net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25 #include "rdev-ops.h"
  26
  27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  28                                    struct genl_info *info,
  29                                    struct cfg80211_crypto_settings *settings,
  30                                    int cipher_limit);
  31
  32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
  33                             struct genl_info *info);
  34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
  35                               struct genl_info *info);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam = {
  39         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  40         .name = "nl80211",      /* have users key off the name instead */
  41         .hdrsize = 0,           /* no private header */
  42         .version = 1,           /* no particular meaning now */
  43         .maxattr = NL80211_ATTR_MAX,
  44         .netnsok = true,
  45         .pre_doit = nl80211_pre_doit,
  46         .post_doit = nl80211_post_doit,
  47 };
  48
  49 /* returns ERR_PTR values */
  50 static struct wireless_dev *
  51 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  52 {
  53         struct cfg80211_registered_device *rdev;
  54         struct wireless_dev *result = NULL;
  55         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  56         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  57         u64 wdev_id;
  58         int wiphy_idx = -1;
  59         int ifidx = -1;
  60
  61         assert_cfg80211_lock();
  62
  63         if (!have_ifidx && !have_wdev_id)
  64                 return ERR_PTR(-EINVAL);
  65
  66         if (have_ifidx)
  67                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  68         if (have_wdev_id) {
  69                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  70                 wiphy_idx = wdev_id >> 32;
  71         }
  72
  73         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  74                 struct wireless_dev *wdev;
  75
  76                 if (wiphy_net(&rdev->wiphy) != netns)
  77                         continue;
  78
  79                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  80                         continue;
  81
  82                 mutex_lock(&rdev->devlist_mtx);
  83                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
  84                         if (have_ifidx && wdev->netdev &&
  85                             wdev->netdev->ifindex == ifidx) {
  86                                 result = wdev;
  87                                 break;
  88                         }
  89                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  90                                 result = wdev;
  91                                 break;
  92                         }
  93                 }
  94                 mutex_unlock(&rdev->devlist_mtx);
  95
  96                 if (result)
  97                         break;
  98         }
  99
 100         if (result)
 101                 return result;
 102         return ERR_PTR(-ENODEV);
 103 }
 104
 105 static struct cfg80211_registered_device *
 106 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 107 {
 108         struct cfg80211_registered_device *rdev = NULL, *tmp;
 109         struct net_device *netdev;
 110
 111         assert_cfg80211_lock();
 112
 113         if (!attrs[NL80211_ATTR_WIPHY] &&
 114             !attrs[NL80211_ATTR_IFINDEX] &&
 115             !attrs[NL80211_ATTR_WDEV])
 116                 return ERR_PTR(-EINVAL);
 117
 118         if (attrs[NL80211_ATTR_WIPHY])
 119                 rdev = cfg80211_rdev_by_wiphy_idx(
 120                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 121
 122         if (attrs[NL80211_ATTR_WDEV]) {
 123                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 124                 struct wireless_dev *wdev;
 125                 bool found = false;
 126
 127                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 128                 if (tmp) {
 129                         /* make sure wdev exists */
 130                         mutex_lock(&tmp->devlist_mtx);
 131                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 132                                 if (wdev->identifier != (u32)wdev_id)
 133                                         continue;
 134                                 found = true;
 135                                 break;
 136                         }
 137                         mutex_unlock(&tmp->devlist_mtx);
 138
 139                         if (!found)
 140                                 tmp = NULL;
 141
 142                         if (rdev && tmp != rdev)
 143                                 return ERR_PTR(-EINVAL);
 144                         rdev = tmp;
 145                 }
 146         }
 147
 148         if (attrs[NL80211_ATTR_IFINDEX]) {
 149                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 150                 netdev = dev_get_by_index(netns, ifindex);
 151                 if (netdev) {
 152                         if (netdev->ieee80211_ptr)
 153                                 tmp = wiphy_to_dev(
 154                                                 netdev->ieee80211_ptr->wiphy);
 155                         else
 156                                 tmp = NULL;
 157
 158                         dev_put(netdev);
 159
 160                         /* not wireless device -- return error */
 161                         if (!tmp)
 162                                 return ERR_PTR(-EINVAL);
 163
 164                         /* mismatch -- return error */
 165                         if (rdev && tmp != rdev)
 166                                 return ERR_PTR(-EINVAL);
 167
 168                         rdev = tmp;
 169                 }
 170         }
 171
 172         if (!rdev)
 173                 return ERR_PTR(-ENODEV);
 174
 175         if (netns != wiphy_net(&rdev->wiphy))
 176                 return ERR_PTR(-ENODEV);
 177
 178         return rdev;
 179 }
 180
 181 /*
 182  * This function returns a pointer to the driver
 183  * that the genl_info item that is passed refers to.
 184  * If successful, it returns non-NULL and also locks
 185  * the driver's mutex!
 186  *
 187  * This means that you need to call cfg80211_unlock_rdev()
 188  * before being allowed to acquire &cfg80211_mutex!
 189  *
 190  * This is necessary because we need to lock the global
 191  * mutex to get an item off the list safely, and then
 192  * we lock the rdev mutex so it doesn't go away under us.
 193  *
 194  * We don't want to keep cfg80211_mutex locked
 195  * for all the time in order to allow requests on
 196  * other interfaces to go through at the same time.
 197  *
 198  * The result of this can be a PTR_ERR and hence must
 199  * be checked with IS_ERR() for errors.
 200  */
 201 static struct cfg80211_registered_device *
 202 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 203 {
 204         struct cfg80211_registered_device *rdev;
 205
 206         mutex_lock(&cfg80211_mutex);
 207         rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
 208
 209         /* if it is not an error we grab the lock on
 210          * it to assure it won't be going away while
 211          * we operate on it */
 212         if (!IS_ERR(rdev))
 213                 mutex_lock(&rdev->mtx);
 214
 215         mutex_unlock(&cfg80211_mutex);
 216
 217         return rdev;
 218 }
 219
 220 /* policy for the attributes */
 221 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 222         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 223         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 224                                       .len = 20-1 },
 225         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 226         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 229         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 230         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 231         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 232         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 233
 234         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 235         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 236         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 237
 238         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 239         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 240
 241         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 242         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 243                                     .len = WLAN_MAX_KEY_LEN },
 244         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 245         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 246         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 247         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 248         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 249
 250         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 251         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 252         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 253                                        .len = IEEE80211_MAX_DATA_LEN },
 254         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 255                                        .len = IEEE80211_MAX_DATA_LEN },
 256         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 257         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 258         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 259         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 260                                                .len = NL80211_MAX_SUPP_RATES },
 261         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 262         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 263         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 264         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 265                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 266         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 267
 268         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 269         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 270
 271         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 272         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 273         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 274         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 275                                            .len = NL80211_MAX_SUPP_RATES },
 276         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 277
 278         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 279         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 280
 281         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 282
 283         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 284         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 285                               .len = IEEE80211_MAX_DATA_LEN },
 286         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 287         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 288
 289         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 290                                 .len = IEEE80211_MAX_SSID_LEN },
 291         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 292         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 293         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 294         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 295         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 296         [NL80211_ATTR_STA_FLAGS2] = {
 297                 .len = sizeof(struct nl80211_sta_flag_update),
 298         },
 299         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 301         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 302         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 303         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 304         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 305         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 306         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 307         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 308                                  .len = WLAN_PMKID_LEN },
 309         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 310         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 311         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 312         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 313                                  .len = IEEE80211_MAX_DATA_LEN },
 314         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 315         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 316         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 317         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 318         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 319         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 320         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 321         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 322         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 323         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 324         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 325         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 326         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 327         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 329         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 330         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 331         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 332         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 333         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 334                                          .len = IEEE80211_MAX_DATA_LEN },
 335         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 336                                          .len = IEEE80211_MAX_DATA_LEN },
 337         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 338         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 339         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 341         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 342         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 343         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 346         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 347                                       .len = IEEE80211_MAX_DATA_LEN },
 348         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 349         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 350         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 351                 .len = NL80211_HT_CAPABILITY_LEN
 352         },
 353         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 354         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 355         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 356         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 357         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 358         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 359         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 360         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 361 };
 362
 363 /* policy for the key attributes */
 364 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 365         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 366         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 367         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 368         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 369         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 370         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 371         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 372         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 373 };
 374
 375 /* policy for the key default flags */
 376 static const struct nla_policy
 377 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 378         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 379         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 380 };
 381
 382 /* policy for WoWLAN attributes */
 383 static const struct nla_policy
 384 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 385         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 386         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 387         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 388         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 389         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 390         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 391         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 392         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 393 };
 394
 395 /* policy for GTK rekey offload attributes */
 396 static const struct nla_policy
 397 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 398         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 399         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 400         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 401 };
 402
 403 static const struct nla_policy
 404 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 405         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 406                                                  .len = IEEE80211_MAX_SSID_LEN },
 407         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 408 };
 409
 410 /* ifidx get helper */
 411 static int nl80211_get_ifidx(struct netlink_callback *cb)
 412 {
 413         int res;
 414
 415         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 416                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 417                           nl80211_policy);
 418         if (res)
 419                 return res;
 420
 421         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 422                 return -EINVAL;
 423
 424         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 425         if (!res)
 426                 return -EINVAL;
 427         return res;
 428 }
 429
 430 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
 431                                        struct netlink_callback *cb,
 432                                        struct cfg80211_registered_device **rdev,
 433                                        struct net_device **dev)
 434 {
 435         int ifidx = cb->args[0];
 436         int err;
 437
 438         if (!ifidx)
 439                 ifidx = nl80211_get_ifidx(cb);
 440         if (ifidx < 0)
 441                 return ifidx;
 442
 443         cb->args[0] = ifidx;
 444
 445         rtnl_lock();
 446
 447         *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 448         if (!*dev) {
 449                 err = -ENODEV;
 450                 goto out_rtnl;
 451         }
 452
 453         *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
 454         if (IS_ERR(*rdev)) {
 455                 err = PTR_ERR(*rdev);
 456                 goto out_rtnl;
 457         }
 458
 459         return 0;
 460  out_rtnl:
 461         rtnl_unlock();
 462         return err;
 463 }
 464
 465 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
 466 {
 467         cfg80211_unlock_rdev(rdev);
 468         rtnl_unlock();
 469 }
 470
 471 /* IE validation */
 472 static bool is_valid_ie_attr(const struct nlattr *attr)
 473 {
 474         const u8 *pos;
 475         int len;
 476
 477         if (!attr)
 478                 return true;
 479
 480         pos = nla_data(attr);
 481         len = nla_len(attr);
 482
 483         while (len) {
 484                 u8 elemlen;
 485
 486                 if (len < 2)
 487                         return false;
 488                 len -= 2;
 489
 490                 elemlen = pos[1];
 491                 if (elemlen > len)
 492                         return false;
 493
 494                 len -= elemlen;
 495                 pos += 2 + elemlen;
 496         }
 497
 498         return true;
 499 }
 500
 501 /* message building helper */
 502 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 503                                    int flags, u8 cmd)
 504 {
 505         /* since there is no private header just add the generic one */
 506         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 507 }
 508
 509 static int nl80211_msg_put_channel(struct sk_buff *msg,
 510                                    struct ieee80211_channel *chan)
 511 {
 512         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 513                         chan->center_freq))
 514                 goto nla_put_failure;
 515
 516         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 517             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 518                 goto nla_put_failure;
 519         if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
 520             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
 521                 goto nla_put_failure;
 522         if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
 523             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
 524                 goto nla_put_failure;
 525         if ((chan->flags & IEEE80211_CHAN_RADAR) &&
 526             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 527                 goto nla_put_failure;
 528
 529         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 530                         DBM_TO_MBM(chan->max_power)))
 531                 goto nla_put_failure;
 532
 533         return 0;
 534
 535  nla_put_failure:
 536         return -ENOBUFS;
 537 }
 538
 539 /* netlink command implementations */
 540
 541 struct key_parse {
 542         struct key_params p;
 543         int idx;
 544         int type;
 545         bool def, defmgmt;
 546         bool def_uni, def_multi;
 547 };
 548
 549 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 550 {
 551         struct nlattr *tb[NL80211_KEY_MAX + 1];
 552         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 553                                    nl80211_key_policy);
 554         if (err)
 555                 return err;
 556
 557         k->def = !!tb[NL80211_KEY_DEFAULT];
 558         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 559
 560         if (k->def) {
 561                 k->def_uni = true;
 562                 k->def_multi = true;
 563         }
 564         if (k->defmgmt)
 565                 k->def_multi = true;
 566
 567         if (tb[NL80211_KEY_IDX])
 568                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 569
 570         if (tb[NL80211_KEY_DATA]) {
 571                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 572                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 573         }
 574
 575         if (tb[NL80211_KEY_SEQ]) {
 576                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 577                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 578         }
 579
 580         if (tb[NL80211_KEY_CIPHER])
 581                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 582
 583         if (tb[NL80211_KEY_TYPE]) {
 584                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 585                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 586                         return -EINVAL;
 587         }
 588
 589         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 590                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 591                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 592                                        tb[NL80211_KEY_DEFAULT_TYPES],
 593                                        nl80211_key_default_policy);
 594                 if (err)
 595                         return err;
 596
 597                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 598                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 599         }
 600
 601         return 0;
 602 }
 603
 604 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 605 {
 606         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 607                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 608                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 609         }
 610
 611         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 612                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 613                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 614         }
 615
 616         if (info->attrs[NL80211_ATTR_KEY_IDX])
 617                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 618
 619         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 620                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 621
 622         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 623         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 624
 625         if (k->def) {
 626                 k->def_uni = true;
 627                 k->def_multi = true;
 628         }
 629         if (k->defmgmt)
 630                 k->def_multi = true;
 631
 632         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 633                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 634                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 635                         return -EINVAL;
 636         }
 637
 638         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 639                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 640                 int err = nla_parse_nested(
 641                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 642                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 643                                 nl80211_key_default_policy);
 644                 if (err)
 645                         return err;
 646
 647                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 648                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 649         }
 650
 651         return 0;
 652 }
 653
 654 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 655 {
 656         int err;
 657
 658         memset(k, 0, sizeof(*k));
 659         k->idx = -1;
 660         k->type = -1;
 661
 662         if (info->attrs[NL80211_ATTR_KEY])
 663                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 664         else
 665                 err = nl80211_parse_key_old(info, k);
 666
 667         if (err)
 668                 return err;
 669
 670         if (k->def && k->defmgmt)
 671                 return -EINVAL;
 672
 673         if (k->defmgmt) {
 674                 if (k->def_uni || !k->def_multi)
 675                         return -EINVAL;
 676         }
 677
 678         if (k->idx != -1) {
 679                 if (k->defmgmt) {
 680                         if (k->idx < 4 || k->idx > 5)
 681                                 return -EINVAL;
 682                 } else if (k->def) {
 683                         if (k->idx < 0 || k->idx > 3)
 684                                 return -EINVAL;
 685                 } else {
 686                         if (k->idx < 0 || k->idx > 5)
 687                                 return -EINVAL;
 688                 }
 689         }
 690
 691         return 0;
 692 }
 693
 694 static struct cfg80211_cached_keys *
 695 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 696                        struct nlattr *keys, bool *no_ht)
 697 {
 698         struct key_parse parse;
 699         struct nlattr *key;
 700         struct cfg80211_cached_keys *result;
 701         int rem, err, def = 0;
 702
 703         result = kzalloc(sizeof(*result), GFP_KERNEL);
 704         if (!result)
 705                 return ERR_PTR(-ENOMEM);
 706
 707         result->def = -1;
 708         result->defmgmt = -1;
 709
 710         nla_for_each_nested(key, keys, rem) {
 711                 memset(&parse, 0, sizeof(parse));
 712                 parse.idx = -1;
 713
 714                 err = nl80211_parse_key_new(key, &parse);
 715                 if (err)
 716                         goto error;
 717                 err = -EINVAL;
 718                 if (!parse.p.key)
 719                         goto error;
 720                 if (parse.idx < 0 || parse.idx > 4)
 721                         goto error;
 722                 if (parse.def) {
 723                         if (def)
 724                                 goto error;
 725                         def = 1;
 726                         result->def = parse.idx;
 727                         if (!parse.def_uni || !parse.def_multi)
 728                                 goto error;
 729                 } else if (parse.defmgmt)
 730                         goto error;
 731                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 732                                                      parse.idx, false, NULL);
 733                 if (err)
 734                         goto error;
 735                 result->params[parse.idx].cipher = parse.p.cipher;
 736                 result->params[parse.idx].key_len = parse.p.key_len;
 737                 result->params[parse.idx].key = result->data[parse.idx];
 738                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 739
 740                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 741                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 742                         if (no_ht)
 743                                 *no_ht = true;
 744                 }
 745         }
 746
 747         return result;
 748  error:
 749         kfree(result);
 750         return ERR_PTR(err);
 751 }
 752
 753 static int nl80211_key_allowed(struct wireless_dev *wdev)
 754 {
 755         ASSERT_WDEV_LOCK(wdev);
 756
 757         switch (wdev->iftype) {
 758         case NL80211_IFTYPE_AP:
 759         case NL80211_IFTYPE_AP_VLAN:
 760         case NL80211_IFTYPE_P2P_GO:
 761         case NL80211_IFTYPE_MESH_POINT:
 762                 break;
 763         case NL80211_IFTYPE_ADHOC:
 764                 if (!wdev->current_bss)
 765                         return -ENOLINK;
 766                 break;
 767         case NL80211_IFTYPE_STATION:
 768         case NL80211_IFTYPE_P2P_CLIENT:
 769                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 770                         return -ENOLINK;
 771                 break;
 772         default:
 773                 return -EINVAL;
 774         }
 775
 776         return 0;
 777 }
 778
 779 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 780 {
 781         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 782         int i;
 783
 784         if (!nl_modes)
 785                 goto nla_put_failure;
 786
 787         i = 0;
 788         while (ifmodes) {
 789                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 790                         goto nla_put_failure;
 791                 ifmodes >>= 1;
 792                 i++;
 793         }
 794
 795         nla_nest_end(msg, nl_modes);
 796         return 0;
 797
 798 nla_put_failure:
 799         return -ENOBUFS;
 800 }
 801
 802 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 803                                           struct sk_buff *msg)
 804 {
 805         struct nlattr *nl_combis;
 806         int i, j;
 807
 808         nl_combis = nla_nest_start(msg,
 809                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 810         if (!nl_combis)
 811                 goto nla_put_failure;
 812
 813         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 814                 const struct ieee80211_iface_combination *c;
 815                 struct nlattr *nl_combi, *nl_limits;
 816
 817                 c = &wiphy->iface_combinations[i];
 818
 819                 nl_combi = nla_nest_start(msg, i + 1);
 820                 if (!nl_combi)
 821                         goto nla_put_failure;
 822
 823                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 824                 if (!nl_limits)
 825                         goto nla_put_failure;
 826
 827                 for (j = 0; j < c->n_limits; j++) {
 828                         struct nlattr *nl_limit;
 829
 830                         nl_limit = nla_nest_start(msg, j + 1);
 831                         if (!nl_limit)
 832                                 goto nla_put_failure;
 833                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 834                                         c->limits[j].max))
 835                                 goto nla_put_failure;
 836                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 837                                                 c->limits[j].types))
 838                                 goto nla_put_failure;
 839                         nla_nest_end(msg, nl_limit);
 840                 }
 841
 842                 nla_nest_end(msg, nl_limits);
 843
 844                 if (c->beacon_int_infra_match &&
 845                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 846                         goto nla_put_failure;
 847                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 848                                 c->num_different_channels) ||
 849                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 850                                 c->max_interfaces))
 851                         goto nla_put_failure;
 852
 853                 nla_nest_end(msg, nl_combi);
 854         }
 855
 856         nla_nest_end(msg, nl_combis);
 857
 858         return 0;
 859 nla_put_failure:
 860         return -ENOBUFS;
 861 }
 862
 863 static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
 864                               struct cfg80211_registered_device *dev)
 865 {
 866         void *hdr;
 867         struct nlattr *nl_bands, *nl_band;
 868         struct nlattr *nl_freqs, *nl_freq;
 869         struct nlattr *nl_rates, *nl_rate;
 870         struct nlattr *nl_cmds;
 871         enum ieee80211_band band;
 872         struct ieee80211_channel *chan;
 873         struct ieee80211_rate *rate;
 874         int i;
 875         const struct ieee80211_txrx_stypes *mgmt_stypes =
 876                                 dev->wiphy.mgmt_stypes;
 877
 878         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
 879         if (!hdr)
 880                 return -1;
 881
 882         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
 883             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
 884             nla_put_u32(msg, NL80211_ATTR_GENERATION,
 885                         cfg80211_rdev_list_generation) ||
 886             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 887                        dev->wiphy.retry_short) ||
 888             nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 889                        dev->wiphy.retry_long) ||
 890             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 891                         dev->wiphy.frag_threshold) ||
 892             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 893                         dev->wiphy.rts_threshold) ||
 894             nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 895                        dev->wiphy.coverage_class) ||
 896             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 897                        dev->wiphy.max_scan_ssids) ||
 898             nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 899                        dev->wiphy.max_sched_scan_ssids) ||
 900             nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 901                         dev->wiphy.max_scan_ie_len) ||
 902             nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 903                         dev->wiphy.max_sched_scan_ie_len) ||
 904             nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 905                        dev->wiphy.max_match_sets))
 906                 goto nla_put_failure;
 907
 908         if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
 909             nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
 910                 goto nla_put_failure;
 911         if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
 912             nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
 913                 goto nla_put_failure;
 914         if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
 915             nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
 916                 goto nla_put_failure;
 917         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
 918             nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
 919                 goto nla_put_failure;
 920         if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
 921             nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
 922                 goto nla_put_failure;
 923         if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
 924             nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
 925                 goto nla_put_failure;
 926
 927         if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
 928                     sizeof(u32) * dev->wiphy.n_cipher_suites,
 929                     dev->wiphy.cipher_suites))
 930                 goto nla_put_failure;
 931
 932         if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 933                        dev->wiphy.max_num_pmkids))
 934                 goto nla_put_failure;
 935
 936         if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
 937             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
 938                 goto nla_put_failure;
 939
 940         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 941                         dev->wiphy.available_antennas_tx) ||
 942             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 943                         dev->wiphy.available_antennas_rx))
 944                 goto nla_put_failure;
 945
 946         if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
 947             nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
 948                         dev->wiphy.probe_resp_offload))
 949                 goto nla_put_failure;
 950
 951         if ((dev->wiphy.available_antennas_tx ||
 952              dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
 953                 u32 tx_ant = 0, rx_ant = 0;
 954                 int res;
 955                 res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
 956                 if (!res) {
 957                         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
 958                                         tx_ant) ||
 959                             nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
 960                                         rx_ant))
 961                                 goto nla_put_failure;
 962                 }
 963         }
 964
 965         if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 966                                 dev->wiphy.interface_modes))
 967                 goto nla_put_failure;
 968
 969         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 970         if (!nl_bands)
 971                 goto nla_put_failure;
 972
 973         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 974                 if (!dev->wiphy.bands[band])
 975                         continue;
 976
 977                 nl_band = nla_nest_start(msg, band);
 978                 if (!nl_band)
 979                         goto nla_put_failure;
 980
 981                 /* add HT info */
 982                 if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
 983                     (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 984                              sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 985                              &dev->wiphy.bands[band]->ht_cap.mcs) ||
 986                      nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
 987                                  dev->wiphy.bands[band]->ht_cap.cap) ||
 988                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 989                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
 990                      nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 991                                 dev->wiphy.bands[band]->ht_cap.ampdu_density)))
 992                         goto nla_put_failure;
 993
 994                 /* add VHT info */
 995                 if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
 996                     (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
 997                              sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
 998                              &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
 999                      nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1000                                  dev->wiphy.bands[band]->vht_cap.cap)))
1001                         goto nla_put_failure;
1002
1003                 /* add frequencies */
1004                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
1005                 if (!nl_freqs)
1006                         goto nla_put_failure;
1007
1008                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
1009                         nl_freq = nla_nest_start(msg, i);
1010                         if (!nl_freq)
1011                                 goto nla_put_failure;
1012
1013                         chan = &dev->wiphy.bands[band]->channels[i];
1014
1015                         if (nl80211_msg_put_channel(msg, chan))
1016                                 goto nla_put_failure;
1017
1018                         nla_nest_end(msg, nl_freq);
1019                 }
1020
1021                 nla_nest_end(msg, nl_freqs);
1022
1023                 /* add bitrates */
1024                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1025                 if (!nl_rates)
1026                         goto nla_put_failure;
1027
1028                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
1029                         nl_rate = nla_nest_start(msg, i);
1030                         if (!nl_rate)
1031                                 goto nla_put_failure;
1032
1033                         rate = &dev->wiphy.bands[band]->bitrates[i];
1034                         if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1035                                         rate->bitrate))
1036                                 goto nla_put_failure;
1037                         if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1038                             nla_put_flag(msg,
1039                                          NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1040                                 goto nla_put_failure;
1041
1042                         nla_nest_end(msg, nl_rate);
1043                 }
1044
1045                 nla_nest_end(msg, nl_rates);
1046
1047                 nla_nest_end(msg, nl_band);
1048         }
1049         nla_nest_end(msg, nl_bands);
1050
1051         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1052         if (!nl_cmds)
1053                 goto nla_put_failure;
1054
1055         i = 0;
1056 #define CMD(op, n)                                              \
1057          do {                                                   \
1058                 if (dev->ops->op) {                             \
1059                         i++;                                    \
1060                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1061                                 goto nla_put_failure;           \
1062                 }                                               \
1063         } while (0)
1064
1065         CMD(add_virtual_intf, NEW_INTERFACE);
1066         CMD(change_virtual_intf, SET_INTERFACE);
1067         CMD(add_key, NEW_KEY);
1068         CMD(start_ap, START_AP);
1069         CMD(add_station, NEW_STATION);
1070         CMD(add_mpath, NEW_MPATH);
1071         CMD(update_mesh_config, SET_MESH_CONFIG);
1072         CMD(change_bss, SET_BSS);
1073         CMD(auth, AUTHENTICATE);
1074         CMD(assoc, ASSOCIATE);
1075         CMD(deauth, DEAUTHENTICATE);
1076         CMD(disassoc, DISASSOCIATE);
1077         CMD(join_ibss, JOIN_IBSS);
1078         CMD(join_mesh, JOIN_MESH);
1079         CMD(set_pmksa, SET_PMKSA);
1080         CMD(del_pmksa, DEL_PMKSA);
1081         CMD(flush_pmksa, FLUSH_PMKSA);
1082         if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1083                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1084         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1085         CMD(mgmt_tx, FRAME);
1086         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1087         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1088                 i++;
1089                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1090                         goto nla_put_failure;
1091         }
1092         if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1093             dev->ops->join_mesh) {
1094                 i++;
1095                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1096                         goto nla_put_failure;
1097         }
1098         CMD(set_wds_peer, SET_WDS_PEER);
1099         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1100                 CMD(tdls_mgmt, TDLS_MGMT);
1101                 CMD(tdls_oper, TDLS_OPER);
1102         }
1103         if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1104                 CMD(sched_scan_start, START_SCHED_SCAN);
1105         CMD(probe_client, PROBE_CLIENT);
1106         CMD(set_noack_map, SET_NOACK_MAP);
1107         if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1108                 i++;
1109                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1110                         goto nla_put_failure;
1111         }
1112         CMD(start_p2p_device, START_P2P_DEVICE);
1113
1114 #ifdef CONFIG_NL80211_TESTMODE
1115         CMD(testmode_cmd, TESTMODE);
1116 #endif
1117
1118 #undef CMD
1119
1120         if (dev->ops->connect || dev->ops->auth) {
1121                 i++;
1122                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1123                         goto nla_put_failure;
1124         }
1125
1126         if (dev->ops->disconnect || dev->ops->deauth) {
1127                 i++;
1128                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1129                         goto nla_put_failure;
1130         }
1131
1132         nla_nest_end(msg, nl_cmds);
1133
1134         if (dev->ops->remain_on_channel &&
1135             (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1136             nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1137                         dev->wiphy.max_remain_on_channel_duration))
1138                 goto nla_put_failure;
1139
1140         if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1141             nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1142                 goto nla_put_failure;
1143
1144         if (mgmt_stypes) {
1145                 u16 stypes;
1146                 struct nlattr *nl_ftypes, *nl_ifs;
1147                 enum nl80211_iftype ift;
1148
1149                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1150                 if (!nl_ifs)
1151                         goto nla_put_failure;
1152
1153                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1154                         nl_ftypes = nla_nest_start(msg, ift);
1155                         if (!nl_ftypes)
1156                                 goto nla_put_failure;
1157                         i = 0;
1158                         stypes = mgmt_stypes[ift].tx;
1159                         while (stypes) {
1160                                 if ((stypes & 1) &&
1161                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1162                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1163                                         goto nla_put_failure;
1164                                 stypes >>= 1;
1165                                 i++;
1166                         }
1167                         nla_nest_end(msg, nl_ftypes);
1168                 }
1169
1170                 nla_nest_end(msg, nl_ifs);
1171
1172                 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1173                 if (!nl_ifs)
1174                         goto nla_put_failure;
1175
1176                 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1177                         nl_ftypes = nla_nest_start(msg, ift);
1178                         if (!nl_ftypes)
1179                                 goto nla_put_failure;
1180                         i = 0;
1181                         stypes = mgmt_stypes[ift].rx;
1182                         while (stypes) {
1183                                 if ((stypes & 1) &&
1184                                     nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1185                                                 (i << 4) | IEEE80211_FTYPE_MGMT))
1186                                         goto nla_put_failure;
1187                                 stypes >>= 1;
1188                                 i++;
1189                         }
1190                         nla_nest_end(msg, nl_ftypes);
1191                 }
1192                 nla_nest_end(msg, nl_ifs);
1193         }
1194
1195 #ifdef CONFIG_PM
1196         if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
1197                 struct nlattr *nl_wowlan;
1198
1199                 nl_wowlan = nla_nest_start(msg,
1200                                 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1201                 if (!nl_wowlan)
1202                         goto nla_put_failure;
1203
1204                 if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1205                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1206                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1207                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1208                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1209                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1210                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1211                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1212                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1213                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1214                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1215                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1216                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1217                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1218                     ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1219                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1220                     goto nla_put_failure;
1221                 if (dev->wiphy.wowlan.n_patterns) {
1222                         struct nl80211_wowlan_pattern_support pat = {
1223                                 .max_patterns = dev->wiphy.wowlan.n_patterns,
1224                                 .min_pattern_len =
1225                                         dev->wiphy.wowlan.pattern_min_len,
1226                                 .max_pattern_len =
1227                                         dev->wiphy.wowlan.pattern_max_len,
1228                         };
1229                         if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1230                                     sizeof(pat), &pat))
1231                                 goto nla_put_failure;
1232                 }
1233
1234                 nla_nest_end(msg, nl_wowlan);
1235         }
1236 #endif
1237
1238         if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1239                                 dev->wiphy.software_iftypes))
1240                 goto nla_put_failure;
1241
1242         if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1243                 goto nla_put_failure;
1244
1245         if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1246             nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1247                         dev->wiphy.ap_sme_capa))
1248                 goto nla_put_failure;
1249
1250         if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
1251                         dev->wiphy.features))
1252                 goto nla_put_failure;
1253
1254         if (dev->wiphy.ht_capa_mod_mask &&
1255             nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1256                     sizeof(*dev->wiphy.ht_capa_mod_mask),
1257                     dev->wiphy.ht_capa_mod_mask))
1258                 goto nla_put_failure;
1259
1260         return genlmsg_end(msg, hdr);
1261
1262  nla_put_failure:
1263         genlmsg_cancel(msg, hdr);
1264         return -EMSGSIZE;
1265 }
1266
1267 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1268 {
1269         int idx = 0;
1270         int start = cb->args[0];
1271         struct cfg80211_registered_device *dev;
1272
1273         mutex_lock(&cfg80211_mutex);
1274         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1275                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1276                         continue;
1277                 if (++idx <= start)
1278                         continue;
1279                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).portid,
1280                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1281                                        dev) < 0) {
1282                         idx--;
1283                         break;
1284                 }
1285         }
1286         mutex_unlock(&cfg80211_mutex);
1287
1288         cb->args[0] = idx;
1289
1290         return skb->len;
1291 }
1292
1293 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1294 {
1295         struct sk_buff *msg;
1296         struct cfg80211_registered_device *dev = info->user_ptr[0];
1297
1298         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1299         if (!msg)
1300                 return -ENOMEM;
1301
1302         if (nl80211_send_wiphy(msg, info->snd_portid, info->snd_seq, 0, dev) < 0) {
1303                 nlmsg_free(msg);
1304                 return -ENOBUFS;
1305         }
1306
1307         return genlmsg_reply(msg, info);
1308 }
1309
1310 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1311         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1312         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1313         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1314         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1315         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1316 };
1317
1318 static int parse_txq_params(struct nlattr *tb[],
1319                             struct ieee80211_txq_params *txq_params)
1320 {
1321         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1322             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1323             !tb[NL80211_TXQ_ATTR_AIFS])
1324                 return -EINVAL;
1325
1326         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1327         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1328         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1329         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1330         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1331
1332         if (txq_params->ac >= NL80211_NUM_ACS)
1333                 return -EINVAL;
1334
1335         return 0;
1336 }
1337
1338 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1339 {
1340         /*
1341          * You can only set the channel explicitly for WDS interfaces,
1342          * all others have their channel managed via their respective
1343          * "establish a connection" command (connect, join, ...)
