gfp);
8879         return;
8880
8881  nla_put_failure:
8882         genlmsg_cancel(msg, hdr);
8883         nlmsg_free(msg);
8884 }
8885
8886 void
8887 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
8888                                 struct net_device *netdev, const u8 *peer,
8889                                 u32 num_packets, gfp_t gfp)
8890 {
8891         struct sk_buff *msg;
8892         struct nlattr *pinfoattr;
8893         void *hdr;
8894
8895         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8896         if (!msg)
8897                 return;
8898
8899         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8900         if (!hdr) {
8901                 nlmsg_free(msg);
8902                 return;
8903         }
8904
8905         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8906             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8907             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
8908                 goto nla_put_failure;
8909
8910         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8911         if (!pinfoattr)
8912                 goto nla_put_failure;
8913
8914         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
8915                 goto nla_put_failure;
8916
8917         nla_nest_end(msg, pinfoattr);
8918
8919         genlmsg_end(msg, hdr);
8920
8921         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8922                                 nl80211_mlme_mcgrp.id, gfp);
8923         return;
8924
8925  nla_put_failure:
8926         genlmsg_cancel(msg, hdr);
8927         nlmsg_free(msg);
8928 }
8929
8930 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
8931                            u64 cookie, bool acked, gfp_t gfp)
8932 {
8933         struct wireless_dev *wdev = dev->ieee80211_ptr;
8934         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8935         struct sk_buff *msg;
8936         void *hdr;
8937         int err;
8938
8939         trace_cfg80211_probe_status(dev, addr, cookie, acked);
8940
8941         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8942
8943         if (!msg)
8944                 return;
8945
8946         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
8947         if (!hdr) {
8948                 nlmsg_free(msg);
8949                 return;
8950         }
8951
8952         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8953             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8954             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
8955             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8956             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
8957                 goto nla_put_failure;
8958
8959         err = genlmsg_end(msg, hdr);
8960         if (err < 0) {
8961                 nlmsg_free(msg);
8962                 return;
8963         }
8964
8965         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8966                                 nl80211_mlme_mcgrp.id, gfp);
8967         return;
8968
8969  nla_put_failure:
8970         genlmsg_cancel(msg, hdr);
8971         nlmsg_free(msg);
8972 }
8973 EXPORT_SYMBOL(cfg80211_probe_status);
8974
8975 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
8976                                  const u8 *frame, size_t len,
8977                                  int freq, int sig_dbm)
8978 {
8979         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
8980         struct sk_buff *msg;
8981         void *hdr;
8982         struct cfg80211_beacon_registration *reg;
8983
8984         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
8985
8986         spin_lock_bh(&rdev->beacon_registrations_lock);
8987         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8988                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
8989                 if (!msg) {
8990                         spin_unlock_bh(&rdev->beacon_registrations_lock);
8991                         return;
8992                 }
8993
8994                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
8995                 if (!hdr)
8996                         goto nla_put_failure;
8997
8998                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8999                     (freq &&
9000                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
9001                     (sig_dbm &&
9002                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
9003                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
9004                         goto nla_put_failure;
9005
9006                 genlmsg_end(msg, hdr);
9007
9008                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
9009         }
9010         spin_unlock_bh(&rdev->beacon_registrations_lock);
9011         return;
9012
9013  nla_put_failure:
9014         spin_unlock_bh(&rdev->beacon_registrations_lock);
9015         if (hdr)
9016                 genlmsg_cancel(msg, hdr);
9017         nlmsg_free(msg);
9018 }
9019 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
9020
9021 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
9022                                 enum nl80211_tdls_operation oper,
9023                                 u16 reason_code, gfp_t gfp)
9024 {
9025         struct wireless_dev *wdev = dev->ieee80211_ptr;
9026         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
9027         struct sk_buff *msg;
9028         void *hdr;
9029         int err;
9030
9031         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
9032                                          reason_code);
9033
9034         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
9035         if (!msg)
9036                 return;
9037
9038         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
9039         if (!hdr) {
9040                 nlmsg_free(msg);
9041                 return;
9042         }
9043
9044         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9045             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
9046             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
9047             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
9048             (reason_code > 0 &&
9049              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
9050                 goto nla_put_failure;
9051
9052         err = genlmsg_end(msg, hdr);
9053         if (err < 0) {
9054                 nlmsg_free(msg);
9055                 return;
9056         }
9057
9058         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
9059                                 nl80211_mlme_mcgrp.id, gfp);
9060         return;
9061
9062  nla_put_failure:
9063         genlmsg_cancel(msg, hdr);
9064         nlmsg_free(msg);
9065 }
9066 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
9067
9068 static int nl80211_netlink_notify(struct notifier_block * nb,
9069                                   unsigned long state,
9070                                   void *_notify)
9071 {
9072         struct netlink_notify *notify = _notify;
9073         struct cfg80211_registered_device *rdev;
9074         struct wireless_dev *wdev;
9075         struct cfg80211_beacon_registration *reg, *tmp;
9076
9077         if (state != NETLINK_URELEASE)
9078                 return NOTIFY_DONE;
9079
9080         rcu_read_lock();
9081
9082         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
9083                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
9084                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
9085
9086                 spin_lock_bh(&rdev->beacon_registrations_lock);
9087                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
9088                                          list) {
9089                         if (reg->nlportid == notify->portid) {
9090                                 list_del(&reg->list);
9091                                 kfree(reg);
9092                                 break;
9093                         }
9094                 }
9095                 spin_unlock_bh(&rdev->beacon_registrations_lock);
9096         }
9097
9098         rcu_read_unlock();
9099
9100         return NOTIFY_DONE;
9101 }
9102
9103 static struct notifier_block nl80211_netlink_notifier = {
9104         .notifier_call = nl80211_netlink_notify,
9105 };
9106
9107 /* initialisation/exit functions */
9108
9109 int nl80211_init(void)
9110 {
9111         int err;
9112
9113         err = genl_register_family_with_ops(&nl80211_fam,
9114                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
9115         if (err)
9116                 return err;
9117
9118         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
9119         if (err)
9120                 goto err_out;
9121
9122         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
9123         if (err)
9124                 goto err_out;
9125
9126         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
9127         if (err)
9128                 goto err_out;
9129
9130         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
9131         if (err)
9132                 goto err_out;
9133
9134 #ifdef CONFIG_NL80211_TESTMODE
9135         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
9136         if (err)
9137                 goto err_out;
9138 #endif
9139
9140         err = netlink_register_notifier(&nl80211_netlink_notifier);
9141         if (err)
9142                 goto err_out;
9143
9144         return 0;
9145  err_out:
9146         genl_unregister_family(&nl80211_fam);
9147         return err;
9148 }
9149
9150 void nl80211_exit(void)
9151 {
9152         netlink_unregister_notifier(&nl80211_netlink_notifier);
9153         genl_unregister_family(&nl80211_fam);
9154 }