1344          *
1345          * For AP/GO and mesh mode, the channel can be set with the
1346          * channel userspace API, but is only stored and passed to the
1347          * low-level driver when the AP starts or the mesh is joined.
1348          * This is for backward compatibility, userspace can also give
1349          * the channel in the start-ap or join-mesh commands instead.
1350          *
1351          * Monitors are special as they are normally slaved to
1352          * whatever else is going on, so they have their own special
1353          * operation to set the monitor channel if possible.
1354          */
1355         return !wdev ||
1356                 wdev->iftype == NL80211_IFTYPE_AP ||
1357                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1358                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1359                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1360 }
1361
1362 static bool nl80211_valid_channel_type(struct genl_info *info,
1363                                        enum nl80211_channel_type *channel_type)
1364 {
1365         enum nl80211_channel_type tmp;
1366
1367         if (!info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1368                 return false;
1369
1370         tmp = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1371         if (tmp != NL80211_CHAN_NO_HT &&
1372             tmp != NL80211_CHAN_HT20 &&
1373             tmp != NL80211_CHAN_HT40PLUS &&
1374             tmp != NL80211_CHAN_HT40MINUS)
1375                 return false;
1376
1377         if (channel_type)
1378                 *channel_type = tmp;
1379
1380         return true;
1381 }
1382
1383 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1384                                  struct wireless_dev *wdev,
1385                                  struct genl_info *info)
1386 {
1387         struct ieee80211_channel *channel;
1388         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1389         u32 freq;
1390         int result;
1391         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1392
1393         if (wdev)
1394                 iftype = wdev->iftype;
1395
1396         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1397                 return -EINVAL;
1398
1399         if (!nl80211_can_set_dev_channel(wdev))
1400                 return -EOPNOTSUPP;
1401
1402         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
1403             !nl80211_valid_channel_type(info, &channel_type))
1404                 return -EINVAL;
1405
1406         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1407
1408         mutex_lock(&rdev->devlist_mtx);
1409         switch (iftype) {
1410         case NL80211_IFTYPE_AP:
1411         case NL80211_IFTYPE_P2P_GO:
1412                 if (wdev->beacon_interval) {
1413                         result = -EBUSY;
1414                         break;
1415                 }
1416                 channel = rdev_freq_to_chan(rdev, freq, channel_type);
1417                 if (!channel || !cfg80211_can_beacon_sec_chan(&rdev->wiphy,
1418                                                               channel,
1419                                                               channel_type)) {
1420                         result = -EINVAL;
1421                         break;
1422                 }
1423                 wdev->preset_chan = channel;
1424                 wdev->preset_chantype = channel_type;
1425                 result = 0;
1426                 break;
1427         case NL80211_IFTYPE_MESH_POINT:
1428                 result = cfg80211_set_mesh_freq(rdev, wdev, freq, channel_type);
1429                 break;
1430         case NL80211_IFTYPE_MONITOR:
1431                 result = cfg80211_set_monitor_channel(rdev, freq, channel_type);
1432                 break;
1433         default:
1434                 result = -EINVAL;
1435         }
1436         mutex_unlock(&rdev->devlist_mtx);
1437
1438         return result;
1439 }
1440
1441 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1442 {
1443         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1444         struct net_device *netdev = info->user_ptr[1];
1445
1446         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1447 }
1448
1449 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1450 {
1451         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1452         struct net_device *dev = info->user_ptr[1];
1453         struct wireless_dev *wdev = dev->ieee80211_ptr;
1454         const u8 *bssid;
1455
1456         if (!info->attrs[NL80211_ATTR_MAC])
1457                 return -EINVAL;
1458
1459         if (netif_running(dev))
1460                 return -EBUSY;
1461
1462         if (!rdev->ops->set_wds_peer)
1463                 return -EOPNOTSUPP;
1464
1465         if (wdev->iftype != NL80211_IFTYPE_WDS)
1466                 return -EOPNOTSUPP;
1467
1468         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1469         return rdev_set_wds_peer(rdev, dev, bssid);
1470 }
1471
1472
1473 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1474 {
1475         struct cfg80211_registered_device *rdev;
1476         struct net_device *netdev = NULL;
1477         struct wireless_dev *wdev;
1478         int result = 0, rem_txq_params = 0;
1479         struct nlattr *nl_txq_params;
1480         u32 changed;
1481         u8 retry_short = 0, retry_long = 0;
1482         u32 frag_threshold = 0, rts_threshold = 0;
1483         u8 coverage_class = 0;
1484
1485         /*
1486          * Try to find the wiphy and netdev. Normally this
1487          * function shouldn't need the netdev, but this is
1488          * done for backward compatibility -- previously
1489          * setting the channel was done per wiphy, but now
1490          * it is per netdev. Previous userland like hostapd
1491          * also passed a netdev to set_wiphy, so that it is
1492          * possible to let that go to the right netdev!
1493          */
1494         mutex_lock(&cfg80211_mutex);
1495
1496         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1497                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1498
1499                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
1500                 if (netdev && netdev->ieee80211_ptr) {
1501                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1502                         mutex_lock(&rdev->mtx);
1503                 } else
1504                         netdev = NULL;
1505         }
1506
1507         if (!netdev) {
1508                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1509                                                   info->attrs);
1510                 if (IS_ERR(rdev)) {
1511                         mutex_unlock(&cfg80211_mutex);
1512                         return PTR_ERR(rdev);
1513                 }
1514                 wdev = NULL;
1515                 netdev = NULL;
1516                 result = 0;
1517
1518                 mutex_lock(&rdev->mtx);
1519         } else
1520                 wdev = netdev->ieee80211_ptr;
1521
1522         /*
1523          * end workaround code, by now the rdev is available
1524          * and locked, and wdev may or may not be NULL.
1525          */
1526
1527         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1528                 result = cfg80211_dev_rename(
1529                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1530
1531         mutex_unlock(&cfg80211_mutex);
1532
1533         if (result)
1534                 goto bad_res;
1535
1536         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1537                 struct ieee80211_txq_params txq_params;
1538                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1539
1540                 if (!rdev->ops->set_txq_params) {
1541                         result = -EOPNOTSUPP;
1542                         goto bad_res;
1543                 }
1544
1545                 if (!netdev) {
1546                         result = -EINVAL;
1547                         goto bad_res;
1548                 }
1549
1550                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1551                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1552                         result = -EINVAL;
1553                         goto bad_res;
1554                 }
1555
1556                 if (!netif_running(netdev)) {
1557                         result = -ENETDOWN;
1558                         goto bad_res;
1559                 }
1560
1561                 nla_for_each_nested(nl_txq_params,
1562                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1563                                     rem_txq_params) {
1564                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1565                                   nla_data(nl_txq_params),
1566                                   nla_len(nl_txq_params),
1567                                   txq_params_policy);
1568                         result = parse_txq_params(tb, &txq_params);
1569                         if (result)
1570                                 goto bad_res;
1571
1572                         result = rdev_set_txq_params(rdev, netdev,
1573                                                      &txq_params);
1574                         if (result)
1575                                 goto bad_res;
1576                 }
1577         }
1578
1579         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1580                 result = __nl80211_set_channel(rdev,
1581                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
1582                                 info);
1583                 if (result)
1584                         goto bad_res;
1585         }
1586
1587         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1588                 struct wireless_dev *txp_wdev = wdev;
1589                 enum nl80211_tx_power_setting type;
1590                 int idx, mbm = 0;
1591
1592                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
1593                         txp_wdev = NULL;
1594
1595                 if (!rdev->ops->set_tx_power) {
1596                         result = -EOPNOTSUPP;
1597                         goto bad_res;
1598                 }
1599
1600                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1601                 type = nla_get_u32(info->attrs[idx]);
1602
1603                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1604                     (type != NL80211_TX_POWER_AUTOMATIC)) {
1605                         result = -EINVAL;
1606                         goto bad_res;
1607                 }
1608
1609                 if (type != NL80211_TX_POWER_AUTOMATIC) {
1610                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1611                         mbm = nla_get_u32(info->attrs[idx]);
1612                 }
1613
1614                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
1615                 if (result)
1616                         goto bad_res;
1617         }
1618
1619         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1620             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1621                 u32 tx_ant, rx_ant;
1622                 if ((!rdev->wiphy.available_antennas_tx &&
1623                      !rdev->wiphy.available_antennas_rx) ||
1624                     !rdev->ops->set_antenna) {
1625                         result = -EOPNOTSUPP;
1626                         goto bad_res;
1627                 }
1628
1629                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1630                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1631
1632                 /* reject antenna configurations which don't match the
1633                  * available antenna masks, except for the "all" mask */
1634                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1635                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1636                         result = -EINVAL;
1637                         goto bad_res;
1638                 }
1639
1640                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1641                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1642
1643                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
1644                 if (result)
1645                         goto bad_res;
1646         }
1647
1648         changed = 0;
1649
1650         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1651                 retry_short = nla_get_u8(
1652                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1653                 if (retry_short == 0) {
1654                         result = -EINVAL;
1655                         goto bad_res;
1656                 }
1657                 changed |= WIPHY_PARAM_RETRY_SHORT;
1658         }
1659
1660         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1661                 retry_long = nla_get_u8(
1662                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1663                 if (retry_long == 0) {
1664                         result = -EINVAL;
1665                         goto bad_res;
1666                 }
1667                 changed |= WIPHY_PARAM_RETRY_LONG;
1668         }
1669
1670         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1671                 frag_threshold = nla_get_u32(
1672                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1673                 if (frag_threshold < 256) {
1674                         result = -EINVAL;
1675                         goto bad_res;
1676                 }
1677                 if (frag_threshold != (u32) -1) {
1678                         /*
1679                          * Fragments (apart from the last one) are required to
1680                          * have even length. Make the fragmentation code
1681                          * simpler by stripping LSB should someone try to use
1682                          * odd threshold value.
1683                          */
1684                         frag_threshold &= ~0x1;
1685                 }
1686                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1687         }
1688
1689         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1690                 rts_threshold = nla_get_u32(
1691                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1692                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
1693         }
1694
1695         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1696                 coverage_class = nla_get_u8(
1697                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1698                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
1699         }
1700
1701         if (changed) {
1702                 u8 old_retry_short, old_retry_long;
1703                 u32 old_frag_threshold, old_rts_threshold;
1704                 u8 old_coverage_class;
1705
1706                 if (!rdev->ops->set_wiphy_params) {
1707                         result = -EOPNOTSUPP;
1708                         goto bad_res;
1709                 }
1710
1711                 old_retry_short = rdev->wiphy.retry_short;
1712                 old_retry_long = rdev->wiphy.retry_long;
1713                 old_frag_threshold = rdev->wiphy.frag_threshold;
1714                 old_rts_threshold = rdev->wiphy.rts_threshold;
1715                 old_coverage_class = rdev->wiphy.coverage_class;
1716
1717                 if (changed & WIPHY_PARAM_RETRY_SHORT)
1718                         rdev->wiphy.retry_short = retry_short;
1719                 if (changed & WIPHY_PARAM_RETRY_LONG)
1720                         rdev->wiphy.retry_long = retry_long;
1721                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1722                         rdev->wiphy.frag_threshold = frag_threshold;
1723                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1724                         rdev->wiphy.rts_threshold = rts_threshold;
1725                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1726                         rdev->wiphy.coverage_class = coverage_class;
1727
1728                 result = rdev_set_wiphy_params(rdev, changed);
1729                 if (result) {
1730                         rdev->wiphy.retry_short = old_retry_short;
1731                         rdev->wiphy.retry_long = old_retry_long;
1732                         rdev->wiphy.frag_threshold = old_frag_threshold;
1733                         rdev->wiphy.rts_threshold = old_rts_threshold;
1734                         rdev->wiphy.coverage_class = old_coverage_class;
1735                 }
1736         }
1737
1738  bad_res:
1739         mutex_unlock(&rdev->mtx);
1740         if (netdev)
1741                 dev_put(netdev);
1742         return result;
1743 }
1744
1745 static inline u64 wdev_id(struct wireless_dev *wdev)
1746 {
1747         return (u64)wdev->identifier |
1748                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
1749 }
1750
1751 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
1752                               struct cfg80211_registered_device *rdev,
1753                               struct wireless_dev *wdev)
1754 {
1755         struct net_device *dev = wdev->netdev;
1756         void *hdr;
1757
1758         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1759         if (!hdr)
1760                 return -1;
1761
1762         if (dev &&
1763             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
1764              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
1765                 goto nla_put_failure;
1766
1767         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1768             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
1769             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
1770             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
1771             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1772                         rdev->devlist_generation ^
1773                         (cfg80211_rdev_list_generation << 2)))
1774                 goto nla_put_failure;
1775
1776         if (rdev->ops->get_channel) {
1777                 struct ieee80211_channel *chan;
1778                 enum nl80211_channel_type channel_type;
1779
1780                 chan = rdev_get_channel(rdev, wdev, &channel_type);
1781                 if (chan &&
1782                     (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
1783                                  chan->center_freq) ||
1784                      nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
1785                                  channel_type)))
1786                         goto nla_put_failure;
1787         }
1788
1789         return genlmsg_end(msg, hdr);
1790
1791  nla_put_failure:
1792         genlmsg_cancel(msg, hdr);
1793         return -EMSGSIZE;
1794 }
1795
1796 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1797 {
1798         int wp_idx = 0;
1799         int if_idx = 0;
1800         int wp_start = cb->args[0];
1801         int if_start = cb->args[1];
1802         struct cfg80211_registered_device *rdev;
1803         struct wireless_dev *wdev;
1804
1805         mutex_lock(&cfg80211_mutex);
1806         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1807                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1808                         continue;
1809                 if (wp_idx < wp_start) {
1810                         wp_idx++;
1811                         continue;
1812                 }
1813                 if_idx = 0;
1814
1815                 mutex_lock(&rdev->devlist_mtx);
1816                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
1817                         if (if_idx < if_start) {
1818                                 if_idx++;
1819                                 continue;
1820                         }
1821                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
1822                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1823                                                rdev, wdev) < 0) {
1824                                 mutex_unlock(&rdev->devlist_mtx);
1825                                 goto out;
1826                         }
1827                         if_idx++;
1828                 }
1829                 mutex_unlock(&rdev->devlist_mtx);
1830
1831                 wp_idx++;
1832         }
1833  out:
1834         mutex_unlock(&cfg80211_mutex);
1835
1836         cb->args[0] = wp_idx;
1837         cb->args[1] = if_idx;
1838
1839         return skb->len;
1840 }
1841
1842 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1843 {
1844         struct sk_buff *msg;
1845         struct cfg80211_registered_device *dev = info->user_ptr[0];
1846         struct wireless_dev *wdev = info->user_ptr[1];
1847
1848         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1849         if (!msg)
1850                 return -ENOMEM;
1851
1852         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
1853                                dev, wdev) < 0) {
1854                 nlmsg_free(msg);
1855                 return -ENOBUFS;
1856         }
1857
1858         return genlmsg_reply(msg, info);
1859 }
1860
1861 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1862         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1863         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1864         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1865         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1866         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1867 };
1868
1869 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1870 {
1871         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1872         int flag;
1873
1874         *mntrflags = 0;
1875
1876         if (!nla)
1877                 return -EINVAL;
1878
1879         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1880                              nla, mntr_flags_policy))
1881                 return -EINVAL;
1882
1883         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1884                 if (flags[flag])
1885                         *mntrflags |= (1<<flag);
1886
1887         return 0;
1888 }
1889
1890 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1891                                struct net_device *netdev, u8 use_4addr,
1892                                enum nl80211_iftype iftype)
1893 {
1894         if (!use_4addr) {
1895                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1896                         return -EBUSY;
1897                 return 0;
1898         }
1899
1900         switch (iftype) {
1901         case NL80211_IFTYPE_AP_VLAN:
1902                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1903                         return 0;
1904                 break;
1905         case NL80211_IFTYPE_STATION:
1906                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1907                         return 0;
1908                 break;
1909         default:
1910                 break;
1911         }
1912
1913         return -EOPNOTSUPP;
1914 }
1915
1916 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1917 {
1918         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1919         struct vif_params params;
1920         int err;
1921         enum nl80211_iftype otype, ntype;
1922         struct net_device *dev = info->user_ptr[1];
1923         u32 _flags, *flags = NULL;
1924         bool change = false;
1925
1926         memset(&params, 0, sizeof(params));
1927
1928         otype = ntype = dev->ieee80211_ptr->iftype;
1929
1930         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1931                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1932                 if (otype != ntype)
1933                         change = true;
1934                 if (ntype > NL80211_IFTYPE_MAX)
1935                         return -EINVAL;
1936         }
1937
1938         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1939                 struct wireless_dev *wdev = dev->ieee80211_ptr;
1940
1941                 if (ntype != NL80211_IFTYPE_MESH_POINT)
1942                         return -EINVAL;
1943                 if (netif_running(dev))
1944                         return -EBUSY;
1945
1946                 wdev_lock(wdev);
1947                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1948                              IEEE80211_MAX_MESH_ID_LEN);
1949                 wdev->mesh_id_up_len =
1950                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1951                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1952                        wdev->mesh_id_up_len);
1953                 wdev_unlock(wdev);
1954         }
1955
1956         if (info->attrs[NL80211_ATTR_4ADDR]) {
1957                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1958                 change = true;
1959                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1960                 if (err)
1961                         return err;
1962         } else {
1963                 params.use_4addr = -1;
1964         }
1965
1966         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1967                 if (ntype != NL80211_IFTYPE_MONITOR)
1968                         return -EINVAL;
1969                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1970                                           &_flags);
1971                 if (err)
1972                         return err;
1973
1974                 flags = &_flags;
1975                 change = true;
1976         }
1977
1978         if (change)
1979                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1980         else
1981                 err = 0;
1982
1983         if (!err && params.use_4addr != -1)
1984                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1985
1986         return err;
1987 }
1988
1989 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1990 {
1991         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1992         struct vif_params params;
1993         struct wireless_dev *wdev;
1994         struct sk_buff *msg;
1995         int err;
1996         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1997         u32 flags;
1998
1999         memset(&params, 0, sizeof(params));
2000
2001         if (!info->attrs[NL80211_ATTR_IFNAME])
2002                 return -EINVAL;
2003
2004         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2005                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2006                 if (type > NL80211_IFTYPE_MAX)
2007                         return -EINVAL;
2008         }
2009
2010         if (!rdev->ops->add_virtual_intf ||
2011             !(rdev->wiphy.interface_modes & (1 << type)))
2012                 return -EOPNOTSUPP;
2013
2014         if (info->attrs[NL80211_ATTR_4ADDR]) {
2015                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2016                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2017                 if (err)
2018                         return err;
2019         }
2020
2021         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2022         if (!msg)
2023                 return -ENOMEM;
2024
2025         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2026                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2027                                   &flags);
2028         wdev = rdev_add_virtual_intf(rdev,
2029                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2030                                 type, err ? NULL : &flags, &params);
2031         if (IS_ERR(wdev)) {
2032                 nlmsg_free(msg);
2033                 return PTR_ERR(wdev);
2034         }
2035
2036         switch (type) {
2037         case NL80211_IFTYPE_MESH_POINT:
2038                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2039                         break;
2040                 wdev_lock(wdev);
2041                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2042                              IEEE80211_MAX_MESH_ID_LEN);
2043                 wdev->mesh_id_up_len =
2044                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2045                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2046                        wdev->mesh_id_up_len);
2047                 wdev_unlock(wdev);
2048                 break;
2049         case NL80211_IFTYPE_P2P_DEVICE:
2050                 /*
2051                  * P2P Device doesn't have a netdev, so doesn't go
2052                  * through the netdev notifier and must be added here
2053                  */
2054                 mutex_init(&wdev->mtx);
2055                 INIT_LIST_HEAD(&wdev->event_list);
2056                 spin_lock_init(&wdev->event_lock);
2057                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2058                 spin_lock_init(&wdev->mgmt_registrations_lock);
2059
2060                 mutex_lock(&rdev->devlist_mtx);
2061                 wdev->identifier = ++rdev->wdev_id;
2062                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2063                 rdev->devlist_generation++;
2064                 mutex_unlock(&rdev->devlist_mtx);
2065                 break;
2066         default:
2067                 break;
2068         }
2069
2070         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2071                                rdev, wdev) < 0) {
2072                 nlmsg_free(msg);
2073                 return -ENOBUFS;
2074         }
2075
2076         return genlmsg_reply(msg, info);
2077 }
2078
2079 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2080 {
2081         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2082         struct wireless_dev *wdev = info->user_ptr[1];
2083
2084         if (!rdev->ops->del_virtual_intf)
2085                 return -EOPNOTSUPP;
2086
2087         /*
2088          * If we remove a wireless device without a netdev then clear
2089          * user_ptr[1] so that nl80211_post_doit won't dereference it
2090          * to check if it needs to do dev_put(). Otherwise it crashes
2091          * since the wdev has been freed, unlike with a netdev where
2092          * we need the dev_put() for the netdev to really be freed.
2093          */
2094         if (!wdev->netdev)
2095                 info->user_ptr[1] = NULL;
2096
2097         return rdev_del_virtual_intf(rdev, wdev);
2098 }
2099
2100 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2101 {
2102         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2103         struct net_device *dev = info->user_ptr[1];
2104         u16 noack_map;
2105
2106         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2107                 return -EINVAL;
2108
2109         if (!rdev->ops->set_noack_map)
2110                 return -EOPNOTSUPP;
2111
2112         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2113
2114         return rdev_set_noack_map(rdev, dev, noack_map);
2115 }
2116
2117 struct get_key_cookie {
2118         struct sk_buff *msg;
2119         int error;
2120         int idx;
2121 };
2122
2123 static void get_key_callback(void *c, struct key_params *params)
2124 {
2125         struct nlattr *key;
2126         struct get_key_cookie *cookie = c;
2127
2128         if ((params->key &&
2129              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2130                      params->key_len, params->key)) ||
2131             (params->seq &&
2132              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2133                      params->seq_len, params->seq)) ||
2134             (params->cipher &&
2135              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2136                          params->cipher)))
2137                 goto nla_put_failure;
2138
2139         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2140         if (!key)
2141                 goto nla_put_failure;
2142
2143         if ((params->key &&
2144              nla_put(cookie->msg, NL80211_KEY_DATA,
2145                      params->key_len, params->key)) ||
2146             (params->seq &&
2147              nla_put(cookie->msg, NL80211_KEY_SEQ,
2148                      params->seq_len, params->seq)) ||
2149             (params->cipher &&
2150              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2151                          params->cipher)))
2152                 goto nla_put_failure;
2153
2154         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2155                 goto nla_put_failure;
2156
2157         nla_nest_end(cookie->msg, key);
2158
2159         return;
2160  nla_put_failure:
2161         cookie->error = 1;
2162 }
2163
2164 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2165 {
2166         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2167         int err;
2168         struct net_device *dev = info->user_ptr[1];
2169         u8 key_idx = 0;
2170         const u8 *mac_addr = NULL;
2171         bool pairwise;
2172         struct get_key_cookie cookie = {
2173                 .error = 0,
2174         };
2175         void *hdr;
2176         struct sk_buff *msg;
2177
2178         if (info->attrs[NL80211_ATTR_KEY_IDX])
2179                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2180
2181         if (key_idx > 5)
2182                 return -EINVAL;
2183
2184         if (info->attrs[NL80211_ATTR_MAC])
2185                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2186
2187         pairwise = !!mac_addr;
2188         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2189                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2190                 if (kt >= NUM_NL80211_KEYTYPES)
2191                         return -EINVAL;
2192                 if (kt != NL80211_KEYTYPE_GROUP &&
2193                     kt != NL80211_KEYTYPE_PAIRWISE)
2194                         return -EINVAL;
2195                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2196         }
2197
2198         if (!rdev->ops->get_key)
2199                 return -EOPNOTSUPP;
2200
2201         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2202         if (!msg)
2203                 return -ENOMEM;
2204
2205         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2206                              NL80211_CMD_NEW_KEY);
2207         if (IS_ERR(hdr))
2208                 return PTR_ERR(hdr);
2209
2210         cookie.msg = msg;
2211         cookie.idx = key_idx;
2212
2213         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2214             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2215                 goto nla_put_failure;
2216         if (mac_addr &&
2217             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2218                 goto nla_put_failure;
2219
2220         if (pairwise && mac_addr &&
2221             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2222                 return -ENOENT;
2223
2224         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2225                            get_key_callback);
2226
2227         if (err)
2228                 goto free_msg;
2229
2230         if (cookie.error)
2231                 goto nla_put_failure;
2232
2233         genlmsg_end(msg, hdr);
2234         return genlmsg_reply(msg, info);
2235
2236  nla_put_failure:
2237         err = -ENOBUFS;
2238  free_msg:
2239         nlmsg_free(msg);
2240         return err;
2241 }
2242
2243 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2244 {
2245         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2246         struct key_parse key;
2247         int err;
2248         struct net_device *dev = info->user_ptr[1];
2249
2250         err = nl80211_parse_key(info, &key);
2251         if (err)
2252                 return err;
2253
2254         if (key.idx < 0)
2255                 return -EINVAL;
2256
2257         /* only support setting default key */
2258         if (!key.def && !key.defmgmt)
2259                 return -EINVAL;
2260
2261         wdev_lock(dev->ieee80211_ptr);
2262
2263         if (key.def) {
2264                 if (!rdev->ops->set_default_key) {
2265                         err = -EOPNOTSUPP;
2266                         goto out;
2267                 }
2268
2269                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2270                 if (err)
2271                         goto out;
2272
2273                 err = rdev_set_default_key(rdev, dev, key.idx,
2274                                                  key.def_uni, key.def_multi);
2275
2276                 if (err)
2277                         goto out;
2278
2279 #ifdef CONFIG_CFG80211_WEXT
2280                 dev->ieee80211_ptr->wext.default_key = key.idx;
2281 #endif
2282         } else {
2283                 if (key.def_uni || !key.def_multi) {
2284                         err = -EINVAL;
2285                         goto out;
2286                 }
2287
2288                 if (!rdev->ops->set_default_mgmt_key) {
2289                         err = -EOPNOTSUPP;
2290                         goto out;
2291                 }
2292
2293                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2294                 if (err)
2295                         goto out;
2296
2297                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2298                 if (err)
2299                         goto out;
2300
2301 #ifdef CONFIG_CFG80211_WEXT
2302                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2303 #endif
2304         }
2305
2306  out:
2307         wdev_unlock(dev->ieee80211_ptr);
2308
2309         return err;
2310 }
2311
2312 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2313 {
2314         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2315         int err;
2316         struct net_device *dev = info->user_ptr[1];
2317         struct key_parse key;
2318         const u8 *mac_addr = NULL;
2319
2320         err = nl80211_parse_key(info, &key);
2321         if (err)
2322                 return err;
2323
2324         if (!key.p.key)
2325                 return -EINVAL;
2326
2327         if (info->attrs[NL80211_ATTR_MAC])
2328                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2329
2330         if (key.type == -1) {
2331                 if (mac_addr)
2332                         key.type = NL80211_KEYTYPE_PAIRWISE;
2333                 else
2334                         key.type = NL80211_KEYTYPE_GROUP;
2335         }
2336
2337         /* for now */
2338         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2339             key.type != NL80211_KEYTYPE_GROUP)
2340                 return -EINVAL;
2341
2342         if (!rdev->ops->add_key)
2343                 return -EOPNOTSUPP;
2344
2345         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2346                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2347                                            mac_addr))
2348                 return -EINVAL;
2349
2350         wdev_lock(dev->ieee80211_ptr);
2351         err = nl80211_key_allowed(dev->ieee80211_ptr);
2352         if (!err)
2353                 err = rdev_add_key(rdev, dev, key.idx,
2354                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2355                                     mac_addr, &key.p);
2356         wdev_unlock(dev->ieee80211_ptr);
2357
2358         return err;
2359 }
2360
2361 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2362 {
2363         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2364         int err;
2365         struct net_device *dev = info->user_ptr[1];
2366         u8 *mac_addr = NULL;
2367         struct key_parse key;
2368
2369         err = nl80211_parse_key(info, &key);
2370         if (err)
2371                 return err;
2372
2373         if (info->attrs[NL80211_ATTR_MAC])
2374                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2375
2376         if (key.type == -1) {
2377                 if (mac_addr)
2378                         key.type = NL80211_KEYTYPE_PAIRWISE;
2379                 else
2380                         key.type = NL80211_KEYTYPE_GROUP;
2381         }
2382
2383         /* for now */
2384         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2385             key.type != NL80211_KEYTYPE_GROUP)
2386                 return -EINVAL;
2387
2388         if (!rdev->ops->del_key)
2389                 return -EOPNOTSUPP;
2390
2391         wdev_lock(dev->ieee80211_ptr);
2392         err = nl80211_key_allowed(dev->ieee80211_ptr);
2393
2394         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2395             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2396                 err = -ENOENT;
2397
2398         if (!err)
2399                 err = rdev_del_key(rdev, dev, key.idx,
2400                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2401                                    mac_addr);
2402
2403 #ifdef CONFIG_CFG80211_WEXT
2404         if (!err) {
2405                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2406                         dev->ieee80211_ptr->wext.default_key = -1;
2407                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2408                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2409         }
2410 #endif
2411         wdev_unlock(dev->ieee80211_ptr);
2412
2413         return err;
2414 }
2415
2416 static int nl80211_parse_beacon(struct genl_info *info,
2417                                 struct cfg80211_beacon_data *bcn)
2418 {
2419         bool haveinfo = false;
2420
2421         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2422             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2423             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2424             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2425                 return -EINVAL;
2426
2427         memset(bcn, 0, sizeof(*bcn));
2428
2429         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2430                 bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2431                 bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2432                 if (!bcn->head_len)
2433                         return -EINVAL;
2434                 haveinfo = true;
2435         }
2436
2437         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2438                 bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2439                 bcn->tail_len =
2440                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2441                 haveinfo = true;
2442         }
2443
2444         if (!haveinfo)
2445                 return -EINVAL;
2446
2447         if (info->attrs[NL80211_ATTR_IE]) {
2448                 bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2449                 bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2450         }
2451
2452         if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2453                 bcn->proberesp_ies =
2454                         nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2455                 bcn->proberesp_ies_len =
2456                         nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2457         }
2458
2459         if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2460                 bcn->assocresp_ies =
2461                         nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2462                 bcn->assocresp_ies_len =
2463                         nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2464         }
2465
2466         if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2467                 bcn->probe_resp =
2468                         nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2469                 bcn->probe_resp_len =
2470                         nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2471         }
2472
2473         return 0;
2474 }
2475
2476 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2477                                    struct cfg80211_ap_settings *params)
2478 {
2479         struct wireless_dev *wdev;
2480         bool ret = false;
2481
2482         mutex_lock(&rdev->devlist_mtx);
2483
2484         list_for_each_entry(wdev, &rdev->wdev_list, list) {
2485                 if (wdev->iftype != NL80211_IFTYPE_AP &&
2486                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
2487                         continue;
2488
2489                 if (!wdev->preset_chan)
2490                         continue;
2491
2492                 params->channel = wdev->preset_chan;
2493                 params->channel_type = wdev->preset_chantype;
2494                 ret = true;
2495                 break;
2496         }
2497
2498         mutex_unlock(&rdev->devlist_mtx);
2499
2500         return ret;
2501 }
2502
2503 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
2504                                     enum nl80211_auth_type auth_type,
2505                                     enum nl80211_commands cmd)
2506 {
2507         if (auth_type > NL80211_AUTHTYPE_MAX)
2508                 return false;
2509
2510         switch (cmd) {
2511         case NL80211_CMD_AUTHENTICATE:
2512                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
2513                     auth_type == NL80211_AUTHTYPE_SAE)
2514                         return false;
2515                 return true;
2516         case NL80211_CMD_CONNECT:
2517         case NL80211_CMD_START_AP:
2518                 /* SAE not supported yet */
2519                 if (auth_type == NL80211_AUTHTYPE_SAE)
2520                         return false;
2521                 return true;
2522         default:
2523                 return false;
2524         }
2525 }
2526
2527 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2528 {
2529         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2530         struct net_device *dev = info->user_ptr[1];
2531         struct wireless_dev *wdev = dev->ieee80211_ptr;
2532         struct cfg80211_ap_settings params;
2533         int err;
2534
2535         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2536             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2537                 return -EOPNOTSUPP;
2538
2539         if (!rdev->ops->start_ap)
2540                 return -EOPNOTSUPP;
2541
2542         if (wdev->beacon_interval)
2543                 return -EALREADY;
2544
2545         memset(&params, 0, sizeof(params));
2546
2547         /* these are required for START_AP */
2548         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2549             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2550             !info->attrs[NL80211_ATTR_BEACON_HEAD])
2551                 return -EINVAL;
2552
2553         err = nl80211_parse_beacon(info, &params.beacon);
2554         if (err)
2555                 return err;
2556
2557         params.beacon_interval =
2558                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2559         params.dtim_period =
2560                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2561
2562         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
2563         if (err)
2564                 return err;
2565
2566         /*
2567          * In theory, some of these attributes should be required here
2568          * but since they were not used when the command was originally
2569          * added, keep them optional for old user space programs to let
2570          * them continue to work with drivers that do not need the
2571          * additional information -- drivers must check!
2572          */
2573         if (info->attrs[NL80211_ATTR_SSID]) {
2574                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2575                 params.ssid_len =
2576                         nla_len(info->attrs[NL80211_ATTR_SSID]);
2577                 if (params.ssid_len == 0 ||
2578                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
2579                         return -EINVAL;
2580         }
2581
2582         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2583                 params.hidden_ssid = nla_get_u32(
2584                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2585                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
2586                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
2587                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2588                         return -EINVAL;
2589         }
2590
2591         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2592
2593         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2594                 params.auth_type = nla_get_u32(
2595                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
2596                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
2597                                              NL80211_CMD_START_AP))
2598                         return -EINVAL;
2599         } else
2600                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2601
2602         err = nl80211_crypto_settings(rdev, info, &params.crypto,
2603                                       NL80211_MAX_NR_CIPHER_SUITES);
2604         if (err)
2605                 return err;
2606
2607         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
2608                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
2609                         return -EOPNOTSUPP;
2610                 params.inactivity_timeout = nla_get_u16(
2611                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
2612         }
2613
2614         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2615                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
2616
2617                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
2618                     !nl80211_valid_channel_type(info, &channel_type))
2619                         return -EINVAL;
2620
2621                 params.channel = rdev_freq_to_chan(rdev,
2622                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
2623                         channel_type);
2624                 if (!params.channel)
2625                         return -EINVAL;
2626                 params.channel_type = channel_type;
2627         } else if (wdev->preset_chan) {
2628                 params.channel = wdev->preset_chan;
2629                 params.channel_type = wdev->preset_chantype;
2630         } else if (!nl80211_get_ap_channel(rdev, &params))
2631                 return -EINVAL;
2632
2633         if (!cfg80211_can_beacon_sec_chan(&rdev->wiphy, params.channel,
2634                                           params.channel_type))
2635                 return -EINVAL;
2636
2637         mutex_lock(&rdev->devlist_mtx);
2638         err = cfg80211_can_use_chan(rdev, wdev, params.channel,
2639                                     CHAN_MODE_SHARED);
2640         mutex_unlock(&rdev->devlist_mtx);
2641
2642         if (err)
2643                 return err;
2644
2645         err = rdev_start_ap(rdev, dev, &params);
2646         if (!err) {
2647                 wdev->preset_chan = params.channel;
2648                 wdev->preset_chantype = params.channel_type;
2649                 wdev->beacon_interval = params.beacon_interval;
2650                 wdev->channel = params.channel;
2651         }
2652         return err;
2653 }
2654
2655 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
2656 {
2657         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2658         struct net_device *dev = info->user_ptr[1];
2659         struct wireless_dev *wdev = dev->ieee80211_ptr;
2660         struct cfg80211_beacon_data params;
2661         int err;
2662
2663         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2664             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2665                 return -EOPNOTSUPP;
2666
2667         if (!rdev->ops->change_beacon)
2668                 return -EOPNOTSUPP;
2669
2670         if (!wdev->beacon_interval)
2671                 return -EINVAL;
2672
2673         err = nl80211_parse_beacon(info, &params);
2674         if (err)
2675                 return err;
2676
2677         return rdev_change_beacon(rdev, dev, &params);
2678 }
2679
2680 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
2681 {
2682         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2683         struct net_device *dev = info->user_ptr[1];
2684
2685         return cfg80211_stop_ap(rdev, dev);
2686 }
2687
2688 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2689         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2690         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2691         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2692         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2693         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2694         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2695 };
2696
2697 static int parse_station_flags(struct genl_info *info,
2698                                enum nl80211_iftype iftype,
2699                                struct station_parameters *params)
2700 {
2701         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2702         struct nlattr *nla;
2703         int flag;
2704
2705         /*
2706          * Try parsing the new attribute first so userspace
2707          * can specify both for older kernels.
2708          */
2709         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2710         if (nla) {
2711                 struct nl80211_sta_flag_update *sta_flags;
2712
2713                 sta_flags = nla_data(nla);
2714                 params->sta_flags_mask = sta_flags->mask;
2715                 params->sta_flags_set = sta_flags->set;
2716                 if ((params->sta_flags_mask |
2717                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2718                         return -EINVAL;
2719                 return 0;
2720         }
2721
2722         /* if present, parse the old attribute */
2723
2724         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2725         if (!nla)
2726                 return 0;
2727
2728         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2729                              nla, sta_flags_policy))
2730                 return -EINVAL;
2731
2732         /*
2733          * Only allow certain flags for interface types so that
2734          * other attributes are silently ignored. Remember that
2735          * this is backward compatibility code with old userspace
2736          * and shouldn't be hit in other cases anyway.
2737          */
2738         switch (iftype) {
2739         case NL80211_IFTYPE_AP:
2740         case NL80211_IFTYPE_AP_VLAN:
2741         case NL80211_IFTYPE_P2P_GO:
2742                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2743                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2744                                          BIT(NL80211_STA_FLAG_WME) |
2745                                          BIT(NL80211_STA_FLAG_MFP);
2746                 break;
2747         case NL80211_IFTYPE_P2P_CLIENT:
2748         case NL80211_IFTYPE_STATION:
2749                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2750                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
2751                 break;
2752         case NL80211_IFTYPE_MESH_POINT:
2753                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2754                                          BIT(NL80211_STA_FLAG_MFP) |
2755                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
2756         default:
2757                 return -EINVAL;
2758         }
2759
2760         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
2761                 if (flags[flag]) {
2762                         params->sta_flags_set |= (1<<flag);
2763
2764                         /* no longer support new API additions in old API */
2765                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
2766                                 return -EINVAL;
2767                 }
2768         }
2769
2770         return 0;
2771 }
2772
2773 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2774                                  int attr)
2775 {
2776         struct nlattr *rate;
2777         u32 bitrate;
2778         u16 bitrate_compat;
2779
2780         rate = nla_nest_start(msg, attr);
2781         if (!rate)
2782                 goto nla_put_failure;
2783
2784         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2785         bitrate = cfg80211_calculate_bitrate(info);
2786         /* report 16-bit bitrate only if we can */
2787         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
2788         if ((bitrate > 0 &&
2789              nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) ||
2790             (bitrate_compat > 0 &&
2791              nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) ||
2792             ((info->flags & RATE_INFO_FLAGS_MCS) &&
2793              nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) ||
2794             ((info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) &&
2795              nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH)) ||
2796             ((info->flags & RATE_INFO_FLAGS_SHORT_GI) &&
2797              nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)))
2798                 goto nla_put_failure;
2799
2800         nla_nest_end(msg, rate);
2801         return true;
2802
2803 nla_put_failure:
2804         return false;
2805 }
2806
2807 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
2808                                 int flags,
2809                                 struct cfg80211_registered_device *rdev,
2810                                 struct net_device *dev,
2811                                 const u8 *mac_addr, struct station_info *sinfo)
2812 {
2813         void *hdr;
2814         struct nlattr *sinfoattr, *bss_param;
2815
2816         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
2817         if (!hdr)
2818                 return -1;
2819
2820         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2821             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
2822             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
2823                 goto nla_put_failure;
2824
2825         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2826         if (!sinfoattr)
2827                 goto nla_put_failure;
2828         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
2829             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2830                         sinfo->connected_time))
2831                 goto nla_put_failure;
2832         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
2833             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2834                         sinfo->inactive_time))
2835                 goto nla_put_failure;
2836         if ((sinfo->filled & STATION_INFO_RX_BYTES) &&
2837             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
2838                         sinfo->rx_bytes))
2839                 goto nla_put_failure;
2840         if ((sinfo->filled & STATION_INFO_TX_BYTES) &&
2841             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
2842                         sinfo->tx_bytes))
2843                 goto nla_put_failure;
2844         if ((sinfo->filled & STATION_INFO_LLID) &&
2845             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
2846                 goto nla_put_failure;
2847         if ((sinfo->filled & STATION_INFO_PLID) &&
2848             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
2849                 goto nla_put_failure;
2850         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
2851             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
2852                        sinfo->plink_state))
2853                 goto nla_put_failure;
2854         switch (rdev->wiphy.signal_type) {
2855         case CFG80211_SIGNAL_TYPE_MBM:
2856                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
2857                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
2858                                sinfo->signal))
2859                         goto nla_put_failure;
2860                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
2861                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2862                                sinfo->signal_avg))
2863                         goto nla_put_failure;
2864                 break;
2865         default:
2866                 break;
2867         }
2868         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2869                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2870                                           NL80211_STA_INFO_TX_BITRATE))
2871                         goto nla_put_failure;
2872         }
2873         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2874                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2875                                           NL80211_STA_INFO_RX_BITRATE))
2876                         goto nla_put_failure;
2877         }
2878         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
2879             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
2880                         sinfo->rx_packets))
2881                 goto nla_put_failure;
2882         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
2883             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
2884                         sinfo->tx_packets))
2885                 goto nla_put_failure;
2886         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
2887             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
2888                         sinfo->tx_retries))
2889                 goto nla_put_failure;
2890         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
2891             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
2892                         sinfo->tx_failed))
2893                 goto nla_put_failure;
2894         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
2895             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
2896                         sinfo->beacon_loss_count))
2897                 goto nla_put_failure;
2898         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2899                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2900                 if (!bss_param)
2901                         goto nla_put_failure;
2902
2903                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
2904                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
2905                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
2906                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
2907                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
2908                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
2909                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2910                                sinfo->bss_param.dtim_period) ||
2911                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2912                                 sinfo->bss_param.beacon_interval))
2913                         goto nla_put_failure;
2914
2915                 nla_nest_end(msg, bss_param);
2916         }
2917         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
2918             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
2919                     sizeof(struct nl80211_sta_flag_update),
2920                     &sinfo->sta_flags))
2921                 goto nla_put_failure;
2922         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
2923                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
2924                             sinfo->t_offset))
2925                 goto nla_put_failure;
2926         nla_nest_end(msg, sinfoattr);
2927
2928         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
2929             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2930                     sinfo->assoc_req_ies))
2931                 goto nla_put_failure;
2932
2933         return genlmsg_end(msg, hdr);
2934
2935  nla_put_failure:
2936         genlmsg_cancel(msg, hdr);
2937         return -EMSGSIZE;
2938 }
2939
2940 static int nl80211_dump_station(struct sk_buff *skb,
2941                                 struct netlink_callback *cb)
2942 {
2943         struct station_info sinfo;
2944         struct cfg80211_registered_device *dev;
2945         struct net_device *netdev;
2946         u8 mac_addr[ETH_ALEN];
2947         int sta_idx = cb->args[1];
2948         int err;
2949
2950         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2951         if (err)
2952                 return err;
2953
2954         if (!dev->ops->dump_station) {
2955                 err = -EOPNOTSUPP;
2956                 goto out_err;
2957         }
2958
2959         while (1) {
2960                 memset(&sinfo, 0, sizeof(sinfo));
2961                 err = rdev_dump_station(dev, netdev, sta_idx,
2962                                         mac_addr, &sinfo);
2963                 if (err == -ENOENT)
2964                         break;
2965                 if (err)
2966                         goto out_err;
2967
2968                 if (nl80211_send_station(skb,
2969                                 NETLINK_CB(cb->skb).portid,
2970                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2971                                 dev, netdev, mac_addr,
2972                                 &sinfo) < 0)
2973                         goto out;
2974
2975                 sta_idx++;
2976         }
2977
2978
2979  out:
2980         cb->args[1] = sta_idx;
2981         err = skb->len;
2982  out_err:
2983         nl80211_finish_netdev_dump(dev);
2984
2985         return err;
2986 }
2987
2988 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2989 {
2990         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2991         struct net_device *dev = info->user_ptr[1];
2992         struct station_info sinfo;
2993         struct sk_buff *msg;
2994         u8 *mac_addr = NULL;
2995         int err;
2996
2997         memset(&sinfo, 0, sizeof(sinfo));
2998
2999         if (!info->attrs[NL80211_ATTR_MAC])
3000                 return -EINVAL;
3001
3002         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3003
3004         if (!rdev->ops->get_station)
3005                 return -EOPNOTSUPP;
3006
3007         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3008         if (err)
3009                 return err;
3010
3011         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3012         if (!msg)
3013                 return -ENOMEM;
3014
3015         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3016                                  rdev, dev, mac_addr, &sinfo) < 0) {
3017                 nlmsg_free(msg);
3018                 return -ENOBUFS;
3019         }
3020
3021         return genlmsg_reply(msg, info);
3022 }
3023
3024 /*
3025  * Get vlan interface making sure it is running and on the right wiphy.
3026  */
3027 static struct net_device *get_vlan(struct genl_info *info,
3028                                    struct cfg80211_registered_device *rdev)
3029 {
3030         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3031         struct net_device *v;
3032         int ret;
3033
3034         if (!vlanattr)
3035                 return NULL;
3036
3037         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3038         if (!v)
3039                 return ERR_PTR(-ENODEV);
3040
3041         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3042                 ret = -EINVAL;
3043                 goto error;
3044         }
3045
3046         if (!netif_running(v)) {
3047                 ret = -ENETDOWN;
3048                 goto error;
3049         }
3050
3051         return v;
3052  error:
3053         dev_put(v);
3054         return ERR_PTR(ret);
3055 }
3056
3057 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3058 {
3059         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3060         int err;
3061         struct net_device *dev = info->user_ptr[1];
3062         struct station_parameters params;
3063         u8 *mac_addr = NULL;
3064
3065         memset(&params, 0, sizeof(params));
3066
3067         params.listen_interval = -1;
3068         params.plink_state = -1;
3069
3070         if (info->attrs[NL80211_ATTR_STA_AID])
3071                 return -EINVAL;
3072
3073         if (!info->attrs[NL80211_ATTR_MAC])
3074                 return -EINVAL;
3075
3076         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3077
3078         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3079                 params.supported_rates =
3080                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3081                 params.supported_rates_len =
3082                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3083         }
3084
3085         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3086                 params.listen_interval =
3087                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3088
3089         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3090                 params.ht_capa =
3091                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3092
3093         if (!rdev->ops->change_station)
3094                 return -EOPNOTSUPP;
3095
3096         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3097                 return -EINVAL;
3098
3099         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3100                 params.plink_action =
3101                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3102
3103         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
3104                 params.plink_state =
3105                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3106
3107         switch (dev->ieee80211_ptr->iftype) {
3108         case NL80211_IFTYPE_AP:
3109         case NL80211_IFTYPE_AP_VLAN:
3110         case NL80211_IFTYPE_P2P_GO:
3111                 /* disallow mesh-specific things */
3112                 if (params.plink_action)
3113                         return -EINVAL;
3114
3115                 /* TDLS can't be set, ... */
3116                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3117                         return -EINVAL;
3118                 /*
3119                  * ... but don't bother the driver with it. This works around
3120                  * a hostapd/wpa_supplicant issue -- it always includes the
3121                  * TLDS_PEER flag in the mask even for AP mode.
3122                  */
3123                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3124
3125                 /* accept only the listed bits */
3126                 if (params.sta_flags_mask &
3127                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3128                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3129                                   BIT(NL80211_STA_FLAG_WME) |
3130                                   BIT(NL80211_STA_FLAG_MFP)))
3131                         return -EINVAL;
3132
3133                 /* must be last in here for error handling */
3134                 params.vlan = get_vlan(info, rdev);
3135                 if (IS_ERR(params.vlan))
3136                         return PTR_ERR(params.vlan);
3137                 break;
3138         case NL80211_IFTYPE_P2P_CLIENT:
3139         case NL80211_IFTYPE_STATION:
3140                 /*
3141                  * Don't allow userspace to change the TDLS_PEER flag,
3142                  * but silently ignore attempts to change it since we
3143                  * don't have state here to verify that it doesn't try
3144                  * to change the flag.
3145                  */
3146                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3147                 /* fall through */
3148         case NL80211_IFTYPE_ADHOC:
3149                 /* disallow things sta doesn't support */
3150                 if (params.plink_action)
3151                         return -EINVAL;
3152                 if (params.ht_capa)
3153                         return -EINVAL;
3154                 if (params.listen_interval >= 0)
3155                         return -EINVAL;
3156                 /* reject any changes other than AUTHORIZED */
3157                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3158                         return -EINVAL;
3159                 break;
3160         case NL80211_IFTYPE_MESH_POINT:
3161                 /* disallow things mesh doesn't support */
3162                 if (params.vlan)
3163                         return -EINVAL;
3164                 if (params.ht_capa)
3165                         return -EINVAL;
3166                 if (params.listen_interval >= 0)
3167                         return -EINVAL;
3168                 /*
3169                  * No special handling for TDLS here -- the userspace
3170                  * mesh code doesn't have this bug.
3171                  */
3172                 if (params.sta_flags_mask &
3173                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3174                                   BIT(NL80211_STA_FLAG_MFP) |
3175                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3176                         return -EINVAL;
3177                 break;
3178         default:
3179                 return -EOPNOTSUPP;
3180         }
3181
3182         /* be aware of params.vlan when changing code here */
3183
3184         err = rdev_change_station(rdev, dev, mac_addr, &params);
3185
3186         if (params.vlan)
3187                 dev_put(params.vlan);
3188
3189         return err;
3190 }
3191
3192 static struct nla_policy
3193 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3194         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3195         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3196 };
3197
3198 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3199 {
3200         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3201         int err;
3202         struct net_device *dev = info->user_ptr[1];
3203         struct station_parameters params;
3204         u8 *mac_addr = NULL;
3205
3206         memset(&params, 0, sizeof(params));
3207
3208         if (!info->attrs[NL80211_ATTR_MAC])
3209                 return -EINVAL;
3210
3211         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3212                 return -EINVAL;
3213
3214         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3215                 return -EINVAL;
3216
3217         if (!info->attrs[NL80211_ATTR_STA_AID])
3218                 return -EINVAL;
3219
3220         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3221         params.supported_rates =
3222                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3223         params.supported_rates_len =
3224                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3225         params.listen_interval =
3226                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3227
3228         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3229         if (!params.aid || params.aid > IEEE80211_MAX_AID)
3230                 return -EINVAL;
3231
3232         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3233                 params.ht_capa =
3234                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3235
3236         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3237                 params.vht_capa =
3238                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3239
3240         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3241                 params.plink_action =
3242                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3243
3244         if (!rdev->ops->add_station)
3245                 return -EOPNOTSUPP;
3246
3247         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3248                 return -EINVAL;
3249
3250         switch (dev->ieee80211_ptr->iftype) {
3251         case NL80211_IFTYPE_AP:
3252         case NL80211_IFTYPE_AP_VLAN:
3253         case NL80211_IFTYPE_P2P_GO:
3254                 /* parse WME attributes if sta is WME capable */
3255                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
3256                     (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
3257                     info->attrs[NL80211_ATTR_STA_WME]) {
3258                         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3259                         struct nlattr *nla;
3260
3261                         nla = info->attrs[NL80211_ATTR_STA_WME];
3262                         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3263                                                nl80211_sta_wme_policy);
3264                         if (err)
3265                                 return err;
3266
3267                         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3268                                 params.uapsd_queues =
3269                                      nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
3270                         if (params.uapsd_queues &
3271                                         ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3272                                 return -EINVAL;
3273
3274                         if (tb[NL80211_STA_WME_MAX_SP])
3275                                 params.max_sp =
3276                                      nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3277
3278                         if (params.max_sp &
3279                                         ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3280                                 return -EINVAL;
3281
3282                         params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3283                 }
3284                 /* TDLS peers cannot be added */
3285                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3286                         return -EINVAL;
3287                 /* but don't bother the driver with it */
3288                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3289
3290                 /* must be last in here for error handling */
3291                 params.vlan = get_vlan(info, rdev);
3292                 if (IS_ERR(params.vlan))
3293                         return PTR_ERR(params.vlan);
3294                 break;
3295         case NL80211_IFTYPE_MESH_POINT:
3296                 /* TDLS peers cannot be added */
3297                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3298                         return -EINVAL;
3299                 break;
3300         case NL80211_IFTYPE_STATION:
3301                 /* Only TDLS peers can be added */
3302                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3303                         return -EINVAL;
3304                 /* Can only add if TDLS ... */
3305                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
3306                         return -EOPNOTSUPP;
3307                 /* ... with external setup is supported */
3308                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
3309                         return -EOPNOTSUPP;
3310                 break;
3311         default:
3312                 return -EOPNOTSUPP;
3313         }
3314
3315         /* be aware of params.vlan when changing code here */
3316
3317         err = rdev_add_station(rdev, dev, mac_addr, &params);
3318
3319         if (params.vlan)
3320                 dev_put(params.vlan);
3321         return err;
3322 }
3323
3324 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
3325 {
3326         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3327         struct net_device *dev = info->user_ptr[1];
3328         u8 *mac_addr = NULL;
3329
3330         if (info->attrs[NL80211_ATTR_MAC])
3331                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3332
3333         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3334             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3335             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
3336             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3337                 return -EINVAL;
3338
3339         if (!rdev->ops->del_station)
3340                 return -EOPNOTSUPP;
3341
3342         return rdev_del_station(rdev, dev, mac_addr);
3343 }
3344
3345 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
3346                                 int flags, struct net_device *dev,
3347                                 u8 *dst, u8 *next_hop,
3348                                 struct mpath_info *pinfo)
3349 {
3350         void *hdr;
3351         struct nlattr *pinfoattr;
3352
3353         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3354         if (!hdr)
3355                 return -1;
3356
3357         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3358             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
3359             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
3360             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
3361                 goto nla_put_failure;
3362
3363         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
3364         if (!pinfoattr)
3365                 goto nla_put_failure;
3366         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
3367             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
3368                         pinfo->frame_qlen))
3369                 goto nla_put_failure;
3370         if (((pinfo->filled & MPATH_INFO_SN) &&
3371              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
3372             ((pinfo->filled & MPATH_INFO_METRIC) &&
3373              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
3374                          pinfo->metric)) ||
3375             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
3376              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
3377                          pinfo->exptime)) ||
3378             ((pinfo->filled & MPATH_INFO_FLAGS) &&
3379              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
3380                         pinfo->flags)) ||
3381             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
3382              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
3383                          pinfo->discovery_timeout)) ||
3384             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
3385              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
3386                         pinfo->discovery_retries)))
3387                 goto nla_put_failure;
3388
3389         nla_nest_end(msg, pinfoattr);
3390
3391         return genlmsg_end(msg, hdr);
3392
3393  nla_put_failure:
3394         genlmsg_cancel(msg, hdr);
3395         return -EMSGSIZE;
3396 }
3397
3398 static int nl80211_dump_mpath(struct sk_buff *skb,
3399                               struct netlink_callback *cb)
3400 {
3401         struct mpath_info pinfo;
3402         struct cfg80211_registered_device *dev;
3403         struct net_device *netdev;
3404         u8 dst[ETH_ALEN];
3405         u8 next_hop[ETH_ALEN];
3406         int path_idx = cb->args[1];
3407         int err;
3408
3409         err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3410         if (err)
3411                 return err;
3412
3413         if (!dev->ops->dump_mpath) {
3414                 err = -EOPNOTSUPP;
3415                 goto out_err;
3416         }
3417
3418         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
3419                 err = -EOPNOTSUPP;
3420                 goto out_err;
3421         }
3422
3423         while (1) {
3424                 err = rdev_dump_mpath(dev, netdev, path_idx, dst, next_hop,
3425                                       &pinfo);
3426                 if (err == -ENOENT)
3427                         break;
3428                 if (err)
3429                         goto out_err;
3430
3431                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
3432                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
3433                                        netdev, dst, next_hop,
3434                                        &pinfo) < 0)
3435                         goto out;
3436
3437                 path_idx++;
3438         }
3439
3440
3441  out:
3442         cb->args[1] = path_idx;
3443         err = skb->len;
3444  out_err:
3445         nl80211_finish_netdev_dump(dev);
3446         return err;
3447 }
3448
3449 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
3450 {
3451         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3452         int err;
3453         struct net_device *dev = info->user_ptr[1];
3454         struct mpath_info pinfo;
3455         struct sk_buff *msg;
3456         u8 *dst = NULL;
3457         u8 next_hop[ETH_ALEN];
3458
3459         memset(&pinfo, 0, sizeof(pinfo));
3460
3461         if (!info->attrs[NL80211_ATTR_MAC])
3462                 return -EINVAL;
3463
3464         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3465
3466         if (!rdev->ops->get_mpath)
3467                 return -EOPNOTSUPP;
3468
3469         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3470                 return -EOPNOTSUPP;
3471
3472         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
3473         if (err)
3474                 return err;
3475
3476         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3477         if (!msg)
3478                 return -ENOMEM;
3479
3480         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
3481                                  dev, dst, next_hop, &pinfo) < 0) {
3482                 nlmsg_free(msg);
3483                 return -ENOBUFS;
3484         }
3485
3486         return genlmsg_reply(msg, info);
3487 }
3488
3489 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
3490 {
3491         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3492         struct net_device *dev = info->user_ptr[1];
3493         u8 *dst = NULL;
3494         u8 *next_hop = NULL;
3495
3496         if (!info->attrs[NL80211_ATTR_MAC])
3497                 return -EINVAL;
3498
3499         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3500                 return -EINVAL;
3501
3502         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3503         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3504
3505         if (!rdev->ops->change_mpath)
3506                 return -EOPNOTSUPP;
3507
3508         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3509                 return -EOPNOTSUPP;
3510
3511         return rdev_change_mpath(rdev, dev, dst, next_hop);
3512 }
3513
3514 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3515 {
3516         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3517         struct net_device *dev = info->user_ptr[1];
3518         u8 *dst = NULL;
3519         u8 *next_hop = NULL;
3520
3521         if (!info->attrs[NL80211_ATTR_MAC])
3522                 return -EINVAL;
3523
3524         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3525                 return -EINVAL;
3526
3527         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3528         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3529
3530         if (!rdev->ops->add_mpath)
3531                 return -EOPNOTSUPP;
3532
3533         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3534                 return -EOPNOTSUPP;
3535
3536         return rdev_add_mpath(rdev, dev, dst, next_hop);
3537 }
3538
3539 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
3540 {
3541         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3542         struct net_device *dev = info->user_ptr[1];
3543         u8 *dst = NULL;
3544
3545         if (info->attrs[NL80211_ATTR_MAC])
3546                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3547
3548         if (!rdev->ops->del_mpath)
3549                 return -EOPNOTSUPP;
3550
3551         return rdev_del_mpath(rdev, dev, dst);
3552 }
3553
3554 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
3555 {
3556         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3557         struct net_device *dev = info->user_ptr[1];
3558         struct bss_parameters params;
3559
3560         memset(&params, 0, sizeof(params));
3561         /* default to not changing parameters */
3562         params.use_cts_prot = -1;
3563         params.use_short_preamble = -1;
3564         params.use_short_slot_time = -1;
3565         params.ap_isolate = -1;
3566         params.ht_opmode = -1;
3567
3568         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
3569                 params.use_cts_prot =
3570                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
3571         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
3572                 params.use_short_preamble =
3573                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
3574         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
3575                 params.use_short_slot_time =
3576                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
3577         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3578                 params.basic_rates =
3579                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3580                 params.basic_rates_len =
3581                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3582         }
3583         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
3584                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
3585         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
3586                 params.ht_opmode =
3587                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
3588
3589         if (!rdev->ops->change_bss)
3590                 return -EOPNOTSUPP;
3591
3592         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3593             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3594                 return -EOPNOTSUPP;
3595
3596         return rdev_change_bss(rdev, dev, &params);
3597 }
3598
3599 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
3600         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
3601         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
3602         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
3603         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
3604         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
3605         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
3606 };
3607
3608 static int parse_reg_rule(struct nlattr *tb[],
3609         struct ieee80211_reg_rule *reg_rule)
3610 {
3611         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
3612         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
3613
3614         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
3615                 return -EINVAL;
3616         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
3617                 return -EINVAL;
3618         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
3619                 return -EINVAL;
3620         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
3621                 return -EINVAL;
3622         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
3623                 return -EINVAL;
3624
3625         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
3626
3627         freq_range->start_freq_khz =
3628                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
3629         freq_range->end_freq_khz =
3630                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
3631         freq_range->max_bandwidth_khz =
3632                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
3633
3634         power_rule->max_eirp =
3635                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
3636
3637         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
3638                 power_rule->max_antenna_gain =
3639                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
3640
3641         return 0;
3642 }
3643
3644 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
3645 {
3646         int r;
3647         char *data = NULL;
3648         enum nl80211_user_reg_hint_type user_reg_hint_type;
3649
3650         /*
3651          * You should only get this when cfg80211 hasn't yet initialized
3652          * completely when built-in to the kernel right between the time
3653          * window between nl80211_init() and regulatory_init(), if that is
3654          * even possible.
3655          */
3656         mutex_lock(&cfg80211_mutex);
3657         if (unlikely(!cfg80211_regdomain)) {
3658                 mutex_unlock(&cfg80211_mutex);
3659                 return -EINPROGRESS;
3660         }
3661         mutex_unlock(&cfg80211_mutex);
3662
3663         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3664                 return -EINVAL;
3665
3666         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3667
3668         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
3669                 user_reg_hint_type =
3670                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
3671         else
3672                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
3673
3674         switch (user_reg_hint_type) {
3675         case NL80211_USER_REG_HINT_USER:
3676         case NL80211_USER_REG_HINT_CELL_BASE:
3677                 break;
3678         default:
3679                 return -EINVAL;
3680         }
3681
3682         r = regulatory_hint_user(data, user_reg_hint_type);
3683
3684         return r;
3685 }
3686
3687 static int nl80211_get_mesh_config(struct sk_buff *skb,
3688                                    struct genl_info *info)
3689 {
3690         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3691         struct net_device *dev = info->user_ptr[1];
3692         struct wireless_dev *wdev = dev->ieee80211_ptr;
3693         struct mesh_config cur_params;
3694         int err = 0;
3695         void *hdr;
3696         struct nlattr *pinfoattr;
3697         struct sk_buff *msg;
3698
3699         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3700                 return -EOPNOTSUPP;
3701
3702         if (!rdev->ops->get_mesh_config)
3703                 return -EOPNOTSUPP;
3704
3705         wdev_lock(wdev);
3706         /* If not connected, get default parameters */
3707         if (!wdev->mesh_id_len)
3708                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3709         else
3710                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
3711         wdev_unlock(wdev);
3712
3713         if (err)
3714                 return err;
3715
3716         /* Draw up a netlink message to send back */
3717         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3718         if (!msg)
3719                 return -ENOMEM;
3720         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3721                              NL80211_CMD_GET_MESH_CONFIG);
3722         if (!hdr)
3723                 goto out;
3724         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3725         if (!pinfoattr)
3726                 goto nla_put_failure;
3727         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3728             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3729                         cur_params.dot11MeshRetryTimeout) ||
3730             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3731                         cur_params.dot11MeshConfirmTimeout) ||
3732             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3733                         cur_params.dot11MeshHoldingTimeout) ||
3734             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3735                         cur_params.dot11MeshMaxPeerLinks) ||
3736             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
3737                        cur_params.dot11MeshMaxRetries) ||
3738             nla_put_u8(msg, NL80211_MESHCONF_TTL,
3739                        cur_params.dot11MeshTTL) ||
3740             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3741                        cur_params.element_ttl) ||
3742             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3743                        cur_params.auto_open_plinks) ||
3744             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3745                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
3746             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3747                        cur_params.dot11MeshHWMPmaxPREQretries) ||
3748             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3749                         cur_params.path_refresh_time) ||
3750             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3751                         cur_params.min_discovery_timeout) ||
3752             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3753                         cur_params.dot11MeshHWMPactivePathTimeout) ||
3754             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3755                         cur_params.dot11MeshHWMPpreqMinInterval) ||
3756             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3757                         cur_params.dot11MeshHWMPperrMinInterval) ||
3758             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3759                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
3760             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3761                        cur_params.dot11MeshHWMPRootMode) ||
3762             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3763                         cur_params.dot11MeshHWMPRannInterval) ||
3764             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3765                        cur_params.dot11MeshGateAnnouncementProtocol) ||
3766             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
3767                        cur_params.dot11MeshForwarding) ||
3768             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
3769                         cur_params.rssi_threshold) ||
3770             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
3771                         cur_params.ht_opmode) ||
3772             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3773                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
3774             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3775                         cur_params.dot11MeshHWMProotInterval) ||
3776             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3777                         cur_params.dot11MeshHWMPconfirmationInterval))
3778                 goto nla_put_failure;
3779         nla_nest_end(msg, pinfoattr);
3780         genlmsg_end(msg, hdr);
3781         return genlmsg_reply(msg, info);
3782
3783  nla_put_failure:
3784         genlmsg_cancel(msg, hdr);
3785  out:
3786         nlmsg_free(msg);
3787         return -ENOBUFS;
3788 }
3789
3790 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3791         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3792         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3793         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3794         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3795         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3796         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3797         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3798         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3799         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
3800         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3801         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3802         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3803         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3804         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3805         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
3806         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3807         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3808         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3809         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3810         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
3811         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
3812         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
3813         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
3814         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
3815         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
3816 };
3817
3818 static const struct nla_policy
3819         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3820         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
3821         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3822         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3823         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3824         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3825                                     .len = IEEE80211_MAX_DATA_LEN },
3826         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3827 };
3828
3829 static int nl80211_parse_mesh_config(struct genl_info *info,
3830                                      struct mesh_config *cfg,
3831                                      u32 *mask_out)
3832 {
3833         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3834         u32 mask = 0;
3835
3836 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3837 do {\
3838         if (table[attr_num]) {\
3839                 cfg->param = nla_fn(table[attr_num]); \
3840                 mask |= (1 << (attr_num - 1)); \
3841         } \
3842 } while (0);\
3843
3844
3845         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3846                 return -EINVAL;
3847         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3848                              info->attrs[NL80211_ATTR_MESH_CONFIG],
3849                              nl80211_meshconf_params_policy))
3850                 return -EINVAL;
3851
3852         /* This makes sure that there aren't more than 32 mesh config
3853          * parameters (otherwise our bitfield scheme would not work.) */
3854         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3855
3856         /* Fill in the params struct */
3857         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3858                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
3859                                   nla_get_u16);
3860         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3861                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3862                                   nla_get_u16);
3863         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3864                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
3865                                   nla_get_u16);
3866         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3867                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
3868                                   nla_get_u16);
3869         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3870                                   mask, NL80211_MESHCONF_MAX_RETRIES,
3871                                   nla_get_u8);
3872         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3873                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
3874         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3875                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
3876                                   nla_get_u8);
3877         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3878                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3879                                   nla_get_u8);
3880         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, mask,
3881                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3882                                   nla_get_u32);
3883         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3884                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3885                                   nla_get_u8);
3886         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3887                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
3888                                   nla_get_u32);
3889         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3890                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3891                                   nla_get_u16);
3892         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, mask,
3893                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3894                                   nla_get_u32);
3895         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3896                                   mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3897                                   nla_get_u16);
3898         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
3899                                   mask, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3900                                   nla_get_u16);
3901         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3902                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
3903                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3904                                   nla_get_u16);
3905         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
3906                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
3907         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
3908                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3909                                   nla_get_u16);
3910         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3911                                   dot11MeshGateAnnouncementProtocol, mask,
3912                                   NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3913                                   nla_get_u8);
3914         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding,
3915                                   mask, NL80211_MESHCONF_FORWARDING,
3916                                   nla_get_u8);
3917         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold,
3918                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
3919                                   nla_get_u32);
3920         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode,
3921                                   mask, NL80211_MESHCONF_HT_OPMODE,
3922                                   nla_get_u16);
3923         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
3924                                   mask,
3925                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3926                                   nla_get_u32);
3927         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval,
3928                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3929                                   nla_get_u16);
3930         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3931                                   dot11MeshHWMPconfirmationInterval, mask,
3932                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3933                                   nla_get_u16);
3934         if (mask_out)
3935                 *mask_out = mask;
3936
3937         return 0;
3938
3939 #undef FILL_IN_MESH_PARAM_IF_SET
3940 }
3941
3942 static int nl80211_parse_mesh_setup(struct genl_info *info,
3943                                      struct mesh_setup *setup)
3944 {
3945         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3946
3947         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3948                 return -EINVAL;
3949         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3950                              info->attrs[NL80211_ATTR_MESH_SETUP],
3951                              nl80211_mesh_setup_params_policy))
3952                 return -EINVAL;
3953
3954         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
3955                 setup->sync_method =
3956                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
3957                  IEEE80211_SYNC_METHOD_VENDOR :
3958                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
3959
3960         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3961                 setup->path_sel_proto =
3962                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3963                  IEEE80211_PATH_PROTOCOL_VENDOR :
3964                  IEEE80211_PATH_PROTOCOL_HWMP;
3965
3966         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3967                 setup->path_metric =
3968                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3969                  IEEE80211_PATH_METRIC_VENDOR :
3970                  IEEE80211_PATH_METRIC_AIRTIME;
3971
3972
3973         if (tb[NL80211_MESH_SETUP_IE]) {
3974                 struct nlattr *ieattr =
3975                         tb[NL80211_MESH_SETUP_IE];
3976                 if (!is_valid_ie_attr(ieattr))
3977                         return -EINVAL;
3978                 setup->ie = nla_data(ieattr);
3979                 setup->ie_len = nla_len(ieattr);
3980         }
3981         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3982         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3983
3984         return 0;
3985 }
3986
3987 static int nl80211_update_mesh_config(struct sk_buff *skb,
3988                                       struct genl_info *info)
3989 {
3990         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3991         struct net_device *dev = info->user_ptr[1];
3992         struct wireless_dev *wdev = dev->ieee80211_ptr;
3993         struct mesh_config cfg;
3994         u32 mask;
3995         int err;
3996
3997         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3998                 return -EOPNOTSUPP;
3999
4000         if (!rdev->ops->update_mesh_config)
4001                 return -EOPNOTSUPP;
4002
4003         err = nl80211_parse_mesh_config(info, &cfg, &mask);
4004         if (err)
4005                 return err;
4006
4007         wdev_lock(wdev);
4008         if (!wdev->mesh_id_len)
4009                 err = -ENOLINK;
4010
4011         if (!err)
4012                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
4013
4014         wdev_unlock(wdev);
4015
4016         return err;
4017 }
4018
4019 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
4020 {
4021         struct sk_buff *msg;
4022         void *hdr = NULL;
4023         struct nlattr *nl_reg_rules;
4024         unsigned int i;
4025         int err = -EINVAL;
4026
4027         mutex_lock(&cfg80211_mutex);
4028
4029         if (!cfg80211_regdomain)
4030                 goto out;
4031
4032         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4033         if (!msg) {
4034                 err = -ENOBUFS;
4035                 goto out;
4036         }
4037
4038         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4039                              NL80211_CMD_GET_REG);
4040         if (!hdr)
4041                 goto put_failure;
4042
4043         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
4044                            cfg80211_regdomain->alpha2) ||
4045             (cfg80211_regdomain->dfs_region &&
4046              nla_put_u8(msg, NL80211_ATTR_DFS_REGION,
4047                         cfg80211_regdomain->dfs_region)))
4048                 goto nla_put_failure;
4049
4050         if (reg_last_request_cell_base() &&
4051             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4052                         NL80211_USER_REG_HINT_CELL_BASE))
4053                 goto nla_put_failure;
4054
4055         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4056         if (!nl_reg_rules)
4057                 goto nla_put_failure;
4058
4059         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
4060                 struct nlattr *nl_reg_rule;
4061                 const struct ieee80211_reg_rule *reg_rule;
4062                 const struct ieee80211_freq_range *freq_range;
4063                 const struct ieee80211_power_rule *power_rule;
4064
4065                 reg_rule = &cfg80211_regdomain->reg_rules[i];
4066                 freq_range = &reg_rule->freq_range;
4067                 power_rule = &reg_rule->power_rule;
4068
4069                 nl_reg_rule = nla_nest_start(msg, i);
4070                 if (!nl_reg_rule)
4071                         goto nla_put_failure;
4072
4073                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4074                                 reg_rule->flags) ||
4075                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4076                                 freq_range->start_freq_khz) ||
4077                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4078                                 freq_range->end_freq_khz) ||
4079                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4080                                 freq_range->max_bandwidth_khz) ||
4081                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4082                                 power_rule->max_antenna_gain) ||
4083                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4084                                 power_rule->max_eirp))
4085                         goto nla_put_failure;
4086
4087                 nla_nest_end(msg, nl_reg_rule);
4088         }
4089
4090         nla_nest_end(msg, nl_reg_rules);
4091
4092         genlmsg_end(msg, hdr);
4093         err = genlmsg_reply(msg, info);
4094         goto out;
4095
4096 nla_put_failure:
4097         genlmsg_cancel(msg, hdr);
4098 put_failure:
4099         nlmsg_free(msg);
4100         err = -EMSGSIZE;
4101 out:
4102         mutex_unlock(&cfg80211_mutex);
4103         return err;
4104 }
4105
4106 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4107 {
4108         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4109         struct nlattr *nl_reg_rule;
4110         char *alpha2 = NULL;
4111         int rem_reg_rules = 0, r = 0;
4112         u32 num_rules = 0, rule_idx = 0, size_of_regd;
4113         u8 dfs_region = 0;
4114         struct ieee80211_regdomain *rd = NULL;
4115
4116         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4117                 return -EINVAL;
4118
4119         if (!info->attrs[NL80211_ATTR_REG_RULES])
4120                 return -EINVAL;
4121
4122         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4123
4124         if (info->attrs[NL80211_ATTR_DFS_REGION])
4125                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4126
4127         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4128                         rem_reg_rules) {
4129                 num_rules++;
4130                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4131                         return -EINVAL;
4132         }
4133
4134         mutex_lock(&cfg80211_mutex);
4135
4136         if (!reg_is_valid_request(alpha2)) {
4137                 r = -EINVAL;
4138                 goto bad_reg;
4139         }
4140
4141         size_of_regd = sizeof(struct ieee80211_regdomain) +
4142                 (num_rules * sizeof(struct ieee80211_reg_rule));
4143
4144         rd = kzalloc(size_of_regd, GFP_KERNEL);
4145         if (!rd) {
4146                 r = -ENOMEM;
4147                 goto bad_reg;
4148         }
4149
4150         rd->n_reg_rules = num_rules;
4151         rd->alpha2[0] = alpha2[0];
4152         rd->alpha2[1] = alpha2[1];
4153
4154         /*
4155          * Disable DFS master mode if the DFS region was
4156          * not supported or known on this kernel.
4157          */
4158         if (reg_supported_dfs_region(dfs_region))
4159                 rd->dfs_region = dfs_region;
4160
4161         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4162                         rem_reg_rules) {
4163                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4164                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4165                         reg_rule_policy);
4166                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4167                 if (r)
4168                         goto bad_reg;
4169
4170                 rule_idx++;
4171
4172                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
4173                         r = -EINVAL;
4174                         goto bad_reg;
4175                 }
4176         }
4177
4178         BUG_ON(rule_idx != num_rules);
4179
4180         r = set_regdom(rd);
4181
4182         mutex_unlock(&cfg80211_mutex);
4183
4184         return r;
4185
4186  bad_reg:
4187         mutex_unlock(&cfg80211_mutex);
4188         kfree(rd);
4189         return r;
4190 }
4191
4192 static int validate_scan_freqs(struct nlattr *freqs)
4193 {
4194         struct nlattr *attr1, *attr2;
4195         int n_channels = 0, tmp1, tmp2;
4196
4197         nla_for_each_nested(attr1, freqs, tmp1) {
4198                 n_channels++;
4199                 /*
4200                  * Some hardware has a limited channel list for
4201                  * scanning, and it is pretty much nonsensical
4202                  * to scan for a channel twice, so disallow that
4203                  * and don't require drivers to check that the
4204                  * channel list they get isn't longer than what
4205                  * they can scan, as long as they can scan all
4206                  * the channels they registered at once.
4207                  */
4208                 nla_for_each_nested(attr2, freqs, tmp2)
4209                         if (attr1 != attr2 &&
4210                             nla_get_u32(attr1) == nla_get_u32(attr2))
4211                                 return 0;
4212         }
4213
4214         return n_channels;
4215 }
4216
4217 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4218 {
4219         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4220         struct wireless_dev *wdev = info->user_ptr[1];
4221         struct cfg80211_scan_request *request;
4222         struct nlattr *attr;
4223         struct wiphy *wiphy;
4224         int err, tmp, n_ssids = 0, n_channels, i;
4225         size_t ie_len;
4226
4227         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4228                 return -EINVAL;
4229
4230         wiphy = &rdev->wiphy;
4231
4232         if (!rdev->ops->scan)
4233                 return -EOPNOTSUPP;
4234
4235         if (rdev->scan_req)
4236                 return -EBUSY;
4237
4238         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4239                 n_channels = validate_scan_freqs(
4240                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4241                 if (!n_channels)
4242                         return -EINVAL;
4243         } else {
4244                 enum ieee80211_band band;
4245                 n_channels = 0;
4246
4247                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4248                         if (wiphy->bands[band])
4249                                 n_channels += wiphy->bands[band]->n_channels;
4250         }
4251
4252         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4253                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4254                         n_ssids++;
4255
4256         if (n_ssids > wiphy->max_scan_ssids)
4257                 return -EINVAL;
4258
4259         if (info->attrs[NL80211_ATTR_IE])
4260                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4261         else
4262                 ie_len = 0;
4263
4264         if (ie_len > wiphy->max_scan_ie_len)
4265                 return -EINVAL;
4266
4267         request = kzalloc(sizeof(*request)
4268                         + sizeof(*request->ssids) * n_ssids
4269                         + sizeof(*request->channels) * n_channels
4270                         + ie_len, GFP_KERNEL);
4271         if (!request)
4272                 return -ENOMEM;
4273
4274         if (n_ssids)
4275                 request->ssids = (void *)&request->channels[n_channels];
4276         request->n_ssids = n_ssids;
4277         if (ie_len) {
4278                 if (request->ssids)
4279                         request->ie = (void *)(request->ssids + n_ssids);
4280                 else
4281                         request->ie = (void *)(request->channels + n_channels);
4282         }
4283
4284         i = 0;
4285         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4286                 /* user specified, bail out if channel not found */
4287                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
4288                         struct ieee80211_channel *chan;
4289
4290                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4291
4292                         if (!chan) {
4293                                 err = -EINVAL;
4294                                 goto out_free;
4295                         }
4296
4297                         /* ignore disabled channels */
4298                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4299                                 continue;
4300
4301                         request->channels[i] = chan;
4302                         i++;
4303                 }
4304         } else {
4305                 enum ieee80211_band band;
4306
4307                 /* all channels */
4308                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4309                         int j;
4310                         if (!wiphy->bands[band])
4311                                 continue;
4312                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4313                                 struct ieee80211_channel *chan;
4314
4315                                 chan = &wiphy->bands[band]->channels[j];
4316
4317                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4318                                         continue;
4319
4320                                 request->channels[i] = chan;
4321                                 i++;
4322                         }
4323                 }
4324         }
4325
4326         if (!i) {
4327                 err = -EINVAL;
4328                 goto out_free;
4329         }
4330
4331         request->n_channels = i;
4332
4333         i = 0;
4334         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4335                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
4336                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4337                                 err = -EINVAL;
4338                                 goto out_free;
4339                         }
4340                         request->ssids[i].ssid_len = nla_len(attr);
4341                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
4342                         i++;
4343                 }
4344         }
4345
4346         if (info->attrs[NL80211_ATTR_IE]) {
4347                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4348                 memcpy((void *)request->ie,
4349                        nla_data(info->attrs[NL80211_ATTR_IE]),
4350                        request->ie_len);
4351         }
4352
4353         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
4354                 if (wiphy->bands[i])
4355                         request->rates[i] =
4356                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
4357
4358         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
4359                 nla_for_each_nested(attr,
4360                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
4361                                     tmp) {
4362                         enum ieee80211_band band = nla_type(attr);
4363
4364                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4365                                 err = -EINVAL;
4366                                 goto out_free;
4367                         }
4368                         err = ieee80211_get_ratemask(wiphy->bands[band],
4369                                                      nla_data(attr),
4370                                                      nla_len(attr),
4371                                                      &request->rates[band]);
4372                         if (err)
4373                                 goto out_free;
4374                 }
4375         }
4376
4377         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4378                 request->flags = nla_get_u32(
4379                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4380                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4381                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4382                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4383                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4384                         err = -EOPNOTSUPP;
4385                         goto out_free;
4386                 }
4387         }
4388
4389         request->no_cck =
4390                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
4391
4392         request->wdev = wdev;
4393         request->wiphy = &rdev->wiphy;
4394         request->scan_start = jiffies;
4395
4396         rdev->scan_req = request;
4397         err = rdev_scan(rdev, request);
4398
4399         if (!err) {
4400                 nl80211_send_scan_start(rdev, wdev);
4401                 if (wdev->netdev)
4402                         dev_hold(wdev->netdev);
4403         } else {
4404  out_free:
4405                 rdev->scan_req = NULL;
4406                 kfree(request);
4407         }
4408
4409         return err;
4410 }
4411
4412 static int nl80211_start_sched_scan(struct sk_buff *skb,
4413                                     struct genl_info *info)
4414 {
4415         struct cfg80211_sched_scan_request *request;
4416         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4417         struct net_device *dev = info->user_ptr[1];
4418         struct nlattr *attr;
4419         struct wiphy *wiphy;
4420         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
4421         u32 interval;
4422         enum ieee80211_band band;
4423         size_t ie_len;
4424         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
4425
4426         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4427             !rdev->ops->sched_scan_start)
4428                 return -EOPNOTSUPP;
4429
4430         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4431                 return -EINVAL;
4432
4433         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
4434                 return -EINVAL;
4435
4436         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
4437         if (interval == 0)
4438                 return -EINVAL;
4439
4440         wiphy = &rdev->wiphy;
4441
4442         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4443                 n_channels = validate_scan_freqs(
4444                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4445                 if (!n_channels)
4446                         return -EINVAL;
4447         } else {
4448                 n_channels = 0;
4449
4450                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4451                         if (wiphy->bands[band])
4452                                 n_channels += wiphy->bands[band]->n_channels;
4453         }
4454
4455         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4456                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4457                                     tmp)
4458                         n_ssids++;
4459
4460         if (n_ssids > wiphy->max_sched_scan_ssids)
4461                 return -EINVAL;
4462
4463         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
4464                 nla_for_each_nested(attr,
4465                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4466                                     tmp)
4467                         n_match_sets++;
4468
4469         if (n_match_sets > wiphy->max_match_sets)
4470                 return -EINVAL;
4471
4472         if (info->attrs[NL80211_ATTR_IE])
4473                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4474         else
4475                 ie_len = 0;
4476
4477         if (ie_len > wiphy->max_sched_scan_ie_len)
4478                 return -EINVAL;
4479
4480         mutex_lock(&rdev->sched_scan_mtx);
4481
4482         if (rdev->sched_scan_req) {
4483                 err = -EINPROGRESS;
4484                 goto out;
4485         }
4486
4487         request = kzalloc(sizeof(*request)
4488                         + sizeof(*request->ssids) * n_ssids
4489                         + sizeof(*request->match_sets) * n_match_sets
4490                         + sizeof(*request->channels) * n_channels
4491                         + ie_len, GFP_KERNEL);
4492         if (!request) {
4493                 err = -ENOMEM;
4494                 goto out;
4495         }
4496
4497         if (n_ssids)
4498                 request->ssids = (void *)&request->channels[n_channels];
4499         request->n_ssids = n_ssids;
4500         if (ie_len) {
4501                 if (request->ssids)
4502                         request->ie = (void *)(request->ssids + n_ssids);
4503                 else
4504                         request->ie = (void *)(request->channels + n_channels);
4505         }
4506
4507         if (n_match_sets) {
4508                 if (request->ie)
4509                         request->match_sets = (void *)(request->ie + ie_len);
4510                 else if (request->ssids)
4511                         request->match_sets =
4512                                 (void *)(request->ssids + n_ssids);
4513                 else
4514                         request->match_sets =
4515                                 (void *)(request->channels + n_channels);
4516         }
4517         request->n_match_sets = n_match_sets;
4518
4519         i = 0;
4520         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4521                 /* user specified, bail out if channel not found */
4522                 nla_for_each_nested(attr,
4523                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
4524                                     tmp) {
4525                         struct ieee80211_channel *chan;
4526
4527                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4528
4529                         if (!chan) {
4530                                 err = -EINVAL;
4531                                 goto out_free;
4532                         }
4533
4534                         /* ignore disabled channels */
4535                         if (chan->flags & IEEE80211_CHAN_DISABLED)
4536                                 continue;
4537
4538                         request->channels[i] = chan;
4539                         i++;
4540                 }
4541         } else {
4542                 /* all channels */
4543                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4544                         int j;
4545                         if (!wiphy->bands[band])
4546                                 continue;
4547                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4548                                 struct ieee80211_channel *chan;
4549
4550                                 chan = &wiphy->bands[band]->channels[j];
4551
4552                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
4553                                         continue;
4554
4555                                 request->channels[i] = chan;
4556                                 i++;
4557                         }
4558                 }
4559         }
4560
4561         if (!i) {
4562                 err = -EINVAL;
4563                 goto out_free;
4564         }
4565
4566         request->n_channels = i;
4567
4568         i = 0;
4569         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4570                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4571                                     tmp) {
4572                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4573                                 err = -EINVAL;
4574                                 goto out_free;
4575                         }
4576                         request->ssids[i].ssid_len = nla_len(attr);
4577                         memcpy(request->ssids[i].ssid, nla_data(attr),
4578                                nla_len(attr));
4579                         i++;
4580                 }
4581         }
4582
4583         i = 0;
4584         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
4585                 nla_for_each_nested(attr,
4586                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4587                                     tmp) {
4588                         struct nlattr *ssid, *rssi;
4589
4590                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
4591                                   nla_data(attr), nla_len(attr),
4592                                   nl80211_match_policy);
4593                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
4594                         if (ssid) {
4595                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
4596                                         err = -EINVAL;
4597                                         goto out_free;
4598                                 }
4599                                 memcpy(request->match_sets[i].ssid.ssid,
4600                                        nla_data(ssid), nla_len(ssid));
4601                                 request->match_sets[i].ssid.ssid_len =
4602                                         nla_len(ssid);
4603                         }
4604                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
4605                         if (rssi)
4606                                 request->rssi_thold = nla_get_u32(rssi);
4607                         else
4608                                 request->rssi_thold =
4609                                                    NL80211_SCAN_RSSI_THOLD_OFF;
4610                         i++;
4611                 }
4612         }
4613
4614         if (info->attrs[NL80211_ATTR_IE]) {
4615                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4616                 memcpy((void *)request->ie,
4617                        nla_data(info->attrs[NL80211_ATTR_IE]),
4618                        request->ie_len);
4619         }
4620
4621         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
4622                 request->flags = nla_get_u32(
4623                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
4624                 if (((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
4625                      !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
4626                     ((request->flags & NL80211_SCAN_FLAG_FLUSH) &&
4627                      !(wiphy->features & NL80211_FEATURE_SCAN_FLUSH))) {
4628                         err = -EOPNOTSUPP;
4629                         goto out_free;
4630                 }
4631         }
4632
4633         request->dev = dev;
4634         request->wiphy = &rdev->wiphy;
4635         request->interval = interval;
4636         request->scan_start = jiffies;
4637
4638         err = rdev_sched_scan_start(rdev, dev, request);
4639         if (!err) {
4640                 rdev->sched_scan_req = request;
4641                 nl80211_send_sched_scan(rdev, dev,
4642                                         NL80211_CMD_START_SCHED_SCAN);
4643                 goto out;
4644         }
4645
4646 out_free:
4647         kfree(request);
4648 out:
4649         mutex_unlock(&rdev->sched_scan_mtx);
4650         return err;
4651 }
4652
4653 static int nl80211_stop_sched_scan(struct sk_buff *skb,
4654                                    struct genl_info *info)
4655 {
4656         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4657         int err;
4658
4659         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4660             !rdev->ops->sched_scan_stop)
4661                 return -EOPNOTSUPP;
4662
4663         mutex_lock(&rdev->sched_scan_mtx);
4664         err = __cfg80211_stop_sched_scan(rdev, false);
4665         mutex_unlock(&rdev->sched_scan_mtx);
4666
4667         return err;
4668 }
4669
4670 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
4671                             u32 seq, int flags,
4672                             struct cfg80211_registered_device *rdev,
4673                             struct wireless_dev *wdev,
4674                             struct cfg80211_internal_bss *intbss)
4675 {
4676         struct cfg80211_bss *res = &intbss->pub;
4677         void *hdr;
4678         struct nlattr *bss;
4679
4680         ASSERT_WDEV_LOCK(wdev);
4681
4682         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
4683                              NL80211_CMD_NEW_SCAN_RESULTS);
4684         if (!hdr)
4685                 return -1;
4686
4687         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
4688
4689         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
4690             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
4691                 goto nla_put_failure;
4692
4693         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
4694         if (!bss)
4695                 goto nla_put_failure;
4696         if ((!is_zero_ether_addr(res->bssid) &&
4697              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)) ||
4698             (res->information_elements && res->len_information_elements &&
4699              nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
4700                      res->len_information_elements,
4701                      res->information_elements)) ||
4702             (res->beacon_ies && res->len_beacon_ies &&
4703              res->beacon_ies != res->information_elements &&
4704              nla_put(msg, NL80211_BSS_BEACON_IES,
4705                      res->len_beacon_ies, res->beacon_ies)))
4706                 goto nla_put_failure;
4707         if (res->tsf &&
4708             nla_put_u64(msg, NL80211_BSS_TSF, res->tsf))
4709                 goto nla_put_failure;
4710         if (res->beacon_interval &&
4711             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
4712                 goto nla_put_failure;
4713         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
4714             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
4715             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
4716                         jiffies_to_msecs(jiffies - intbss->ts)))
4717                 goto nla_put_failure;
4718
4719         switch (rdev->wiphy.signal_type) {
4720         case CFG80211_SIGNAL_TYPE_MBM:
4721                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
4722                         goto nla_put_failure;
4723                 break;
4724         case CFG80211_SIGNAL_TYPE_UNSPEC:
4725                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
4726                         goto nla_put_failure;
4727                 break;
4728         default:
4729                 break;
4730         }
4731
4732         switch (wdev->iftype) {
4733         case NL80211_IFTYPE_P2P_CLIENT:
4734         case NL80211_IFTYPE_STATION:
4735                 if (intbss == wdev->current_bss &&
4736                     nla_put_u32(msg, NL80211_BSS_STATUS,
4737                                 NL80211_BSS_STATUS_ASSOCIATED))
4738                         goto nla_put_failure;
4739                 break;
4740         case NL80211_IFTYPE_ADHOC:
4741                 if (intbss == wdev->current_bss &&
4742                     nla_put_u32(msg, NL80211_BSS_STATUS,
4743                                 NL80211_BSS_STATUS_IBSS_JOINED))
4744                         goto nla_put_failure;
4745                 break;
4746         default:
4747                 break;
4748         }
4749
4750         nla_nest_end(msg, bss);
4751
4752         return genlmsg_end(msg, hdr);
4753
4754  nla_put_failure:
4755         genlmsg_cancel(msg, hdr);
4756         return -EMSGSIZE;
4757 }
4758
4759 static int nl80211_dump_scan(struct sk_buff *skb,
4760                              struct netlink_callback *cb)
4761 {
4762         struct cfg80211_registered_device *rdev;
4763         struct net_device *dev;
4764         struct cfg80211_internal_bss *scan;
4765         struct wireless_dev *wdev;
4766         int start = cb->args[1], idx = 0;
4767         int err;
4768
4769         err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
4770         if (err)
4771                 return err;
4772
4773         wdev = dev->ieee80211_ptr;
4774
4775         wdev_lock(wdev);
4776         spin_lock_bh(&rdev->bss_lock);
4777         cfg80211_bss_expire(rdev);
4778
4779         cb->seq = rdev->bss_generation;
4780
4781         list_for_each_entry(scan, &rdev->bss_list, list) {
4782                 if (++idx <= start)
4783                         continue;
4784                 if (nl80211_send_bss(skb, cb,
4785                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4786                                 rdev, wdev, scan) < 0) {
4787                         idx--;
4788                         break;
4789                 }
4790         }
4791
4792         spin_unlock_bh(&rdev->bss_lock);
4793         wdev_unlock(wdev);
4794
4795         cb->args[1] = idx;
4796         nl80211_finish_netdev_dump(rdev);
4797
4798         return skb->len;
4799 }
4800
4801 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
4802                                 int flags, struct net_device *dev,
4803                                 struct survey_info *survey)
4804 {
4805         void *hdr;
4806         struct nlattr *infoattr;
4807
4808         hdr = nl80211hdr_put(msg, portid, seq, flags,
4809                              NL80211_CMD_NEW_SURVEY_RESULTS);
4810         if (!hdr)
4811                 return -ENOMEM;
4812
4813         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
4814                 goto nla_put_failure;
4815
4816         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
4817         if (!infoattr)
4818                 goto nla_put_failure;
4819
4820         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
4821                         survey->channel->center_freq))
4822                 goto nla_put_failure;
4823
4824         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
4825             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
4826                 goto nla_put_failure;
4827         if ((survey->filled & SURVEY_INFO_IN_USE) &&
4828             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
4829                 goto nla_put_failure;
4830         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
4831             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
4832                         survey->channel_time))
4833                 goto nla_put_failure;
4834         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
4835             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
4836                         survey->channel_time_busy))
4837                 goto nla_put_failure;
4838         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
4839             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
4840                         survey->channel_time_ext_busy))
4841                 goto nla_put_failure;
4842         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
4843             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
4844                         survey->channel_time_rx))
4845                 goto nla_put_failure;
4846         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
4847             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
4848                         survey->channel_time_tx))
4849                 goto nla_put_failure;
4850
4851         nla_nest_end(msg, infoattr);
4852
4853         return genlmsg_end(msg, hdr);
4854
4855  nla_put_failure:
4856         genlmsg_cancel(msg, hdr);
4857         return -EMSGSIZE;
4858 }
4859
4860 static int nl80211_dump_survey(struct sk_buff *skb,
4861                         struct netlink_callback *cb)
4862 {
4863         struct survey_info survey;
4864         struct cfg80211_registered_device *dev;
4865         struct net_device *netdev;
4866         int survey_idx = cb->args[1];
4867         int res;
4868
4869         res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4870         if (res)
4871                 return res;
4872
4873         if (!dev->ops->dump_survey) {
4874                 res = -EOPNOTSUPP;
4875                 goto out_err;
4876         }
4877
4878         while (1) {
4879                 struct ieee80211_channel *chan;
4880
4881                 res = rdev_dump_survey(dev, netdev, survey_idx, &survey);
4882                 if (res == -ENOENT)
4883                         break;
4884                 if (res)
4885                         goto out_err;
4886
4887                 /* Survey without a channel doesn't make sense */
4888                 if (!survey.channel) {
4889                         res = -EINVAL;
4890                         goto out;
4891                 }
4892
4893                 chan = ieee80211_get_channel(&dev->wiphy,
4894                                              survey.channel->center_freq);
4895                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4896                         survey_idx++;
4897                         continue;
4898                 }
4899
4900                 if (nl80211_send_survey(skb,
4901                                 NETLINK_CB(cb->skb).portid,
4902                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4903                                 netdev,
4904                                 &survey) < 0)
4905                         goto out;
4906                 survey_idx++;
4907         }
4908
4909  out:
4910         cb->args[1] = survey_idx;
4911         res = skb->len;
4912  out_err:
4913         nl80211_finish_netdev_dump(dev);
4914         return res;
4915 }
4916
4917 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4918 {
4919         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4920                                   NL80211_WPA_VERSION_2));
4921 }
4922
4923 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4924 {
4925         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4926         struct net_device *dev = info->user_ptr[1];
4927         struct ieee80211_channel *chan;
4928         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
4929         int err, ssid_len, ie_len = 0, sae_data_len = 0;
4930         enum nl80211_auth_type auth_type;
4931         struct key_parse key;
4932         bool local_state_change;
4933
4934         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4935                 return -EINVAL;
4936
4937         if (!info->attrs[NL80211_ATTR_MAC])
4938                 return -EINVAL;
4939
4940         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4941                 return -EINVAL;
4942
4943         if (!info->attrs[NL80211_ATTR_SSID])
4944                 return -EINVAL;
4945
4946         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4947                 return -EINVAL;
4948
4949         err = nl80211_parse_key(info, &key);
4950         if (err)
4951                 return err;
4952
4953         if (key.idx >= 0) {
4954                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4955                         return -EINVAL;
4956                 if (!key.p.key || !key.p.key_len)
4957                         return -EINVAL;
4958                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4959                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4960                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4961                      key.p.key_len != WLAN_KEY_LEN_WEP104))
4962                         return -EINVAL;
4963                 if (key.idx > 4)
4964                         return -EINVAL;
4965         } else {
4966                 key.p.key_len = 0;
4967                 key.p.key = NULL;
4968         }
4969
4970         if (key.idx >= 0) {
4971                 int i;
4972                 bool ok = false;
4973                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4974                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4975                                 ok = true;
4976                                 break;
4977                         }
4978                 }
4979                 if (!ok)
4980                         return -EINVAL;
4981         }
4982
4983         if (!rdev->ops->auth)
4984                 return -EOPNOTSUPP;
4985
4986         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4987             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4988                 return -EOPNOTSUPP;
4989
4990         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4991         chan = ieee80211_get_channel(&rdev->wiphy,
4992                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4993         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4994                 return -EINVAL;
4995
4996         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4997         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4998
4999         if (info->attrs[NL80211_ATTR_IE]) {
5000                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5001                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5002         }
5003
5004         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5005         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
5006                 return -EINVAL;
5007
5008         if (auth_type == NL80211_AUTHTYPE_SAE &&
5009             !info->attrs[NL80211_ATTR_SAE_DATA])
5010                 return -EINVAL;
5011
5012         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
5013                 if (auth_type != NL80211_AUTHTYPE_SAE)
5014                         return -EINVAL;
5015                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
5016                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
5017                 /* need to include at least Auth Transaction and Status Code */
5018                 if (sae_data_len < 4)
5019                         return -EINVAL;
5020         }
5021
5022         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5023
5024         /*
5025          * Since we no longer track auth state, ignore
5026          * requests to only change local state.
5027          */
5028         if (local_state_change)
5029                 return 0;
5030
5031         return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
5032                                   ssid, ssid_len, ie, ie_len,
5033                                   key.p.key, key.p.key_len, key.idx,
5034                                   sae_data, sae_data_len);
5035 }
5036
5037 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
5038                                    struct genl_info *info,
5039                                    struct cfg80211_crypto_settings *settings,
5040                                    int cipher_limit)
5041 {
5042         memset(settings, 0, sizeof(*settings));
5043
5044         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
5045
5046         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
5047                 u16 proto;
5048                 proto = nla_get_u16(
5049                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
5050                 settings->control_port_ethertype = cpu_to_be16(proto);
5051                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
5052                     proto != ETH_P_PAE)
5053                         return -EINVAL;
5054                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
5055                         settings->control_port_no_encrypt = true;
5056         } else
5057                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
5058
5059         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
5060                 void *data;
5061                 int len, i;
5062
5063                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5064                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
5065                 settings->n_ciphers_pairwise = len / sizeof(u32);
5066
5067                 if (len % sizeof(u32))
5068                         return -EINVAL;
5069
5070                 if (settings->n_ciphers_pairwise > cipher_limit)
5071                         return -EINVAL;
5072
5073                 memcpy(settings->ciphers_pairwise, data, len);
5074
5075                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
5076                         if (!cfg80211_supported_cipher_suite(
5077                                         &rdev->wiphy,
5078                                         settings->ciphers_pairwise[i]))
5079                                 return -EINVAL;
5080         }
5081
5082         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5083                 settings->cipher_group =
5084                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5085                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5086                                                      settings->cipher_group))
5087                         return -EINVAL;
5088         }
5089
5090         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5091                 settings->wpa_versions =
5092                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5093                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5094                         return -EINVAL;
5095         }
5096
5097         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5098                 void *data;
5099                 int len;
5100
5101                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5102                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5103                 settings->n_akm_suites = len / sizeof(u32);
5104
5105                 if (len % sizeof(u32))
5106                         return -EINVAL;
5107
5108                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
5109                         return -EINVAL;
5110
5111                 memcpy(settings->akm_suites, data, len);
5112         }
5113
5114         return 0;
5115 }
5116
5117 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
5118 {
5119         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5120         struct net_device *dev = info->user_ptr[1];
5121         struct cfg80211_crypto_settings crypto;
5122         struct ieee80211_channel *chan;
5123         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
5124         int err, ssid_len, ie_len = 0;
5125         bool use_mfp = false;
5126         u32 flags = 0;
5127         struct ieee80211_ht_cap *ht_capa = NULL;
5128         struct ieee80211_ht_cap *ht_capa_mask = NULL;
5129
5130         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5131                 return -EINVAL;
5132
5133         if (!info->attrs[NL80211_ATTR_MAC] ||
5134             !info->attrs[NL80211_ATTR_SSID] ||
5135             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5136                 return -EINVAL;
5137
5138         if (!rdev->ops->assoc)
5139                 return -EOPNOTSUPP;
5140
5141         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5142             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5143                 return -EOPNOTSUPP;
5144
5145         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5146
5147         chan = ieee80211_get_channel(&rdev->wiphy,
5148                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5149         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5150                 return -EINVAL;
5151
5152         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5153         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5154
5155         if (info->attrs[NL80211_ATTR_IE]) {
5156                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5157                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5158         }
5159
5160         if (info->attrs[NL80211_ATTR_USE_MFP]) {
5161                 enum nl80211_mfp mfp =
5162                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
5163                 if (mfp == NL80211_MFP_REQUIRED)
5164                         use_mfp = true;
5165                 else if (mfp != NL80211_MFP_NO)
5166                         return -EINVAL;
5167         }
5168
5169         if (info->attrs[NL80211_ATTR_PREV_BSSID])
5170                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
5171
5172         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5173                 flags |= ASSOC_REQ_DISABLE_HT;
5174
5175         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5176                 ht_capa_mask =
5177                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
5178
5179         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5180                 if (!ht_capa_mask)
5181                         return -EINVAL;
5182                 ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5183         }
5184
5185         err = nl80211_crypto_settings(rdev, info, &crypto, 1);
5186         if (!err)
5187                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
5188                                           ssid, ssid_len, ie, ie_len, use_mfp,
5189                                           &crypto, flags, ht_capa,
5190                                           ht_capa_mask);
5191
5192         return err;
5193 }
5194
5195 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
5196 {
5197         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5198         struct net_device *dev = info->user_ptr[1];
5199         const u8 *ie = NULL, *bssid;
5200         int ie_len = 0;
5201         u16 reason_code;
5202         bool local_state_change;
5203
5204         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5205                 return -EINVAL;
5206
5207         if (!info->attrs[NL80211_ATTR_MAC])
5208                 return -EINVAL;
5209
5210         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5211                 return -EINVAL;
5212
5213         if (!rdev->ops->deauth)
5214                 return -EOPNOTSUPP;
5215
5216         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5217             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5218                 return -EOPNOTSUPP;
5219
5220         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5221
5222         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5223         if (reason_code == 0) {
5224                 /* Reason Code 0 is reserved */
5225                 return -EINVAL;
5226         }
5227
5228         if (info->attrs[NL80211_ATTR_IE]) {
5229                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5230                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5231         }
5232
5233         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5234
5235         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
5236                                     local_state_change);
5237 }
5238
5239 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
5240 {
5241         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5242         struct net_device *dev = info->user_ptr[1];
5243         const u8 *ie = NULL, *bssid;
5244         int ie_len = 0;
5245         u16 reason_code;
5246         bool local_state_change;
5247
5248         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5249                 return -EINVAL;
5250
5251         if (!info->attrs[NL80211_ATTR_MAC])
5252                 return -EINVAL;
5253
5254         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5255                 return -EINVAL;
5256
5257         if (!rdev->ops->disassoc)
5258                 return -EOPNOTSUPP;
5259
5260         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5261             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5262                 return -EOPNOTSUPP;
5263
5264         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5265
5266         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5267         if (reason_code == 0) {
5268                 /* Reason Code 0 is reserved */
5269                 return -EINVAL;
5270         }
5271
5272         if (info->attrs[NL80211_ATTR_IE]) {
5273                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5274                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5275         }
5276
5277         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5278
5279         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
5280                                       local_state_change);
5281 }
5282
5283 static bool
5284 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
5285                          int mcast_rate[IEEE80211_NUM_BANDS],
5286                          int rateval)
5287 {
5288         struct wiphy *wiphy = &rdev->wiphy;
5289         bool found = false;
5290         int band, i;
5291
5292         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5293                 struct ieee80211_supported_band *sband;
5294
5295                 sband = wiphy->bands[band];
5296                 if (!sband)
5297                         continue;
5298
5299                 for (i = 0; i < sband->n_bitrates; i++) {
5300                         if (sband->bitrates[i].bitrate == rateval) {
5301                                 mcast_rate[band] = i + 1;
5302                                 found = true;
5303                                 break;
5304                         }
5305                 }
5306         }
5307
5308         return found;
5309 }
5310
5311 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
5312 {
5313         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5314         struct net_device *dev = info->user_ptr[1];
5315         struct cfg80211_ibss_params ibss;
5316         struct wiphy *wiphy;
5317         struct cfg80211_cached_keys *connkeys = NULL;
5318         int err;
5319
5320         memset(&ibss, 0, sizeof(ibss));
5321
5322         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5323                 return -EINVAL;
5324
5325         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5326             !info->attrs[NL80211_ATTR_SSID] ||
5327             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5328                 return -EINVAL;
5329
5330         ibss.beacon_interval = 100;
5331
5332         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
5333                 ibss.beacon_interval =
5334                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5335                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
5336                         return -EINVAL;
5337         }
5338
5339         if (!rdev->ops->join_ibss)
5340                 return -EOPNOTSUPP;
5341
5342         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5343                 return -EOPNOTSUPP;
5344
5345         wiphy = &rdev->wiphy;
5346
5347         if (info->attrs[NL80211_ATTR_MAC]) {
5348                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5349
5350                 if (!is_valid_ether_addr(ibss.bssid))
5351                         return -EINVAL;
5352         }
5353         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5354         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5355
5356         if (info->attrs[NL80211_ATTR_IE]) {
5357                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5358                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5359         }
5360
5361         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5362                 enum nl80211_channel_type channel_type;
5363
5364                 if (!nl80211_valid_channel_type(info, &channel_type))
5365                         return -EINVAL;
5366
5367                 if (channel_type != NL80211_CHAN_NO_HT &&
5368                     !(wiphy->features & NL80211_FEATURE_HT_IBSS))
5369                         return -EINVAL;
5370
5371                 ibss.channel_type = channel_type;
5372         } else {
5373                 ibss.channel_type = NL80211_CHAN_NO_HT;
5374         }
5375
5376         ibss.channel = rdev_freq_to_chan(rdev,
5377                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
5378                 ibss.channel_type);
5379         if (!ibss.channel ||
5380             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
5381             ibss.channel->flags & IEEE80211_CHAN_DISABLED)
5382                 return -EINVAL;
5383
5384         /* Both channels should be able to initiate communication */
5385         if ((ibss.channel_type == NL80211_CHAN_HT40PLUS ||
5386              ibss.channel_type == NL80211_CHAN_HT40MINUS) &&
5387             !cfg80211_can_beacon_sec_chan(&rdev->wiphy, ibss.channel,
5388                                           ibss.channel_type))
5389                 return -EINVAL;
5390
5391         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
5392         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5393
5394         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5395                 u8 *rates =
5396                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5397                 int n_rates =
5398                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5399                 struct ieee80211_supported_band *sband =
5400                         wiphy->bands[ibss.channel->band];
5401
5402                 err = ieee80211_get_ratemask(sband, rates, n_rates,
5403                                              &ibss.basic_rates);
5404                 if (err)
5405                         return err;
5406         }
5407
5408         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5409             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
5410                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5411                 return -EINVAL;
5412
5413         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5414                 bool no_ht = false;
5415
5416                 connkeys = nl80211_parse_connkeys(rdev,
5417                                           info->attrs[NL80211_ATTR_KEYS],
5418                                           &no_ht);
5419                 if (IS_ERR(connkeys))
5420                         return PTR_ERR(connkeys);
5421
5422                 if ((ibss.channel_type != NL80211_CHAN_NO_HT) && no_ht) {
5423                         kfree(connkeys);
5424                         return -EINVAL;
5425                 }
5426         }
5427
5428         ibss.control_port =
5429                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
5430
5431         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
5432         if (err)
5433                 kfree(connkeys);
5434         return err;
5435 }
5436
5437 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
5438 {
5439         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5440         struct net_device *dev = info->user_ptr[1];
5441
5442         if (!rdev->ops->leave_ibss)
5443                 return -EOPNOTSUPP;
5444
5445         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5446                 return -EOPNOTSUPP;
5447
5448         return cfg80211_leave_ibss(rdev, dev, false);
5449 }
5450
5451 #ifdef CONFIG_NL80211_TESTMODE
5452 static struct genl_multicast_group nl80211_testmode_mcgrp = {
5453         .name = "testmode",
5454 };
5455
5456 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
5457 {
5458         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5459         int err;
5460
5461         if (!info->attrs[NL80211_ATTR_TESTDATA])
5462                 return -EINVAL;
5463
5464         err = -EOPNOTSUPP;
5465         if (rdev->ops->testmode_cmd) {
5466                 rdev->testmode_info = info;
5467                 err = rdev_testmode_cmd(rdev,
5468                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
5469                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
5470                 rdev->testmode_info = NULL;
5471         }
5472
5473         return err;
5474 }
5475
5476 static int nl80211_testmode_dump(struct sk_buff *skb,
5477                                  struct netlink_callback *cb)
5478 {
5479         struct cfg80211_registered_device *rdev;
5480         int err;
5481         long phy_idx;
5482         void *data = NULL;
5483         int data_len = 0;
5484
5485         if (cb->args[0]) {
5486                 /*
5487                  * 0 is a valid index, but not valid for args[0],
5488                  * so we need to offset by 1.
5489                  */
5490                 phy_idx = cb->args[0] - 1;
5491         } else {
5492                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
5493                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
5494                                   nl80211_policy);
5495                 if (err)
5496                         return err;
5497
5498                 mutex_lock(&cfg80211_mutex);
5499                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
5500                                                   nl80211_fam.attrbuf);
5501                 if (IS_ERR(rdev)) {
5502                         mutex_unlock(&cfg80211_mutex);
5503                         return PTR_ERR(rdev);
5504                 }
5505                 phy_idx = rdev->wiphy_idx;
5506                 rdev = NULL;
5507                 mutex_unlock(&cfg80211_mutex);
5508
5509                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
5510                         cb->args[1] =
5511                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
5512         }
5513
5514         if (cb->args[1]) {
5515                 data = nla_data((void *)cb->args[1]);
5516                 data_len = nla_len((void *)cb->args[1]);
5517         }
5518
5519         mutex_lock(&cfg80211_mutex);
5520         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
5521         if (!rdev) {
5522                 mutex_unlock(&cfg80211_mutex);
5523                 return -ENOENT;
5524         }
5525         cfg80211_lock_rdev(rdev);
5526         mutex_unlock(&cfg80211_mutex);
5527
5528         if (!rdev->ops->testmode_dump) {
5529                 err = -EOPNOTSUPP;
5530                 goto out_err;
5531         }
5532
5533         while (1) {
5534                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
5535                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
5536                                            NL80211_CMD_TESTMODE);
5537                 struct nlattr *tmdata;
5538
5539                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
5540                         genlmsg_cancel(skb, hdr);
5541                         break;
5542                 }
5543
5544                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5545                 if (!tmdata) {
5546                         genlmsg_cancel(skb, hdr);
5547                         break;
5548                 }
5549                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
5550                 nla_nest_end(skb, tmdata);
5551
5552                 if (err == -ENOBUFS || err == -ENOENT) {
5553                         genlmsg_cancel(skb, hdr);
5554                         break;
5555                 } else if (err) {
5556                         genlmsg_cancel(skb, hdr);
5557                         goto out_err;
5558                 }
5559
5560                 genlmsg_end(skb, hdr);
5561         }
5562
5563         err = skb->len;
5564         /* see above */
5565         cb->args[0] = phy_idx + 1;
5566  out_err:
5567         cfg80211_unlock_rdev(rdev);
5568         return err;
5569 }
5570
5571 static struct sk_buff *
5572 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
5573                               int approxlen, u32 portid, u32 seq, gfp_t gfp)
5574 {
5575         struct sk_buff *skb;
5576         void *hdr;
5577         struct nlattr *data;
5578
5579         skb = nlmsg_new(approxlen + 100, gfp);
5580         if (!skb)
5581                 return NULL;
5582
5583         hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
5584         if (!hdr) {
5585                 kfree_skb(skb);
5586                 return NULL;
5587         }
5588
5589         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
5590                 goto nla_put_failure;
5591         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5592
5593         ((void **)skb->cb)[0] = rdev;
5594         ((void **)skb->cb)[1] = hdr;
5595         ((void **)skb->cb)[2] = data;
5596
5597         return skb;
5598
5599  nla_put_failure:
5600         kfree_skb(skb);
5601         return NULL;
5602 }
5603
5604 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
5605                                                   int approxlen)
5606 {
5607         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5608
5609         if (WARN_ON(!rdev->testmode_info))
5610                 return NULL;
5611
5612         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
5613                                 rdev->testmode_info->snd_portid,
5614                                 rdev->testmode_info->snd_seq,
5615                                 GFP_KERNEL);
5616 }
5617 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
5618
5619 int cfg80211_testmode_reply(struct sk_buff *skb)
5620 {
5621         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
5622         void *hdr = ((void **)skb->cb)[1];
5623         struct nlattr *data = ((void **)skb->cb)[2];
5624
5625         if (WARN_ON(!rdev->testmode_info)) {
5626                 kfree_skb(skb);
5627                 return -EINVAL;
5628         }
5629
5630         nla_nest_end(skb, data);
5631         genlmsg_end(skb, hdr);
5632         return genlmsg_reply(skb, rdev->testmode_info);
5633 }
5634 EXPORT_SYMBOL(cfg80211_testmode_reply);
5635
5636 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
5637                                                   int approxlen, gfp_t gfp)
5638 {
5639         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5640
5641         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
5642 }
5643 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
5644
5645 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
5646 {
5647         void *hdr = ((void **)skb->cb)[1];
5648         struct nlattr *data = ((void **)skb->cb)[2];
5649
5650         nla_nest_end(skb, data);
5651         genlmsg_end(skb, hdr);
5652         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
5653 }
5654 EXPORT_SYMBOL(cfg80211_testmode_event);
5655 #endif
5656
5657 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
5658 {
5659         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5660         struct net_device *dev = info->user_ptr[1];
5661         struct cfg80211_connect_params connect;
5662         struct wiphy *wiphy;
5663         struct cfg80211_cached_keys *connkeys = NULL;
5664         int err;
5665
5666         memset(&connect, 0, sizeof(connect));
5667
5668         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5669                 return -EINVAL;
5670
5671         if (!info->attrs[NL80211_ATTR_SSID] ||
5672             !nla_len(info->attrs[NL80211_ATTR_SSID]))
5673                 return -EINVAL;
5674
5675         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5676                 connect.auth_type =
5677                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5678                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
5679                                              NL80211_CMD_CONNECT))
5680                         return -EINVAL;
5681         } else
5682                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5683
5684         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
5685
5686         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
5687                                       NL80211_MAX_NR_CIPHER_SUITES);
5688         if (err)
5689                 return err;
5690
5691         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5692             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5693                 return -EOPNOTSUPP;
5694
5695         wiphy = &rdev->wiphy;
5696
5697         connect.bg_scan_period = -1;
5698         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
5699                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
5700                 connect.bg_scan_period =
5701                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
5702         }
5703
5704         if (info->attrs[NL80211_ATTR_MAC])
5705                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5706         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5707         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5708
5709         if (info->attrs[NL80211_ATTR_IE]) {
5710                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5711                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5712         }
5713
5714         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5715                 connect.channel =
5716                         ieee80211_get_channel(wiphy,
5717                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5718                 if (!connect.channel ||
5719                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
5720                         return -EINVAL;
5721         }
5722
5723         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5724                 connkeys = nl80211_parse_connkeys(rdev,
5725                                           info->attrs[NL80211_ATTR_KEYS], NULL);
5726                 if (IS_ERR(connkeys))
5727                         return PTR_ERR(connkeys);
5728         }
5729
5730         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5731                 connect.flags |= ASSOC_REQ_DISABLE_HT;
5732
5733         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5734                 memcpy(&connect.ht_capa_mask,
5735                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
5736                        sizeof(connect.ht_capa_mask));
5737
5738         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5739                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
5740                         kfree(connkeys);
5741                         return -EINVAL;
5742                 }
5743                 memcpy(&connect.ht_capa,
5744                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
5745                        sizeof(connect.ht_capa));
5746         }
5747
5748         err = cfg80211_connect(rdev, dev, &connect, connkeys);
5749         if (err)
5750                 kfree(connkeys);
5751         return err;
5752 }
5753
5754 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
5755 {
5756         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5757         struct net_device *dev = info->user_ptr[1];
5758         u16 reason;
5759
5760         if (!info->attrs[NL80211_ATTR_REASON_CODE])
5761                 reason = WLAN_REASON_DEAUTH_LEAVING;
5762         else
5763                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5764
5765         if (reason == 0)
5766                 return -EINVAL;
5767
5768         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5769             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5770                 return -EOPNOTSUPP;
5771
5772         return cfg80211_disconnect(rdev, dev, reason, true);
5773 }
5774
5775 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
5776 {
5777         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5778         struct net *net;
5779         int err;
5780         u32 pid;
5781
5782         if (!info->attrs[NL80211_ATTR_PID])
5783                 return -EINVAL;
5784
5785         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
5786
5787         net = get_net_ns_by_pid(pid);
5788         if (IS_ERR(net))
5789                 return PTR_ERR(net);
5790
5791         err = 0;
5792
5793         /* check if anything to do */
5794         if (!net_eq(wiphy_net(&rdev->wiphy), net))
5795                 err = cfg80211_switch_netns(rdev, net);
5796
5797         put_net(net);
5798         return err;
5799 }
5800
5801 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
5802 {
5803         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5804         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
5805                         struct cfg80211_pmksa *pmksa) = NULL;
5806         struct net_device *dev = info->user_ptr[1];
5807         struct cfg80211_pmksa pmksa;
5808
5809         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
5810
5811         if (!info->attrs[NL80211_ATTR_MAC])
5812                 return -EINVAL;
5813
5814         if (!info->attrs[NL80211_ATTR_PMKID])
5815                 return -EINVAL;
5816
5817         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
5818         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5819
5820         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5821             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5822                 return -EOPNOTSUPP;
5823
5824         switch (info->genlhdr->cmd) {
5825         case NL80211_CMD_SET_PMKSA:
5826                 rdev_ops = rdev->ops->set_pmksa;
5827                 break;
5828         case NL80211_CMD_DEL_PMKSA:
5829                 rdev_ops = rdev->ops->del_pmksa;
5830                 break;
5831         default:
5832                 WARN_ON(1);
5833                 break;
5834         }
5835
5836         if (!rdev_ops)
5837                 return -EOPNOTSUPP;
5838
5839         return rdev_ops(&rdev->wiphy, dev, &pmksa);
5840 }
5841
5842 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
5843 {
5844         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5845         struct net_device *dev = info->user_ptr[1];
5846
5847         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5848             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5849                 return -EOPNOTSUPP;
5850
5851         if (!rdev->ops->flush_pmksa)
5852                 return -EOPNOTSUPP;
5853
5854         return rdev_flush_pmksa(rdev, dev);
5855 }
5856
5857 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
5858 {
5859         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5860         struct net_device *dev = info->user_ptr[1];
5861         u8 action_code, dialog_token;
5862         u16 status_code;
5863         u8 *peer;
5864
5865         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5866             !rdev->ops->tdls_mgmt)
5867                 return -EOPNOTSUPP;
5868
5869         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
5870             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
5871             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
5872             !info->attrs[NL80211_ATTR_IE] ||
5873             !info->attrs[NL80211_ATTR_MAC])
5874                 return -EINVAL;
5875
5876         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5877         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
5878         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
5879         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
5880
5881         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
5882                               dialog_token, status_code,
5883                               nla_data(info->attrs[NL80211_ATTR_IE]),
5884                               nla_len(info->attrs[NL80211_ATTR_IE]));
5885 }
5886
5887 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
5888 {
5889         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5890         struct net_device *dev = info->user_ptr[1];
5891         enum nl80211_tdls_operation operation;
5892         u8 *peer;
5893
5894         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5895             !rdev->ops->tdls_oper)
5896                 return -EOPNOTSUPP;
5897
5898         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
5899             !info->attrs[NL80211_ATTR_MAC])
5900                 return -EINVAL;
5901
5902         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
5903         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5904
5905         return rdev_tdls_oper(rdev, dev, peer, operation);
5906 }
5907
5908 static int nl80211_remain_on_channel(struct sk_buff *skb,
5909                                      struct genl_info *info)
5910 {
5911         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5912         struct wireless_dev *wdev = info->user_ptr[1];
5913         struct ieee80211_channel *chan;
5914         struct sk_buff *msg;
5915         void *hdr;
5916         u64 cookie;
5917         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5918         u32 freq, duration;
5919         int err;
5920
5921         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5922             !info->attrs[NL80211_ATTR_DURATION])
5923                 return -EINVAL;
5924
5925         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5926
5927         if (!rdev->ops->remain_on_channel ||
5928             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
5929                 return -EOPNOTSUPP;
5930
5931         /*
5932          * We should be on that channel for at least a minimum amount of
5933          * time (10ms) but no longer than the driver supports.
5934          */
5935         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
5936             duration > rdev->wiphy.max_remain_on_channel_duration)
5937                 return -EINVAL;
5938
5939         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
5940             !nl80211_valid_channel_type(info, &channel_type))
5941                 return -EINVAL;
5942
5943         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5944         chan = rdev_freq_to_chan(rdev, freq, channel_type);
5945         if (chan == NULL)
5946                 return -EINVAL;
5947
5948         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5949         if (!msg)
5950                 return -ENOMEM;
5951
5952         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5953                              NL80211_CMD_REMAIN_ON_CHANNEL);
5954
5955         if (IS_ERR(hdr)) {
5956                 err = PTR_ERR(hdr);
5957                 goto free_msg;
5958         }
5959
5960         err = rdev_remain_on_channel(rdev, wdev, chan, channel_type, duration,
5961                                      &cookie);
5962
5963         if (err)
5964                 goto free_msg;
5965
5966         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
5967                 goto nla_put_failure;
5968
5969         genlmsg_end(msg, hdr);
5970
5971         return genlmsg_reply(msg, info);
5972
5973  nla_put_failure:
5974         err = -ENOBUFS;
5975  free_msg:
5976         nlmsg_free(msg);
5977         return err;
5978 }
5979
5980 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
5981                                             struct genl_info *info)
5982 {
5983         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5984         struct wireless_dev *wdev = info->user_ptr[1];
5985         u64 cookie;
5986
5987         if (!info->attrs[NL80211_ATTR_COOKIE])
5988                 return -EINVAL;
5989
5990         if (!rdev->ops->cancel_remain_on_channel)
5991                 return -EOPNOTSUPP;
5992
5993         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5994
5995         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
5996 }
5997
5998 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5999                            u8 *rates, u8 rates_len)
6000 {
6001         u8 i;
6002         u32 mask = 0;
6003
6004         for (i = 0; i < rates_len; i++) {
6005                 int rate = (rates[i] & 0x7f) * 5;
6006                 int ridx;
6007                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
6008                         struct ieee80211_rate *srate =
6009                                 &sband->bitrates[ridx];
6010                         if (rate == srate->bitrate) {
6011                                 mask |= 1 << ridx;
6012                                 break;
6013                         }
6014                 }
6015                 if (ridx == sband->n_bitrates)
6016                         return 0; /* rate not found */
6017         }
6018
6019         return mask;
6020 }
6021
6022 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
6023                                u8 *rates, u8 rates_len,
6024                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
6025 {
6026         u8 i;
6027
6028         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
6029
6030         for (i = 0; i < rates_len; i++) {
6031                 int ridx, rbit;
6032
6033                 ridx = rates[i] / 8;
6034                 rbit = BIT(rates[i] % 8);
6035
6036                 /* check validity */
6037                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
6038                         return false;
6039
6040                 /* check availability */
6041                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
6042                         mcs[ridx] |= rbit;
6043                 else
6044                         return false;
6045         }
6046
6047         return true;
6048 }
6049
6050 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
6051         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
6052                                     .len = NL80211_MAX_SUPP_RATES },
6053         [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
6054                                  .len = NL80211_MAX_SUPP_HT_RATES },
6055 };
6056
6057 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
6058                                        struct genl_info *info)
6059 {
6060         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
6061         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6062         struct cfg80211_bitrate_mask mask;
6063         int rem, i;
6064         struct net_device *dev = info->user_ptr[1];
6065         struct nlattr *tx_rates;
6066         struct ieee80211_supported_band *sband;
6067
6068         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
6069                 return -EINVAL;
6070
6071         if (!rdev->ops->set_bitrate_mask)
6072                 return -EOPNOTSUPP;
6073
6074         memset(&mask, 0, sizeof(mask));
6075         /* Default to all rates enabled */
6076         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
6077                 sband = rdev->wiphy.bands[i];
6078                 mask.control[i].legacy =
6079                         sband ? (1 << sband->n_bitrates) - 1 : 0;
6080                 if (sband)
6081                         memcpy(mask.control[i].mcs,
6082                                sband->ht_cap.mcs.rx_mask,
6083                                sizeof(mask.control[i].mcs));
6084                 else
6085                         memset(mask.control[i].mcs, 0,
6086                                sizeof(mask.control[i].mcs));
6087         }
6088
6089         /*
6090          * The nested attribute uses enum nl80211_band as the index. This maps
6091          * directly to the enum ieee80211_band values used in cfg80211.
6092          */
6093         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
6094         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
6095         {
6096                 enum ieee80211_band band = nla_type(tx_rates);
6097                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
6098                         return -EINVAL;
6099                 sband = rdev->wiphy.bands[band];
6100                 if (sband == NULL)
6101                         return -EINVAL;
6102                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
6103                           nla_len(tx_rates), nl80211_txattr_policy);
6104                 if (tb[NL80211_TXRATE_LEGACY]) {
6105                         mask.control[band].legacy = rateset_to_mask(
6106                                 sband,
6107                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
6108                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
6109                         if ((mask.control[band].legacy == 0) &&
6110                             nla_len(tb[NL80211_TXRATE_LEGACY]))
6111                                 return -EINVAL;
6112                 }
6113                 if (tb[NL80211_TXRATE_MCS]) {
6114                         if (!ht_rateset_to_mask(
6115                                         sband,
6116                                         nla_data(tb[NL80211_TXRATE_MCS]),
6117                                         nla_len(tb[NL80211_TXRATE_MCS]),
6118                                         mask.control[band].mcs))
6119                                 return -EINVAL;
6120                 }
6121
6122                 if (mask.control[band].legacy == 0) {
6123                         /* don't allow empty legacy rates if HT
6124                          * is not even supported. */
6125                         if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
6126                                 return -EINVAL;
6127
6128                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
6129                                 if (mask.control[band].mcs[i])
6130                                         break;
6131
6132                         /* legacy and mcs rates may not be both empty */
6133                         if (i == IEEE80211_HT_MCS_MASK_LEN)
6134                                 return -EINVAL;
6135                 }
6136         }
6137
6138         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
6139 }
6140
6141 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
6142 {
6143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6144         struct wireless_dev *wdev = info->user_ptr[1];
6145         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
6146
6147         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
6148                 return -EINVAL;
6149
6150         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
6151                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
6152
6153         switch (wdev->iftype) {
6154         case NL80211_IFTYPE_STATION:
6155         case NL80211_IFTYPE_ADHOC:
6156         case NL80211_IFTYPE_P2P_CLIENT:
6157         case NL80211_IFTYPE_AP:
6158         case NL80211_IFTYPE_AP_VLAN:
6159         case NL80211_IFTYPE_MESH_POINT:
6160         case NL80211_IFTYPE_P2P_GO:
6161         case NL80211_IFTYPE_P2P_DEVICE:
6162                 break;
6163         default:
6164                 return -EOPNOTSUPP;
6165         }
6166
6167         /* not much point in registering if we can't reply */
6168         if (!rdev->ops->mgmt_tx)
6169                 return -EOPNOTSUPP;
6170
6171         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
6172                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
6173                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
6174 }
6175
6176 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
6177 {
6178         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6179         struct wireless_dev *wdev = info->user_ptr[1];
6180         struct ieee80211_channel *chan;
6181         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
6182         bool channel_type_valid = false;
6183         u32 freq;
6184         int err;
6185         void *hdr = NULL;
6186         u64 cookie;
6187         struct sk_buff *msg = NULL;
6188         unsigned int wait = 0;
6189         bool offchan, no_cck, dont_wait_for_ack;
6190
6191         dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
6192
6193         if (!info->attrs[NL80211_ATTR_FRAME] ||
6194             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6195                 return -EINVAL;
6196
6197         if (!rdev->ops->mgmt_tx)
6198                 return -EOPNOTSUPP;
6199
6200         switch (wdev->iftype) {
6201         case NL80211_IFTYPE_STATION:
6202         case NL80211_IFTYPE_ADHOC:
6203         case NL80211_IFTYPE_P2P_CLIENT:
6204         case NL80211_IFTYPE_AP:
6205         case NL80211_IFTYPE_AP_VLAN:
6206         case NL80211_IFTYPE_MESH_POINT:
6207         case NL80211_IFTYPE_P2P_GO:
6208         case NL80211_IFTYPE_P2P_DEVICE:
6209                 break;
6210         default:
6211                 return -EOPNOTSUPP;
6212         }
6213
6214         if (info->attrs[NL80211_ATTR_DURATION]) {
6215                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6216                         return -EINVAL;
6217                 wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6218
6219                 /*
6220                  * We should wait on the channel for at least a minimum amount
6221                  * of time (10ms) but no longer than the driver supports.
6222                  */
6223                 if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6224                     wait > rdev->wiphy.max_remain_on_channel_duration)
6225                         return -EINVAL;
6226
6227         }
6228
6229         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
6230                 if (!nl80211_valid_channel_type(info, &channel_type))
6231                         return -EINVAL;
6232                 channel_type_valid = true;
6233         }
6234
6235         offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
6236
6237         if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6238                 return -EINVAL;
6239
6240         no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6241
6242         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6243         chan = rdev_freq_to_chan(rdev, freq, channel_type);
6244         if (chan == NULL)
6245                 return -EINVAL;
6246
6247         if (!dont_wait_for_ack) {
6248                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6249                 if (!msg)
6250                         return -ENOMEM;
6251
6252                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6253                                      NL80211_CMD_FRAME);
6254
6255                 if (IS_ERR(hdr)) {
6256                         err = PTR_ERR(hdr);
6257                         goto free_msg;
6258                 }
6259         }
6260
6261         err = cfg80211_mlme_mgmt_tx(rdev, wdev, chan, offchan, channel_type,
6262                                     channel_type_valid, wait,
6263                                     nla_data(info->attrs[NL80211_ATTR_FRAME]),
6264                                     nla_len(info->attrs[NL80211_ATTR_FRAME]),
6265                                     no_cck, dont_wait_for_ack, &cookie);
6266         if (err)
6267                 goto free_msg;
6268
6269         if (msg) {
6270                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6271                         goto nla_put_failure;
6272
6273                 genlmsg_end(msg, hdr);
6274                 return genlmsg_reply(msg, info);
6275         }
6276
6277         return 0;
6278
6279  nla_put_failure:
6280         err = -ENOBUFS;
6281  free_msg:
6282         nlmsg_free(msg);
6283         return err;
6284 }
6285
6286 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
6287 {
6288         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6289         struct wireless_dev *wdev = info->user_ptr[1];
6290         u64 cookie;
6291
6292         if (!info->attrs[NL80211_ATTR_COOKIE])
6293                 return -EINVAL;
6294
6295         if (!rdev->ops->mgmt_tx_cancel_wait)
6296                 return -EOPNOTSUPP;
6297
6298         switch (wdev->iftype) {
6299         case NL80211_IFTYPE_STATION:
6300         case NL80211_IFTYPE_ADHOC:
6301         case NL80211_IFTYPE_P2P_CLIENT:
6302         case NL80211_IFTYPE_AP:
6303         case NL80211_IFTYPE_AP_VLAN:
6304         case NL80211_IFTYPE_P2P_GO:
6305         case NL80211_IFTYPE_P2P_DEVICE:
6306                 break;
6307         default:
6308                 return -EOPNOTSUPP;
6309         }
6310
6311         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6312
6313         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
6314 }
6315
6316 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
6317 {
6318         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6319         struct wireless_dev *wdev;
6320         struct net_device *dev = info->user_ptr[1];
6321         u8 ps_state;
6322         bool state;
6323         int err;
6324
6325         if (!info->attrs[NL80211_ATTR_PS_STATE])
6326                 return -EINVAL;
6327
6328         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
6329
6330         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
6331                 return -EINVAL;
6332
6333         wdev = dev->ieee80211_ptr;
6334
6335         if (!rdev->ops->set_power_mgmt)
6336                 return -EOPNOTSUPP;
6337
6338         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
6339
6340         if (state == wdev->ps)
6341                 return 0;
6342
6343         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
6344         if (!err)
6345                 wdev->ps = state;
6346         return err;
6347 }
6348
6349 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
6350 {
6351         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6352         enum nl80211_ps_state ps_state;
6353         struct wireless_dev *wdev;
6354         struct net_device *dev = info->user_ptr[1];
6355         struct sk_buff *msg;
6356         void *hdr;
6357         int err;
6358
6359         wdev = dev->ieee80211_ptr;
6360
6361         if (!rdev->ops->set_power_mgmt)
6362                 return -EOPNOTSUPP;
6363
6364         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6365         if (!msg)
6366                 return -ENOMEM;
6367
6368         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6369                              NL80211_CMD_GET_POWER_SAVE);
6370         if (!hdr) {
6371                 err = -ENOBUFS;
6372                 goto free_msg;
6373         }
6374
6375         if (wdev->ps)
6376                 ps_state = NL80211_PS_ENABLED;
6377         else
6378                 ps_state = NL80211_PS_DISABLED;
6379
6380         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
6381                 goto nla_put_failure;
6382
6383         genlmsg_end(msg, hdr);
6384         return genlmsg_reply(msg, info);
6385
6386  nla_put_failure:
6387         err = -ENOBUFS;
6388  free_msg:
6389         nlmsg_free(msg);
6390         return err;
6391 }
6392
6393 static struct nla_policy
6394 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
6395         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
6396         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
6397         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
6398         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
6399         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
6400         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
6401 };
6402
6403 static int nl80211_set_cqm_txe(struct genl_info *info,
6404                                 u32 rate, u32 pkts, u32 intvl)
6405 {
6406         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6407         struct wireless_dev *wdev;
6408         struct net_device *dev = info->user_ptr[1];
6409
6410         if ((rate < 0 || rate > 100) ||
6411             (intvl < 0 || intvl > NL80211_CQM_TXE_MAX_INTVL))
6412                 return -EINVAL;
6413
6414         wdev = dev->ieee80211_ptr;
6415
6416         if (!rdev->ops->set_cqm_txe_config)
6417                 return -EOPNOTSUPP;
6418
6419         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6420             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6421                 return -EOPNOTSUPP;
6422
6423         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
6424 }
6425
6426 static int nl80211_set_cqm_rssi(struct genl_info *info,
6427                                 s32 threshold, u32 hysteresis)
6428 {
6429         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6430         struct wireless_dev *wdev;
6431         struct net_device *dev = info->user_ptr[1];
6432
6433         if (threshold > 0)
6434                 return -EINVAL;
6435
6436         wdev = dev->ieee80211_ptr;
6437
6438         if (!rdev->ops->set_cqm_rssi_config)
6439                 return -EOPNOTSUPP;
6440
6441         if (wdev->iftype != NL80211_IFTYPE_STATION &&
6442             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6443                 return -EOPNOTSUPP;
6444
6445         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
6446 }
6447
6448 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
6449 {
6450         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
6451         struct nlattr *cqm;
6452         int err;
6453
6454         cqm = info->attrs[NL80211_ATTR_CQM];
6455         if (!cqm) {
6456                 err = -EINVAL;
6457                 goto out;
6458         }
6459
6460         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
6461                                nl80211_attr_cqm_policy);
6462         if (err)
6463                 goto out;
6464
6465         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
6466             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
6467                 s32 threshold;
6468                 u32 hysteresis;
6469                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
6470                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
6471                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
6472         } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
6473                    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
6474                    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
6475                 u32 rate, pkts, intvl;
6476                 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
6477                 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
6478                 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
6479                 err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
6480         } else
6481                 err = -EINVAL;
6482
6483 out:
6484         return err;
6485 }
6486
6487 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
6488 {
6489         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6490         struct net_device *dev = info->user_ptr[1];
6491         struct mesh_config cfg;
6492         struct mesh_setup setup;
6493         int err;
6494
6495         /* start with default */
6496         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
6497         memcpy(&setup, &default_mesh_setup, sizeof(setup));
6498
6499         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
6500                 /* and parse parameters if given */
6501                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
6502                 if (err)
6503                         return err;
6504         }
6505
6506         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
6507             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
6508                 return -EINVAL;
6509
6510         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
6511         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
6512
6513         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6514             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
6515                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6516                         return -EINVAL;
6517
6518         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
6519                 /* parse additional setup parameters if given */
6520                 err = nl80211_parse_mesh_setup(info, &setup);
6521                 if (err)
6522                         return err;
6523         }
6524
6525         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6526                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
6527
6528                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
6529                     !nl80211_valid_channel_type(info, &channel_type))
6530                         return -EINVAL;
6531
6532                 setup.channel = rdev_freq_to_chan(rdev,
6533                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
6534                         channel_type);
6535                 if (!setup.channel)
6536                         return -EINVAL;
6537                 setup.channel_type = channel_type;
6538         } else {
6539                 /* cfg80211_join_mesh() will sort it out */
6540                 setup.channel = NULL;
6541         }
6542
6543         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
6544 }
6545
6546 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
6547 {
6548         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6549         struct net_device *dev = info->user_ptr[1];
6550
6551         return cfg80211_leave_mesh(rdev, dev);
6552 }
6553
6554 #ifdef CONFIG_PM
6555 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
6556 {
6557         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6558         struct sk_buff *msg;
6559         void *hdr;
6560
6561         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6562                 return -EOPNOTSUPP;
6563
6564         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6565         if (!msg)
6566                 return -ENOMEM;
6567
6568         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6569                              NL80211_CMD_GET_WOWLAN);
6570         if (!hdr)
6571                 goto nla_put_failure;
6572
6573         if (rdev->wowlan) {
6574                 struct nlattr *nl_wowlan;
6575
6576                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
6577                 if (!nl_wowlan)
6578                         goto nla_put_failure;
6579
6580                 if ((rdev->wowlan->any &&
6581                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
6582                     (rdev->wowlan->disconnect &&
6583                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
6584                     (rdev->wowlan->magic_pkt &&
6585                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
6586                     (rdev->wowlan->gtk_rekey_failure &&
6587                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
6588                     (rdev->wowlan->eap_identity_req &&
6589                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
6590                     (rdev->wowlan->four_way_handshake &&
6591                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
6592                     (rdev->wowlan->rfkill_release &&
6593                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
6594                         goto nla_put_failure;
6595                 if (rdev->wowlan->n_patterns) {
6596                         struct nlattr *nl_pats, *nl_pat;
6597                         int i, pat_len;
6598
6599                         nl_pats = nla_nest_start(msg,
6600                                         NL80211_WOWLAN_TRIG_PKT_PATTERN);
6601                         if (!nl_pats)
6602                                 goto nla_put_failure;
6603
6604                         for (i = 0; i < rdev->wowlan->n_patterns; i++) {
6605                                 nl_pat = nla_nest_start(msg, i + 1);
6606                                 if (!nl_pat)
6607                                         goto nla_put_failure;
6608                                 pat_len = rdev->wowlan->patterns[i].pattern_len;
6609                                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
6610                                             DIV_ROUND_UP(pat_len, 8),
6611                                             rdev->wowlan->patterns[i].mask) ||
6612                                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
6613                                             pat_len,
6614                                             rdev->wowlan->patterns[i].pattern))
6615                                         goto nla_put_failure;
6616                                 nla_nest_end(msg, nl_pat);
6617                         }
6618                         nla_nest_end(msg, nl_pats);
6619                 }
6620
6621                 nla_nest_end(msg, nl_wowlan);
6622         }
6623
6624         genlmsg_end(msg, hdr);
6625         return genlmsg_reply(msg, info);
6626
6627 nla_put_failure:
6628         nlmsg_free(msg);
6629         return -ENOBUFS;
6630 }
6631
6632 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
6633 {
6634         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6635         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
6636         struct cfg80211_wowlan new_triggers = {};
6637         struct cfg80211_wowlan *ntrig;
6638         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
6639         int err, i;
6640         bool prev_enabled = rdev->wowlan;
6641
6642         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6643                 return -EOPNOTSUPP;
6644
6645         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
6646                 cfg80211_rdev_free_wowlan(rdev);
6647                 rdev->wowlan = NULL;
6648                 goto set_wakeup;
6649         }
6650
6651         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
6652                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6653                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6654                         nl80211_wowlan_policy);
6655         if (err)
6656                 return err;
6657
6658         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
6659                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
6660                         return -EINVAL;
6661                 new_triggers.any = true;
6662         }
6663
6664         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
6665                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
6666                         return -EINVAL;
6667                 new_triggers.disconnect = true;
6668         }
6669
6670         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
6671                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
6672                         return -EINVAL;
6673                 new_triggers.magic_pkt = true;
6674         }
6675
6676         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
6677                 return -EINVAL;
6678
6679         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
6680                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
6681                         return -EINVAL;
6682                 new_triggers.gtk_rekey_failure = true;
6683         }
6684
6685         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
6686                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
6687                         return -EINVAL;
6688                 new_triggers.eap_identity_req = true;
6689         }
6690
6691         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
6692                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
6693                         return -EINVAL;
6694                 new_triggers.four_way_handshake = true;
6695         }
6696
6697         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
6698                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
6699                         return -EINVAL;
6700                 new_triggers.rfkill_release = true;
6701         }
6702
6703         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
6704                 struct nlattr *pat;
6705                 int n_patterns = 0;
6706                 int rem, pat_len, mask_len;
6707                 struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
6708
6709                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6710                                     rem)
6711                         n_patterns++;
6712                 if (n_patterns > wowlan->n_patterns)
6713                         return -EINVAL;
6714
6715                 new_triggers.patterns = kcalloc(n_patterns,
6716                                                 sizeof(new_triggers.patterns[0]),
6717                                                 GFP_KERNEL);
6718                 if (!new_triggers.patterns)
6719                         return -ENOMEM;
6720
6721                 new_triggers.n_patterns = n_patterns;
6722                 i = 0;
6723
6724                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6725                                     rem) {
6726                         nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
6727                                   nla_data(pat), nla_len(pat), NULL);
6728                         err = -EINVAL;
6729                         if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
6730                             !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
6731                                 goto error;
6732                         pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
6733                         mask_len = DIV_ROUND_UP(pat_len, 8);
6734                         if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
6735                             mask_len)
6736                                 goto error;
6737                         if (pat_len > wowlan->pattern_max_len ||
6738                             pat_len < wowlan->pattern_min_len)
6739                                 goto error;
6740
6741                         new_triggers.patterns[i].mask =
6742                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
6743                         if (!new_triggers.patterns[i].mask) {
6744                                 err = -ENOMEM;
6745                                 goto error;
6746                         }
6747                         new_triggers.patterns[i].pattern =
6748                                 new_triggers.patterns[i].mask + mask_len;
6749                         memcpy(new_triggers.patterns[i].mask,
6750                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
6751                                mask_len);
6752                         new_triggers.patterns[i].pattern_len = pat_len;
6753                         memcpy(new_triggers.patterns[i].pattern,
6754                                nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
6755                                pat_len);
6756                         i++;
6757                 }
6758         }
6759
6760         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
6761         if (!ntrig) {
6762                 err = -ENOMEM;
6763                 goto error;
6764         }
6765         cfg80211_rdev_free_wowlan(rdev);
6766         rdev->wowlan = ntrig;
6767
6768  set_wakeup:
6769         if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
6770                 rdev_set_wakeup(rdev, rdev->wowlan);
6771
6772         return 0;
6773  error:
6774         for (i = 0; i < new_triggers.n_patterns; i++)
6775                 kfree(new_triggers.patterns[i].mask);
6776         kfree(new_triggers.patterns);
6777         return err;
6778 }
6779 #endif
6780
6781 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
6782 {
6783         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6784         struct net_device *dev = info->user_ptr[1];
6785         struct wireless_dev *wdev = dev->ieee80211_ptr;
6786         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
6787         struct cfg80211_gtk_rekey_data rekey_data;
6788         int err;
6789
6790         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
6791                 return -EINVAL;
6792
6793         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
6794                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
6795                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
6796                         nl80211_rekey_policy);
6797         if (err)
6798                 return err;
6799
6800         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
6801                 return -ERANGE;
6802         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
6803                 return -ERANGE;
6804         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
6805                 return -ERANGE;
6806
6807         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
6808                NL80211_KEK_LEN);
6809         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
6810                NL80211_KCK_LEN);
6811         memcpy(rekey_data.replay_ctr,
6812                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
6813                NL80211_REPLAY_CTR_LEN);
6814
6815         wdev_lock(wdev);
6816         if (!wdev->current_bss) {
6817                 err = -ENOTCONN;
6818                 goto out;
6819         }
6820
6821         if (!rdev->ops->set_rekey_data) {
6822                 err = -EOPNOTSUPP;
6823                 goto out;
6824         }
6825
6826         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
6827  out:
6828         wdev_unlock(wdev);
6829         return err;
6830 }
6831
6832 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
6833                                              struct genl_info *info)
6834 {
6835         struct net_device *dev = info->user_ptr[1];
6836         struct wireless_dev *wdev = dev->ieee80211_ptr;
6837
6838         if (wdev->iftype != NL80211_IFTYPE_AP &&
6839             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6840                 return -EINVAL;
6841
6842         if (wdev->ap_unexpected_nlportid)
6843                 return -EBUSY;
6844
6845         wdev->ap_unexpected_nlportid = info->snd_portid;
6846         return 0;
6847 }
6848
6849 static int nl80211_probe_client(struct sk_buff *skb,
6850                                 struct genl_info *info)
6851 {
6852         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6853         struct net_device *dev = info->user_ptr[1];
6854         struct wireless_dev *wdev = dev->ieee80211_ptr;
6855         struct sk_buff *msg;
6856         void *hdr;
6857         const u8 *addr;
6858         u64 cookie;
6859         int err;
6860
6861         if (wdev->iftype != NL80211_IFTYPE_AP &&
6862             wdev->iftype != NL80211_IFTYPE_P2P_GO)
6863                 return -EOPNOTSUPP;
6864
6865         if (!info->attrs[NL80211_ATTR_MAC])
6866                 return -EINVAL;
6867
6868         if (!rdev->ops->probe_client)
6869                 return -EOPNOTSUPP;
6870
6871         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6872         if (!msg)
6873                 return -ENOMEM;
6874
6875         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6876                              NL80211_CMD_PROBE_CLIENT);
6877
6878         if (IS_ERR(hdr)) {
6879                 err = PTR_ERR(hdr);
6880                 goto free_msg;
6881         }
6882
6883         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6884
6885         err = rdev_probe_client(rdev, dev, addr, &cookie);
6886         if (err)
6887                 goto free_msg;
6888
6889         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6890                 goto nla_put_failure;
6891
6892         genlmsg_end(msg, hdr);
6893
6894         return genlmsg_reply(msg, info);
6895
6896  nla_put_failure:
6897         err = -ENOBUFS;
6898  free_msg:
6899         nlmsg_free(msg);
6900         return err;
6901 }
6902
6903 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
6904 {
6905         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6906
6907         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
6908                 return -EOPNOTSUPP;
6909
6910         if (rdev->ap_beacons_nlportid)
6911                 return -EBUSY;
6912
6913         rdev->ap_beacons_nlportid = info->snd_portid;
6914
6915         return 0;
6916 }
6917
6918 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
6919 {
6920         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6921         struct wireless_dev *wdev = info->user_ptr[1];
6922         int err;
6923
6924         if (!rdev->ops->start_p2p_device)
6925                 return -EOPNOTSUPP;
6926
6927         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
6928                 return -EOPNOTSUPP;
6929
6930         if (wdev->p2p_started)
6931                 return 0;
6932
6933         mutex_lock(&rdev->devlist_mtx);
6934         err = cfg80211_can_add_interface(rdev, wdev->iftype);
6935         mutex_unlock(&rdev->devlist_mtx);
6936         if (err)
6937                 return err;
6938
6939         err = rdev_start_p2p_device(rdev, wdev);
6940         if (err)
6941                 return err;
6942
6943         wdev->p2p_started = true;
6944         mutex_lock(&rdev->devlist_mtx);
6945         rdev->opencount++;
6946         mutex_unlock(&rdev->devlist_mtx);
6947
6948         return 0;
6949 }
6950
6951 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
6952 {
6953         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6954         struct wireless_dev *wdev = info->user_ptr[1];
6955
6956         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
6957                 return -EOPNOTSUPP;
6958
6959         if (!rdev->ops->stop_p2p_device)
6960                 return -EOPNOTSUPP;
6961
6962         if (!wdev->p2p_started)
6963                 return 0;
6964
6965         rdev_stop_p2p_device(rdev, wdev);
6966         wdev->p2p_started = false;
6967
6968         mutex_lock(&rdev->devlist_mtx);
6969         rdev->opencount--;
6970         mutex_unlock(&rdev->devlist_mtx);
6971
6972         if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
6973                 rdev->scan_req->aborted = true;
6974                 ___cfg80211_scan_done(rdev, true);
6975         }
6976
6977         return 0;
6978 }
6979
6980 #define NL80211_FLAG_NEED_WIPHY         0x01
6981 #define NL80211_FLAG_NEED_NETDEV        0x02
6982 #define NL80211_FLAG_NEED_RTNL          0x04
6983 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
6984 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
6985                                          NL80211_FLAG_CHECK_NETDEV_UP)
6986 #define NL80211_FLAG_NEED_WDEV          0x10
6987 /* If a netdev is associated, it must be UP, P2P must be started */
6988 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
6989                                          NL80211_FLAG_CHECK_NETDEV_UP)
6990
6991 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
6992                             struct genl_info *info)
6993 {
6994         struct cfg80211_registered_device *rdev;
6995         struct wireless_dev *wdev;
6996         struct net_device *dev;
6997         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
6998
6999         if (rtnl)
7000                 rtnl_lock();
7001
7002         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
7003                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7004                 if (IS_ERR(rdev)) {
7005                         if (rtnl)
7006                                 rtnl_unlock();
7007                         return PTR_ERR(rdev);
7008                 }
7009                 info->user_ptr[0] = rdev;
7010         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
7011                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7012                 mutex_lock(&cfg80211_mutex);
7013                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
7014                                                   info->attrs);
7015                 if (IS_ERR(wdev)) {
7016                         mutex_unlock(&cfg80211_mutex);
7017                         if (rtnl)
7018                                 rtnl_unlock();
7019                         return PTR_ERR(wdev);
7020                 }
7021
7022                 dev = wdev->netdev;
7023                 rdev = wiphy_to_dev(wdev->wiphy);
7024
7025                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
7026                         if (!dev) {
7027                                 mutex_unlock(&cfg80211_mutex);
7028                                 if (rtnl)
7029                                         rtnl_unlock();
7030                                 return -EINVAL;
7031                         }
7032
7033                         info->user_ptr[1] = dev;
7034                 } else {
7035                         info->user_ptr[1] = wdev;
7036                 }
7037
7038                 if (dev) {
7039                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
7040                             !netif_running(dev)) {
7041                                 mutex_unlock(&cfg80211_mutex);
7042                                 if (rtnl)
7043                                         rtnl_unlock();
7044                                 return -ENETDOWN;
7045                         }
7046
7047                         dev_hold(dev);
7048                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
7049                         if (!wdev->p2p_started) {
7050                                 mutex_unlock(&cfg80211_mutex);
7051                                 if (rtnl)
7052                                         rtnl_unlock();
7053                                 return -ENETDOWN;
7054                         }
7055                 }
7056
7057                 cfg80211_lock_rdev(rdev);
7058
7059                 mutex_unlock(&cfg80211_mutex);
7060
7061                 info->user_ptr[0] = rdev;
7062         }
7063
7064         return 0;
7065 }
7066
7067 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
7068                               struct genl_info *info)
7069 {
7070         if (info->user_ptr[0])
7071                 cfg80211_unlock_rdev(info->user_ptr[0]);
7072         if (info->user_ptr[1]) {
7073                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
7074                         struct wireless_dev *wdev = info->user_ptr[1];
7075
7076                         if (wdev->netdev)
7077                                 dev_put(wdev->netdev);
7078                 } else {
7079                         dev_put(info->user_ptr[1]);
7080                 }
7081         }
7082         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
7083                 rtnl_unlock();
7084 }
7085
7086 static struct genl_ops nl80211_ops[] = {
7087         {
7088                 .cmd = NL80211_CMD_GET_WIPHY,
7089                 .doit = nl80211_get_wiphy,
7090                 .dumpit = nl80211_dump_wiphy,
7091                 .policy = nl80211_policy,
7092                 /* can be retrieved by unprivileged users */
7093                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
7094         },
7095         {
7096                 .cmd = NL80211_CMD_SET_WIPHY,
7097                 .doit = nl80211_set_wiphy,
7098                 .policy = nl80211_policy,
7099                 .flags = GENL_ADMIN_PERM,
7100                 .internal_flags = NL80211_FLAG_NEED_RTNL,
7101         },
7102         {
7103                 .cmd = NL80211_CMD_GET_INTERFACE,
7104                 .doit = nl80211_get_interface,
7105                 .dumpit = nl80211_dump_interface,
7106                 .policy = nl80211_policy,
7107                 /* can be retrieved by unprivileged users */
7108                 .internal_flags = NL80211_FLAG_NEED_WDEV,
7109         },
7110         {
7111                 .cmd = NL80211_CMD_SET_INTERFACE,
7112                 .doit = nl80211_set_interface,
7113                 .policy = nl80211_policy,
7114                 .flags = GENL_ADMIN_PERM,
7115                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7116                                   NL80211_FLAG_NEED_RTNL,
7117         },
7118         {
7119                 .cmd = NL80211_CMD_NEW_INTERFACE,
7120                 .doit = nl80211_new_interface,
7121                 .policy = nl80211_policy,
7122                 .flags = GENL_ADMIN_PERM,
7123                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7124                                   NL80211_FLAG_NEED_RTNL,
7125         },
7126         {
7127                 .cmd = NL80211_CMD_DEL_INTERFACE,
7128                 .doit = nl80211_del_interface,
7129                 .policy = nl80211_policy,
7130                 .flags = GENL_ADMIN_PERM,
7131                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7132                                   NL80211_FLAG_NEED_RTNL,
7133         },
7134         {
7135                 .cmd = NL80211_CMD_GET_KEY,
7136                 .doit = nl80211_get_key,
7137                 .policy = nl80211_policy,
7138                 .flags = GENL_ADMIN_PERM,
7139                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7140                                   NL80211_FLAG_NEED_RTNL,
7141         },
7142         {
7143                 .cmd = NL80211_CMD_SET_KEY,
7144                 .doit = nl80211_set_key,
7145                 .policy = nl80211_policy,
7146                 .flags = GENL_ADMIN_PERM,
7147                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7148                                   NL80211_FLAG_NEED_RTNL,
7149         },
7150         {
7151                 .cmd = NL80211_CMD_NEW_KEY,
7152                 .doit = nl80211_new_key,
7153                 .policy = nl80211_policy,
7154                 .flags = GENL_ADMIN_PERM,
7155                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7156                                   NL80211_FLAG_NEED_RTNL,
7157         },
7158         {
7159                 .cmd = NL80211_CMD_DEL_KEY,
7160                 .doit = nl80211_del_key,
7161                 .policy = nl80211_policy,
7162                 .flags = GENL_ADMIN_PERM,
7163                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7164                                   NL80211_FLAG_NEED_RTNL,
7165         },
7166         {
7167                 .cmd = NL80211_CMD_SET_BEACON,
7168                 .policy = nl80211_policy,
7169                 .flags = GENL_ADMIN_PERM,
7170                 .doit = nl80211_set_beacon,
7171                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7172                                   NL80211_FLAG_NEED_RTNL,
7173         },
7174         {
7175                 .cmd = NL80211_CMD_START_AP,
7176                 .policy = nl80211_policy,
7177                 .flags = GENL_ADMIN_PERM,
7178                 .doit = nl80211_start_ap,
7179                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7180                                   NL80211_FLAG_NEED_RTNL,
7181         },
7182         {
7183                 .cmd = NL80211_CMD_STOP_AP,
7184                 .policy = nl80211_policy,
7185                 .flags = GENL_ADMIN_PERM,
7186                 .doit = nl80211_stop_ap,
7187                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7188                                   NL80211_FLAG_NEED_RTNL,
7189         },
7190         {
7191                 .cmd = NL80211_CMD_GET_STATION,
7192                 .doit = nl80211_get_station,
7193                 .dumpit = nl80211_dump_station,
7194                 .policy = nl80211_policy,
7195                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7196                                   NL80211_FLAG_NEED_RTNL,
7197         },
7198         {
7199                 .cmd = NL80211_CMD_SET_STATION,
7200                 .doit = nl80211_set_station,
7201                 .policy = nl80211_policy,
7202                 .flags = GENL_ADMIN_PERM,
7203                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7204                                   NL80211_FLAG_NEED_RTNL,
7205         },
7206         {
7207                 .cmd = NL80211_CMD_NEW_STATION,
7208                 .doit = nl80211_new_station,
7209                 .policy = nl80211_policy,
7210                 .flags = GENL_ADMIN_PERM,
7211                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7212                                   NL80211_FLAG_NEED_RTNL,
7213         },
7214         {
7215                 .cmd = NL80211_CMD_DEL_STATION,
7216                 .doit = nl80211_del_station,
7217                 .policy = nl80211_policy,
7218                 .flags = GENL_ADMIN_PERM,
7219                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7220                                   NL80211_FLAG_NEED_RTNL,
7221         },
7222         {
7223                 .cmd = NL80211_CMD_GET_MPATH,
7224                 .doit = nl80211_get_mpath,
7225                 .dumpit = nl80211_dump_mpath,
7226                 .policy = nl80211_policy,
7227                 .flags = GENL_ADMIN_PERM,
7228                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7229                                   NL80211_FLAG_NEED_RTNL,
7230         },
7231         {
7232                 .cmd = NL80211_CMD_SET_MPATH,
7233                 .doit = nl80211_set_mpath,
7234                 .policy = nl80211_policy,
7235                 .flags = GENL_ADMIN_PERM,
7236                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7237                                   NL80211_FLAG_NEED_RTNL,
7238         },
7239         {
7240                 .cmd = NL80211_CMD_NEW_MPATH,
7241                 .doit = nl80211_new_mpath,
7242                 .policy = nl80211_policy,
7243                 .flags = GENL_ADMIN_PERM,
7244                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7245                                   NL80211_FLAG_NEED_RTNL,
7246         },
7247         {
7248                 .cmd = NL80211_CMD_DEL_MPATH,
7249                 .doit = nl80211_del_mpath,
7250                 .policy = nl80211_policy,
7251                 .flags = GENL_ADMIN_PERM,
7252                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7253                                   NL80211_FLAG_NEED_RTNL,
7254         },
7255         {
7256                 .cmd = NL80211_CMD_SET_BSS,
7257                 .doit = nl80211_set_bss,
7258                 .policy = nl80211_policy,
7259                 .flags = GENL_ADMIN_PERM,
7260                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7261                                   NL80211_FLAG_NEED_RTNL,
7262         },
7263         {
7264                 .cmd = NL80211_CMD_GET_REG,
7265                 .doit = nl80211_get_reg,
7266                 .policy = nl80211_policy,
7267                 /* can be retrieved by unprivileged users */
7268         },
7269         {
7270                 .cmd = NL80211_CMD_SET_REG,
7271                 .doit = nl80211_set_reg,
7272                 .policy = nl80211_policy,
7273                 .flags = GENL_ADMIN_PERM,
7274         },
7275         {
7276                 .cmd = NL80211_CMD_REQ_SET_REG,
7277                 .doit = nl80211_req_set_reg,
7278                 .policy = nl80211_policy,
7279                 .flags = GENL_ADMIN_PERM,
7280         },
7281         {
7282                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
7283                 .doit = nl80211_get_mesh_config,
7284                 .policy = nl80211_policy,
7285                 /* can be retrieved by unprivileged users */
7286                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7287                                   NL80211_FLAG_NEED_RTNL,
7288         },
7289         {
7290                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
7291                 .doit = nl80211_update_mesh_config,
7292                 .policy = nl80211_policy,
7293                 .flags = GENL_ADMIN_PERM,
7294                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7295                                   NL80211_FLAG_NEED_RTNL,
7296         },
7297         {
7298                 .cmd = NL80211_CMD_TRIGGER_SCAN,
7299                 .doit = nl80211_trigger_scan,
7300                 .policy = nl80211_policy,
7301                 .flags = GENL_ADMIN_PERM,
7302                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7303                                   NL80211_FLAG_NEED_RTNL,
7304         },
7305         {
7306                 .cmd = NL80211_CMD_GET_SCAN,
7307                 .policy = nl80211_policy,
7308                 .dumpit = nl80211_dump_scan,
7309         },
7310         {
7311                 .cmd = NL80211_CMD_START_SCHED_SCAN,
7312                 .doit = nl80211_start_sched_scan,
7313                 .policy = nl80211_policy,
7314                 .flags = GENL_ADMIN_PERM,
7315                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7316                                   NL80211_FLAG_NEED_RTNL,
7317         },
7318         {
7319                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
7320                 .doit = nl80211_stop_sched_scan,
7321                 .policy = nl80211_policy,
7322                 .flags = GENL_ADMIN_PERM,
7323                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7324                                   NL80211_FLAG_NEED_RTNL,
7325         },
7326         {
7327                 .cmd = NL80211_CMD_AUTHENTICATE,
7328                 .doit = nl80211_authenticate,
7329                 .policy = nl80211_policy,
7330                 .flags = GENL_ADMIN_PERM,
7331                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7332                                   NL80211_FLAG_NEED_RTNL,
7333         },
7334         {
7335                 .cmd = NL80211_CMD_ASSOCIATE,
7336                 .doit = nl80211_associate,
7337                 .policy = nl80211_policy,
7338                 .flags = GENL_ADMIN_PERM,
7339                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7340                                   NL80211_FLAG_NEED_RTNL,
7341         },
7342         {
7343                 .cmd = NL80211_CMD_DEAUTHENTICATE,
7344                 .doit = nl80211_deauthenticate,
7345                 .policy = nl80211_policy,
7346                 .flags = GENL_ADMIN_PERM,
7347                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7348                                   NL80211_FLAG_NEED_RTNL,
7349         },
7350         {
7351                 .cmd = NL80211_CMD_DISASSOCIATE,
7352                 .doit = nl80211_disassociate,
7353                 .policy = nl80211_policy,
7354                 .flags = GENL_ADMIN_PERM,
7355                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7356                                   NL80211_FLAG_NEED_RTNL,
7357         },
7358         {
7359                 .cmd = NL80211_CMD_JOIN_IBSS,
7360                 .doit = nl80211_join_ibss,
7361                 .policy = nl80211_policy,
7362                 .flags = GENL_ADMIN_PERM,
7363                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7364                                   NL80211_FLAG_NEED_RTNL,
7365         },
7366         {
7367                 .cmd = NL80211_CMD_LEAVE_IBSS,
7368                 .doit = nl80211_leave_ibss,
7369                 .policy = nl80211_policy,
7370                 .flags = GENL_ADMIN_PERM,
7371                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7372                                   NL80211_FLAG_NEED_RTNL,
7373         },
7374 #ifdef CONFIG_NL80211_TESTMODE
7375         {
7376                 .cmd = NL80211_CMD_TESTMODE,
7377                 .doit = nl80211_testmode_do,
7378                 .dumpit = nl80211_testmode_dump,
7379                 .policy = nl80211_policy,
7380                 .flags = GENL_ADMIN_PERM,
7381                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7382                                   NL80211_FLAG_NEED_RTNL,
7383         },
7384 #endif
7385         {
7386                 .cmd = NL80211_CMD_CONNECT,
7387                 .doit = nl80211_connect,
7388                 .policy = nl80211_policy,
7389                 .flags = GENL_ADMIN_PERM,
7390                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7391                                   NL80211_FLAG_NEED_RTNL,
7392         },
7393         {
7394                 .cmd = NL80211_CMD_DISCONNECT,
7395                 .doit = nl80211_disconnect,
7396                 .policy = nl80211_policy,
7397                 .flags = GENL_ADMIN_PERM,
7398                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7399                                   NL80211_FLAG_NEED_RTNL,
7400         },
7401         {
7402                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
7403                 .doit = nl80211_wiphy_netns,
7404                 .policy = nl80211_policy,
7405                 .flags = GENL_ADMIN_PERM,
7406                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7407                                   NL80211_FLAG_NEED_RTNL,
7408         },
7409         {
7410                 .cmd = NL80211_CMD_GET_SURVEY,
7411                 .policy = nl80211_policy,
7412                 .dumpit = nl80211_dump_survey,
7413         },
7414         {
7415                 .cmd = NL80211_CMD_SET_PMKSA,
7416                 .doit = nl80211_setdel_pmksa,
7417                 .policy = nl80211_policy,
7418                 .flags = GENL_ADMIN_PERM,
7419                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7420                                   NL80211_FLAG_NEED_RTNL,
7421         },
7422         {
7423                 .cmd = NL80211_CMD_DEL_PMKSA,
7424                 .doit = nl80211_setdel_pmksa,
7425                 .policy = nl80211_policy,
7426                 .flags = GENL_ADMIN_PERM,
7427                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7428                                   NL80211_FLAG_NEED_RTNL,
7429         },
7430         {
7431                 .cmd = NL80211_CMD_FLUSH_PMKSA,
7432                 .doit = nl80211_flush_pmksa,
7433                 .policy = nl80211_policy,
7434                 .flags = GENL_ADMIN_PERM,
7435                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7436                                   NL80211_FLAG_NEED_RTNL,
7437         },
7438         {
7439                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
7440                 .doit = nl80211_remain_on_channel,
7441                 .policy = nl80211_policy,
7442                 .flags = GENL_ADMIN_PERM,
7443                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7444                                   NL80211_FLAG_NEED_RTNL,
7445         },
7446         {
7447                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
7448                 .doit = nl80211_cancel_remain_on_channel,
7449                 .policy = nl80211_policy,
7450                 .flags = GENL_ADMIN_PERM,
7451                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7452                                   NL80211_FLAG_NEED_RTNL,
7453         },
7454         {
7455                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
7456                 .doit = nl80211_set_tx_bitrate_mask,
7457                 .policy = nl80211_policy,
7458                 .flags = GENL_ADMIN_PERM,
7459                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7460                                   NL80211_FLAG_NEED_RTNL,
7461         },
7462         {
7463                 .cmd = NL80211_CMD_REGISTER_FRAME,
7464                 .doit = nl80211_register_mgmt,
7465                 .policy = nl80211_policy,
7466                 .flags = GENL_ADMIN_PERM,
7467                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7468                                   NL80211_FLAG_NEED_RTNL,
7469         },
7470         {
7471                 .cmd = NL80211_CMD_FRAME,
7472                 .doit = nl80211_tx_mgmt,
7473                 .policy = nl80211_policy,
7474                 .flags = GENL_ADMIN_PERM,
7475                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7476                                   NL80211_FLAG_NEED_RTNL,
7477         },
7478         {
7479                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
7480                 .doit = nl80211_tx_mgmt_cancel_wait,
7481                 .policy = nl80211_policy,
7482                 .flags = GENL_ADMIN_PERM,
7483                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7484                                   NL80211_FLAG_NEED_RTNL,
7485         },
7486         {
7487                 .cmd = NL80211_CMD_SET_POWER_SAVE,
7488                 .doit = nl80211_set_power_save,
7489                 .policy = nl80211_policy,
7490                 .flags = GENL_ADMIN_PERM,
7491                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7492                                   NL80211_FLAG_NEED_RTNL,
7493         },
7494         {
7495                 .cmd = NL80211_CMD_GET_POWER_SAVE,
7496                 .doit = nl80211_get_power_save,
7497                 .policy = nl80211_policy,
7498                 /* can be retrieved by unprivileged users */
7499                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7500                                   NL80211_FLAG_NEED_RTNL,
7501         },
7502         {
7503                 .cmd = NL80211_CMD_SET_CQM,
7504                 .doit = nl80211_set_cqm,
7505                 .policy = nl80211_policy,
7506                 .flags = GENL_ADMIN_PERM,
7507                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7508                                   NL80211_FLAG_NEED_RTNL,
7509         },
7510         {
7511                 .cmd = NL80211_CMD_SET_CHANNEL,
7512                 .doit = nl80211_set_channel,
7513                 .policy = nl80211_policy,
7514                 .flags = GENL_ADMIN_PERM,
7515                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7516                                   NL80211_FLAG_NEED_RTNL,
7517         },
7518         {
7519                 .cmd = NL80211_CMD_SET_WDS_PEER,
7520                 .doit = nl80211_set_wds_peer,
7521                 .policy = nl80211_policy,
7522                 .flags = GENL_ADMIN_PERM,
7523                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7524                                   NL80211_FLAG_NEED_RTNL,
7525         },
7526         {
7527                 .cmd = NL80211_CMD_JOIN_MESH,
7528                 .doit = nl80211_join_mesh,
7529                 .policy = nl80211_policy,
7530                 .flags = GENL_ADMIN_PERM,
7531                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7532                                   NL80211_FLAG_NEED_RTNL,
7533         },
7534         {
7535                 .cmd = NL80211_CMD_LEAVE_MESH,
7536                 .doit = nl80211_leave_mesh,
7537                 .policy = nl80211_policy,
7538                 .flags = GENL_ADMIN_PERM,
7539                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7540                                   NL80211_FLAG_NEED_RTNL,
7541         },
7542 #ifdef CONFIG_PM
7543         {
7544                 .cmd = NL80211_CMD_GET_WOWLAN,
7545                 .doit = nl80211_get_wowlan,
7546                 .policy = nl80211_policy,
7547                 /* can be retrieved by unprivileged users */
7548                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7549                                   NL80211_FLAG_NEED_RTNL,
7550         },
7551         {
7552                 .cmd = NL80211_CMD_SET_WOWLAN,
7553                 .doit = nl80211_set_wowlan,
7554                 .policy = nl80211_policy,
7555                 .flags = GENL_ADMIN_PERM,
7556                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7557                                   NL80211_FLAG_NEED_RTNL,
7558         },
7559 #endif
7560         {
7561                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
7562                 .doit = nl80211_set_rekey_data,
7563                 .policy = nl80211_policy,
7564                 .flags = GENL_ADMIN_PERM,
7565                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7566                                   NL80211_FLAG_NEED_RTNL,
7567         },
7568         {
7569                 .cmd = NL80211_CMD_TDLS_MGMT,
7570                 .doit = nl80211_tdls_mgmt,
7571                 .policy = nl80211_policy,
7572                 .flags = GENL_ADMIN_PERM,
7573                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7574                                   NL80211_FLAG_NEED_RTNL,
7575         },
7576         {
7577                 .cmd = NL80211_CMD_TDLS_OPER,
7578                 .doit = nl80211_tdls_oper,
7579                 .policy = nl80211_policy,
7580                 .flags = GENL_ADMIN_PERM,
7581                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7582                                   NL80211_FLAG_NEED_RTNL,
7583         },
7584         {
7585                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
7586                 .doit = nl80211_register_unexpected_frame,
7587                 .policy = nl80211_policy,
7588                 .flags = GENL_ADMIN_PERM,
7589                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7590                                   NL80211_FLAG_NEED_RTNL,
7591         },
7592         {
7593                 .cmd = NL80211_CMD_PROBE_CLIENT,
7594                 .doit = nl80211_probe_client,
7595                 .policy = nl80211_policy,
7596                 .flags = GENL_ADMIN_PERM,
7597                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7598                                   NL80211_FLAG_NEED_RTNL,
7599         },
7600         {
7601                 .cmd = NL80211_CMD_REGISTER_BEACONS,
7602                 .doit = nl80211_register_beacons,
7603                 .policy = nl80211_policy,
7604                 .flags = GENL_ADMIN_PERM,
7605                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
7606                                   NL80211_FLAG_NEED_RTNL,
7607         },
7608         {
7609                 .cmd = NL80211_CMD_SET_NOACK_MAP,
7610                 .doit = nl80211_set_noack_map,
7611                 .policy = nl80211_policy,
7612                 .flags = GENL_ADMIN_PERM,
7613                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
7614                                   NL80211_FLAG_NEED_RTNL,
7615         },
7616         {
7617                 .cmd = NL80211_CMD_START_P2P_DEVICE,
7618                 .doit = nl80211_start_p2p_device,
7619                 .policy = nl80211_policy,
7620                 .flags = GENL_ADMIN_PERM,
7621                 .internal_flags = NL80211_FLAG_NEED_WDEV |
7622                                   NL80211_FLAG_NEED_RTNL,
7623         },
7624         {
7625                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
7626                 .doit = nl80211_stop_p2p_device,
7627                 .policy = nl80211_policy,
7628                 .flags = GENL_ADMIN_PERM,
7629                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7630                                   NL80211_FLAG_NEED_RTNL,
7631         },
7632 };
7633
7634 static struct genl_multicast_group nl80211_mlme_mcgrp = {
7635         .name = "mlme",
7636 };
7637
7638 /* multicast groups */
7639 static struct genl_multicast_group nl80211_config_mcgrp = {
7640         .name = "config",
7641 };
7642 static struct genl_multicast_group nl80211_scan_mcgrp = {
7643         .name = "scan",
7644 };
7645 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
7646         .name = "regulatory",
7647 };
7648
7649 /* notification functions */
7650
7651 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
7652 {
7653         struct sk_buff *msg;
7654
7655         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7656         if (!msg)
7657                 return;
7658
7659         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
7660                 nlmsg_free(msg);
7661                 return;
7662         }
7663
7664         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7665                                 nl80211_config_mcgrp.id, GFP_KERNEL);
7666 }
7667
7668 static int nl80211_add_scan_req(struct sk_buff *msg,
7669                                 struct cfg80211_registered_device *rdev)
7670 {
7671         struct cfg80211_scan_request *req = rdev->scan_req;
7672         struct nlattr *nest;
7673         int i;
7674
7675         ASSERT_RDEV_LOCK(rdev);
7676
7677         if (WARN_ON(!req))
7678                 return 0;
7679
7680         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
7681         if (!nest)
7682                 goto nla_put_failure;
7683         for (i = 0; i < req->n_ssids; i++) {
7684                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
7685                         goto nla_put_failure;
7686         }
7687         nla_nest_end(msg, nest);
7688
7689         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
7690         if (!nest)
7691                 goto nla_put_failure;
7692         for (i = 0; i < req->n_channels; i++) {
7693                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
7694                         goto nla_put_failure;
7695         }
7696         nla_nest_end(msg, nest);
7697
7698         if (req->ie &&
7699             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
7700                 goto nla_put_failure;
7701
7702         if (req->flags)
7703                 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags);
7704
7705         return 0;
7706  nla_put_failure:
7707         return -ENOBUFS;
7708 }
7709
7710 static int nl80211_send_scan_msg(struct sk_buff *msg,
7711                                  struct cfg80211_registered_device *rdev,
7712                                  struct wireless_dev *wdev,
7713                                  u32 portid, u32 seq, int flags,
7714                                  u32 cmd)
7715 {
7716         void *hdr;
7717
7718         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7719         if (!hdr)
7720                 return -1;
7721
7722         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7723             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
7724                                          wdev->netdev->ifindex)) ||
7725             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
7726                 goto nla_put_failure;
7727
7728         /* ignore errors and send incomplete event anyway */
7729         nl80211_add_scan_req(msg, rdev);
7730
7731         return genlmsg_end(msg, hdr);
7732
7733  nla_put_failure:
7734         genlmsg_cancel(msg, hdr);
7735         return -EMSGSIZE;
7736 }
7737
7738 static int
7739 nl80211_send_sched_scan_msg(struct sk_buff *msg,
7740                             struct cfg80211_registered_device *rdev,
7741                             struct net_device *netdev,
7742                             u32 portid, u32 seq, int flags, u32 cmd)
7743 {
7744         void *hdr;
7745
7746         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7747         if (!hdr)
7748                 return -1;
7749
7750         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7751             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
7752                 goto nla_put_failure;
7753
7754         return genlmsg_end(msg, hdr);
7755
7756  nla_put_failure:
7757         genlmsg_cancel(msg, hdr);
7758         return -EMSGSIZE;
7759 }
7760
7761 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
7762                              struct wireless_dev *wdev)
7763 {
7764         struct sk_buff *msg;
7765
7766         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7767         if (!msg)
7768                 return;
7769
7770         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7771                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
7772                 nlmsg_free(msg);
7773                 return;
7774         }
7775
7776         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7777                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7778 }
7779
7780 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
7781                             struct wireless_dev *wdev)
7782 {
7783         struct sk_buff *msg;
7784
7785         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7786         if (!msg)
7787                 return;
7788
7789         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7790                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
7791                 nlmsg_free(msg);
7792                 return;
7793         }
7794
7795         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7796                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7797 }
7798
7799 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
7800                                struct wireless_dev *wdev)
7801 {
7802         struct sk_buff *msg;
7803
7804         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7805         if (!msg)
7806                 return;
7807
7808         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7809                                   NL80211_CMD_SCAN_ABORTED) < 0) {
7810                 nlmsg_free(msg);
7811                 return;
7812         }
7813
7814         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7815                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7816 }
7817
7818 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
7819                                      struct net_device *netdev)
7820 {
7821         struct sk_buff *msg;
7822
7823         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7824         if (!msg)
7825                 return;
7826
7827         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
7828                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
7829                 nlmsg_free(msg);
7830                 return;
7831         }
7832
7833         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7834                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7835 }
7836
7837 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
7838                              struct net_device *netdev, u32 cmd)
7839 {
7840         struct sk_buff *msg;
7841
7842         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7843         if (!msg)
7844                 return;
7845
7846         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
7847                 nlmsg_free(msg);
7848                 return;
7849         }
7850
7851         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7852                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
7853 }
7854
7855 /*
7856  * This can happen on global regulatory changes or device specific settings
7857  * based on custom world regulatory domains.
7858  */
7859 void nl80211_send_reg_change_event(struct regulatory_request *request)
7860 {
7861         struct sk_buff *msg;
7862         void *hdr;
7863
7864         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7865         if (!msg)
7866                 return;
7867
7868         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
7869         if (!hdr) {
7870                 nlmsg_free(msg);
7871                 return;
7872         }
7873
7874         /* Userspace can always count this one always being set */
7875         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
7876                 goto nla_put_failure;
7877
7878         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
7879                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7880                                NL80211_REGDOM_TYPE_WORLD))
7881                         goto nla_put_failure;
7882         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
7883                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7884                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
7885                         goto nla_put_failure;
7886         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
7887                    request->intersect) {
7888                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7889                                NL80211_REGDOM_TYPE_INTERSECTION))
7890                         goto nla_put_failure;
7891         } else {
7892                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7893                                NL80211_REGDOM_TYPE_COUNTRY) ||
7894                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
7895                                    request->alpha2))
7896                         goto nla_put_failure;
7897         }
7898
7899         if (wiphy_idx_valid(request->wiphy_idx) &&
7900             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
7901                 goto nla_put_failure;
7902
7903         genlmsg_end(msg, hdr);
7904
7905         rcu_read_lock();
7906         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
7907                                 GFP_ATOMIC);
7908         rcu_read_unlock();
7909
7910         return;
7911
7912 nla_put_failure:
7913         genlmsg_cancel(msg, hdr);
7914         nlmsg_free(msg);
7915 }
7916
7917 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
7918                                     struct net_device *netdev,
7919                                     const u8 *buf, size_t len,
7920                                     enum nl80211_commands cmd, gfp_t gfp)
7921 {
7922         struct sk_buff *msg;
7923         void *hdr;
7924
7925         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7926         if (!msg)
7927                 return;
7928
7929         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7930         if (!hdr) {
7931                 nlmsg_free(msg);
7932                 return;
7933         }
7934
7935         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7936             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7937             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
7938                 goto nla_put_failure;
7939
7940         genlmsg_end(msg, hdr);
7941
7942         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7943                                 nl80211_mlme_mcgrp.id, gfp);
7944         return;
7945
7946  nla_put_failure:
7947         genlmsg_cancel(msg, hdr);
7948         nlmsg_free(msg);
7949 }
7950
7951 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
7952                           struct net_device *netdev, const u8 *buf,
7953                           size_t len, gfp_t gfp)
7954 {
7955         nl80211_send_mlme_event(rdev, netdev, buf, len,
7956                                 NL80211_CMD_AUTHENTICATE, gfp);
7957 }
7958
7959 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
7960                            struct net_device *netdev, const u8 *buf,
7961                            size_t len, gfp_t gfp)
7962 {
7963         nl80211_send_mlme_event(rdev, netdev, buf, len,
7964                                 NL80211_CMD_ASSOCIATE, gfp);
7965 }
7966
7967 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
7968                          struct net_device *netdev, const u8 *buf,
7969                          size_t len, gfp_t gfp)
7970 {
7971         nl80211_send_mlme_event(rdev, netdev, buf, len,
7972                                 NL80211_CMD_DEAUTHENTICATE, gfp);
7973 }
7974
7975 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
7976                            struct net_device *netdev, const u8 *buf,
7977                            size_t len, gfp_t gfp)
7978 {
7979         nl80211_send_mlme_event(rdev, netdev, buf, len,
7980                                 NL80211_CMD_DISASSOCIATE, gfp);
7981 }
7982
7983 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
7984                                 struct net_device *netdev, const u8 *buf,
7985                                 size_t len, gfp_t gfp)
7986 {
7987         nl80211_send_mlme_event(rdev, netdev, buf, len,
7988                                 NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
7989 }
7990
7991 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
7992                                   struct net_device *netdev, const u8 *buf,
7993                                   size_t len, gfp_t gfp)
7994 {
7995         nl80211_send_mlme_event(rdev, netdev, buf, len,
7996                                 NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
7997 }
7998
7999 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
8000                                       struct net_device *netdev, int cmd,
8001                                       const u8 *addr, gfp_t gfp)
8002 {
8003         struct sk_buff *msg;
8004         void *hdr;
8005
8006         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8007         if (!msg)
8008                 return;
8009
8010         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8011         if (!hdr) {
8012                 nlmsg_free(msg);
8013                 return;
8014         }
8015
8016         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8017             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8018             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
8019             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8020                 goto nla_put_failure;
8021
8022         genlmsg_end(msg, hdr);
8023
8024         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8025                                 nl80211_mlme_mcgrp.id, gfp);
8026         return;
8027
8028  nla_put_failure:
8029         genlmsg_cancel(msg, hdr);
8030         nlmsg_free(msg);
8031 }
8032
8033 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
8034                                struct net_device *netdev, const u8 *addr,
8035                                gfp_t gfp)
8036 {
8037         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
8038                                   addr, gfp);
8039 }
8040
8041 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
8042                                 struct net_device *netdev, const u8 *addr,
8043                                 gfp_t gfp)
8044 {
8045         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
8046                                   addr, gfp);
8047 }
8048
8049 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
8050                                  struct net_device *netdev, const u8 *bssid,
8051                                  const u8 *req_ie, size_t req_ie_len,
8052                                  const u8 *resp_ie, size_t resp_ie_len,
8053                                  u16 status, gfp_t gfp)
8054 {
8055         struct sk_buff *msg;
8056         void *hdr;
8057
8058         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8059         if (!msg)
8060                 return;
8061
8062         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
8063         if (!hdr) {
8064                 nlmsg_free(msg);
8065                 return;
8066         }
8067
8068         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8069             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8070             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
8071             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
8072             (req_ie &&
8073              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8074             (resp_ie &&
8075              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8076                 goto nla_put_failure;
8077
8078         genlmsg_end(msg, hdr);
8079
8080         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8081                                 nl80211_mlme_mcgrp.id, gfp);
8082         return;
8083
8084  nla_put_failure:
8085         genlmsg_cancel(msg, hdr);
8086         nlmsg_free(msg);
8087
8088 }
8089
8090 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
8091                          struct net_device *netdev, const u8 *bssid,
8092                          const u8 *req_ie, size_t req_ie_len,
8093                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
8094 {
8095         struct sk_buff *msg;
8096         void *hdr;
8097
8098         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8099         if (!msg)
8100                 return;
8101
8102         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
8103         if (!hdr) {
8104                 nlmsg_free(msg);
8105                 return;
8106         }
8107
8108         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8109             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8110             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
8111             (req_ie &&
8112              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8113             (resp_ie &&
8114              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8115                 goto nla_put_failure;
8116
8117         genlmsg_end(msg, hdr);
8118
8119         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8120                                 nl80211_mlme_mcgrp.id, gfp);
8121         return;
8122
8123  nla_put_failure:
8124         genlmsg_cancel(msg, hdr);
8125         nlmsg_free(msg);
8126
8127 }
8128
8129 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
8130                                struct net_device *netdev, u16 reason,
8131                                const u8 *ie, size_t ie_len, bool from_ap)
8132 {
8133         struct sk_buff *msg;
8134         void *hdr;
8135
8136         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8137         if (!msg)
8138                 return;
8139
8140         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
8141         if (!hdr) {
8142                 nlmsg_free(msg);
8143                 return;
8144         }
8145
8146         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8147             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8148             (from_ap && reason &&
8149              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
8150             (from_ap &&
8151              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
8152             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
8153                 goto nla_put_failure;
8154
8155         genlmsg_end(msg, hdr);
8156
8157         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8158                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
8159         return;
8160
8161  nla_put_failure:
8162         genlmsg_cancel(msg, hdr);
8163         nlmsg_free(msg);
8164
8165 }
8166
8167 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
8168                              struct net_device *netdev, const u8 *bssid,
8169                              gfp_t gfp)
8170 {
8171         struct sk_buff *msg;
8172         void *hdr;
8173
8174         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8175         if (!msg)
8176                 return;
8177
8178         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
8179         if (!hdr) {
8180                 nlmsg_free(msg);
8181                 return;
8182         }
8183
8184         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8185             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8186             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8187                 goto nla_put_failure;
8188
8189         genlmsg_end(msg, hdr);
8190
8191         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8192                                 nl80211_mlme_mcgrp.id, gfp);
8193         return;
8194
8195  nla_put_failure:
8196         genlmsg_cancel(msg, hdr);
8197         nlmsg_free(msg);
8198 }
8199
8200 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
8201                 struct net_device *netdev,
8202                 const u8 *macaddr, const u8* ie, u8 ie_len,
8203                 gfp_t gfp)
8204 {
8205         struct sk_buff *msg;
8206         void *hdr;
8207
8208         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8209         if (!msg)
8210                 return;
8211
8212         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
8213         if (!hdr) {
8214                 nlmsg_free(msg);
8215                 return;
8216         }
8217
8218         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8219             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8220             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
8221             (ie_len && ie &&
8222              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
8223                 goto nla_put_failure;
8224
8225         genlmsg_end(msg, hdr);
8226
8227         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8228                                 nl80211_mlme_mcgrp.id, gfp);
8229         return;
8230
8231  nla_put_failure:
8232         genlmsg_cancel(msg, hdr);
8233         nlmsg_free(msg);
8234 }
8235
8236 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
8237                                  struct net_device *netdev, const u8 *addr,
8238                                  enum nl80211_key_type key_type, int key_id,
8239                                  const u8 *tsc, gfp_t gfp)
8240 {
8241         struct sk_buff *msg;
8242         void *hdr;
8243
8244         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8245         if (!msg)
8246                 return;
8247
8248         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
8249         if (!hdr) {
8250                 nlmsg_free(msg);
8251                 return;
8252         }
8253
8254         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8255             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8256             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
8257             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
8258             (key_id != -1 &&
8259              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
8260             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
8261                 goto nla_put_failure;
8262
8263         genlmsg_end(msg, hdr);
8264
8265         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8266                                 nl80211_mlme_mcgrp.id, gfp);
8267         return;
8268
8269  nla_put_failure:
8270         genlmsg_cancel(msg, hdr);
8271         nlmsg_free(msg);
8272 }
8273
8274 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
8275                                     struct ieee80211_channel *channel_before,
8276                                     struct ieee80211_channel *channel_after)
8277 {
8278         struct sk_buff *msg;
8279         void *hdr;
8280         struct nlattr *nl_freq;
8281
8282         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
8283         if (!msg)
8284                 return;
8285
8286         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
8287         if (!hdr) {
8288                 nlmsg_free(msg);
8289                 return;
8290         }
8291
8292         /*
8293          * Since we are applying the beacon hint to a wiphy we know its
8294          * wiphy_idx is valid
8295          */
8296         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8297                 goto nla_put_failure;
8298
8299         /* Before */
8300         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
8301         if (!nl_freq)
8302                 goto nla_put_failure;
8303         if (nl80211_msg_put_channel(msg, channel_before))
8304                 goto nla_put_failure;
8305         nla_nest_end(msg, nl_freq);
8306
8307         /* After */
8308         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
8309         if (!nl_freq)
8310                 goto nla_put_failure;
8311         if (nl80211_msg_put_channel(msg, channel_after))
8312                 goto nla_put_failure;
8313         nla_nest_end(msg, nl_freq);
8314
8315         genlmsg_end(msg, hdr);
8316
8317         rcu_read_lock();
8318         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
8319                                 GFP_ATOMIC);
8320         rcu_read_unlock();
8321
8322         return;
8323
8324 nla_put_failure:
8325         genlmsg_cancel(msg, hdr);
8326         nlmsg_free(msg);
8327 }
8328
8329 static void nl80211_send_remain_on_chan_event(
8330         int cmd, struct cfg80211_registered_device *rdev,
8331         struct wireless_dev *wdev, u64 cookie,
8332         struct ieee80211_channel *chan,
8333         enum nl80211_channel_type channel_type,
8334         unsigned int duration, gfp_t gfp)
8335 {
8336         struct sk_buff *msg;
8337         void *hdr;
8338
8339         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8340         if (!msg)
8341                 return;
8342
8343         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8344         if (!hdr) {
8345                 nlmsg_free(msg);
8346                 return;
8347         }
8348
8349         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8350             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8351                                          wdev->netdev->ifindex)) ||
8352             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
8353             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
8354             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type) ||
8355             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8356                 goto nla_put_failure;
8357
8358         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
8359             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
8360                 goto nla_put_failure;
8361
8362         genlmsg_end(msg, hdr);
8363
8364         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8365                                 nl80211_mlme_mcgrp.id, gfp);
8366         return;
8367
8368  nla_put_failure:
8369         genlmsg_cancel(msg, hdr);
8370         nlmsg_free(msg);
8371 }
8372
8373 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
8374                                     struct wireless_dev *wdev, u64 cookie,
8375                                     struct ieee80211_channel *chan,
8376                                     enum nl80211_channel_type channel_type,
8377                                     unsigned int duration, gfp_t gfp)
8378 {
8379         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
8380                                           rdev, wdev, cookie, chan,
8381                                           channel_type, duration, gfp);
8382 }
8383
8384 void nl80211_send_remain_on_channel_cancel(
8385         struct cfg80211_registered_device *rdev,
8386         struct wireless_dev *wdev,
8387         u64 cookie, struct ieee80211_channel *chan,
8388         enum nl80211_channel_type channel_type, gfp_t gfp)
8389 {
8390         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8391                                           rdev, wdev, cookie, chan,
8392                                           channel_type, 0, gfp);
8393 }
8394
8395 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
8396                             struct net_device *dev, const u8 *mac_addr,
8397                             struct station_info *sinfo, gfp_t gfp)
8398 {
8399         struct sk_buff *msg;
8400
8401         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8402         if (!msg)
8403                 return;
8404
8405         if (nl80211_send_station(msg, 0, 0, 0,
8406                                  rdev, dev, mac_addr, sinfo) < 0) {
8407                 nlmsg_free(msg);
8408                 return;
8409         }
8410
8411         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8412                                 nl80211_mlme_mcgrp.id, gfp);
8413 }
8414
8415 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
8416                                 struct net_device *dev, const u8 *mac_addr,
8417                                 gfp_t gfp)
8418 {
8419         struct sk_buff *msg;
8420         void *hdr;
8421
8422         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8423         if (!msg)
8424                 return;
8425
8426         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
8427         if (!hdr) {
8428                 nlmsg_free(msg);
8429                 return;
8430         }
8431
8432         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8433             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
8434                 goto nla_put_failure;
8435
8436         genlmsg_end(msg, hdr);
8437
8438         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8439                                 nl80211_mlme_mcgrp.id, gfp);
8440         return;
8441
8442  nla_put_failure:
8443         genlmsg_cancel(msg, hdr);
8444         nlmsg_free(msg);
8445 }
8446
8447 void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
8448                                     struct net_device *dev, const u8 *mac_addr,
8449                                     enum nl80211_connect_failed_reason reason,
8450                                     gfp_t gfp)
8451 {
8452         struct sk_buff *msg;
8453         void *hdr;
8454
8455         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8456         if (!msg)
8457                 return;
8458
8459         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
8460         if (!hdr) {
8461                 nlmsg_free(msg);
8462                 return;
8463         }
8464
8465         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8466             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
8467             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
8468                 goto nla_put_failure;
8469
8470         genlmsg_end(msg, hdr);
8471
8472         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8473                                 nl80211_mlme_mcgrp.id, gfp);
8474         return;
8475
8476  nla_put_failure:
8477         genlmsg_cancel(msg, hdr);
8478         nlmsg_free(msg);
8479 }
8480
8481 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
8482                                        const u8 *addr, gfp_t gfp)
8483 {
8484         struct wireless_dev *wdev = dev->ieee80211_ptr;
8485         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8486         struct sk_buff *msg;
8487         void *hdr;
8488         int err;
8489         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
8490
8491         if (!nlportid)
8492                 return false;
8493
8494         msg = nlmsg_new(100, gfp);
8495         if (!msg)
8496                 return true;
8497
8498         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8499         if (!hdr) {
8500                 nlmsg_free(msg);
8501                 return true;
8502         }
8503
8504         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8505             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8506             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8507                 goto nla_put_failure;
8508
8509         err = genlmsg_end(msg, hdr);
8510         if (err < 0) {
8511                 nlmsg_free(msg);
8512                 return true;
8513         }
8514
8515         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8516         return true;
8517
8518  nla_put_failure:
8519         genlmsg_cancel(msg, hdr);
8520         nlmsg_free(msg);
8521         return true;
8522 }
8523
8524 bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
8525 {
8526         return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
8527                                           addr, gfp);
8528 }
8529
8530 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
8531                                     const u8 *addr, gfp_t gfp)
8532 {
8533         return __nl80211_unexpected_frame(dev,
8534                                           NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
8535                                           addr, gfp);
8536 }
8537
8538 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
8539                       struct wireless_dev *wdev, u32 nlportid,
8540                       int freq, int sig_dbm,
8541                       const u8 *buf, size_t len, gfp_t gfp)
8542 {
8543         struct net_device *netdev = wdev->netdev;
8544         struct sk_buff *msg;
8545         void *hdr;
8546
8547         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8548         if (!msg)
8549                 return -ENOMEM;
8550
8551         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
8552         if (!hdr) {
8553                 nlmsg_free(msg);
8554                 return -ENOMEM;
8555         }
8556
8557         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8558             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8559                                         netdev->ifindex)) ||
8560             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
8561             (sig_dbm &&
8562              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
8563             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
8564                 goto nla_put_failure;
8565
8566         genlmsg_end(msg, hdr);
8567
8568         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8569
8570  nla_put_failure:
8571         genlmsg_cancel(msg, hdr);
8572         nlmsg_free(msg);
8573         return -ENOBUFS;
8574 }
8575
8576 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
8577                                  struct wireless_dev *wdev, u64 cookie,
8578                                  const u8 *buf, size_t len, bool ack,
8579                                  gfp_t gfp)
8580 {
8581         struct net_device *netdev = wdev->netdev;
8582         struct sk_buff *msg;
8583         void *hdr;
8584
8585         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8586         if (!msg)
8587                 return;
8588
8589         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
8590         if (!hdr) {
8591                 nlmsg_free(msg);
8592                 return;
8593         }
8594
8595         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8596             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8597                                    netdev->ifindex)) ||
8598             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
8599             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8600             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
8601                 goto nla_put_failure;
8602
8603         genlmsg_end(msg, hdr);
8604
8605         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
8606         return;
8607
8608  nla_put_failure:
8609         genlmsg_cancel(msg, hdr);
8610         nlmsg_free(msg);
8611 }
8612
8613 void
8614 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
8615                              struct net_device *netdev,
8616                              enum nl80211_cqm_rssi_threshold_event rssi_event,
8617                              gfp_t gfp)
8618 {
8619         struct sk_buff *msg;
8620         struct nlattr *pinfoattr;
8621         void *hdr;
8622
8623         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8624         if (!msg)
8625                 return;
8626
8627         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8628         if (!hdr) {
8629                 nlmsg_free(msg);
8630                 return;
8631         }
8632
8633         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8634             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8635                 goto nla_put_failure;
8636
8637         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8638         if (!pinfoattr)
8639                 goto nla_put_failure;
8640
8641         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
8642                         rssi_event))
8643                 goto nla_put_failure;
8644
8645         nla_nest_end(msg, pinfoattr);
8646
8647         genlmsg_end(msg, hdr);
8648
8649         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8650                                 nl80211_mlme_mcgrp.id, gfp);
8651         return;
8652
8653  nla_put_failure:
8654         genlmsg_cancel(msg, hdr);
8655         nlmsg_free(msg);
8656 }
8657
8658 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
8659                               struct net_device *netdev, const u8 *bssid,
8660                               const u8 *replay_ctr, gfp_t gfp)
8661 {
8662         struct sk_buff *msg;
8663         struct nlattr *rekey_attr;
8664         void *hdr;
8665
8666         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8667         if (!msg)
8668                 return;
8669
8670         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
8671         if (!hdr) {
8672                 nlmsg_free(msg);
8673                 return;
8674         }
8675
8676         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8677             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8678             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8679                 goto nla_put_failure;
8680
8681         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
8682         if (!rekey_attr)
8683                 goto nla_put_failure;
8684
8685         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
8686                     NL80211_REPLAY_CTR_LEN, replay_ctr))
8687                 goto nla_put_failure;
8688
8689         nla_nest_end(msg, rekey_attr);
8690
8691         genlmsg_end(msg, hdr);
8692
8693         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8694                                 nl80211_mlme_mcgrp.id, gfp);
8695         return;
8696
8697  nla_put_failure:
8698         genlmsg_cancel(msg, hdr);
8699         nlmsg_free(msg);
8700 }
8701
8702 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
8703                                     struct net_device *netdev, int index,
8704                                     const u8 *bssid, bool preauth, gfp_t gfp)
8705 {
8706         struct sk_buff *msg;
8707         struct nlattr *attr;
8708         void *hdr;
8709
8710         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8711         if (!msg)
8712                 return;
8713
8714         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
8715         if (!hdr) {
8716                 nlmsg_free(msg);
8717                 return;
8718         }
8719
8720         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8721             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8722                 goto nla_put_failure;
8723
8724         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
8725         if (!attr)
8726                 goto nla_put_failure;
8727
8728         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
8729             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
8730             (preauth &&
8731              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
8732                 goto nla_put_failure;
8733
8734         nla_nest_end(msg, attr);
8735
8736         genlmsg_end(msg, hdr);
8737
8738         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8739                                 nl80211_mlme_mcgrp.id, gfp);
8740         return;
8741
8742  nla_put_failure:
8743         genlmsg_cancel(msg, hdr);
8744         nlmsg_free(msg);
8745 }
8746
8747 void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
8748                               struct net_device *netdev, int freq,
8749                               enum nl80211_channel_type type, gfp_t gfp)
8750 {
8751         struct sk_buff *msg;
8752         void *hdr;
8753
8754         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8755         if (!msg)
8756                 return;
8757
8758         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
8759         if (!hdr) {
8760                 nlmsg_free(msg);
8761                 return;
8762         }
8763
8764         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8765             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
8766             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, type))
8767                 goto nla_put_failure;
8768
8769         genlmsg_end(msg, hdr);
8770
8771         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8772                                 nl80211_mlme_mcgrp.id, gfp);
8773         return;
8774
8775  nla_put_failure:
8776         genlmsg_cancel(msg, hdr);
8777         nlmsg_free(msg);
8778 }
8779
8780 void
8781 nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
8782                             struct net_device *netdev, const u8 *peer,
8783                             u32 num_packets, u32 rate, u32 intvl, gfp_t gfp)
8784 {
8785         struct sk_buff *msg;
8786         struct nlattr *pinfoattr;
8787         void *hdr;
8788
8789         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8790         if (!msg)
8791                 return;
8792
8793         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8794         if (!hdr) {
8795                 nlmsg_free(msg);
8796                 return;
8797         }
8798
8799         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8800             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8801             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
8802                 goto nla_put_failure;
8803
8804         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8805         if (!pinfoattr)
8806                 goto nla_put_failure;
8807
8808         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
8809                 goto nla_put_failure;
8810
8811         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
8812                 goto nla_put_failure;
8813
8814         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
8815                 goto nla_put_failure;
8816
8817         nla_nest_end(msg, pinfoattr);
8818
8819         genlmsg_end(msg, hdr);
8820
8821         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8822                                 nl80211_mlme_mcgrp.id, gfp);
8823         return;
8824
8825  nla_put_failure:
8826         genlmsg_cancel(msg, hdr);
8827         nlmsg_free(msg);
8828 }
8829
8830 void
8831 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
8832                                 struct net_device *netdev, const u8 *peer,
8833                                 u32 num_packets, gfp_t gfp)
8834 {
8835         struct sk_buff *msg;
8836         struct nlattr *pinfoattr;
8837         void *hdr;
8838
8839         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8840         if (!msg)
8841                 return;
8842
8843         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8844         if (!hdr) {
8845                 nlmsg_free(msg);
8846                 return;
8847         }
8848
8849         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8850             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8851             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
8852                 goto nla_put_failure;
8853
8854         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8855         if (!pinfoattr)
8856                 goto nla_put_failure;
8857
8858         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
8859                 goto nla_put_failure;
8860
8861         nla_nest_end(msg, pinfoattr);
8862
8863         genlmsg_end(msg, hdr);
8864
8865         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8866                                 nl80211_mlme_mcgrp.id, gfp);
8867         return;
8868
8869  nla_put_failure:
8870         genlmsg_cancel(msg, hdr);
8871         nlmsg_free(msg);
8872 }
8873
8874 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
8875                            u64 cookie, bool acked, gfp_t gfp)
8876 {
8877         struct wireless_dev *wdev = dev->ieee80211_ptr;
8878         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8879         struct sk_buff *msg;
8880         void *hdr;
8881         int err;
8882
8883         trace_cfg80211_probe_status(dev, addr, cookie, acked);
8884
8885         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8886
8887         if (!msg)
8888                 return;
8889
8890         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
8891         if (!hdr) {
8892                 nlmsg_free(msg);
8893                 return;
8894         }
8895
8896         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8897             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8898             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
8899             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8900             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
8901                 goto nla_put_failure;
8902
8903         err = genlmsg_end(msg, hdr);
8904         if (err < 0) {
8905                 nlmsg_free(msg);
8906                 return;
8907         }
8908
8909         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8910                                 nl80211_mlme_mcgrp.id, gfp);
8911         return;
8912
8913  nla_put_failure:
8914         genlmsg_cancel(msg, hdr);
8915         nlmsg_free(msg);
8916 }
8917 EXPORT_SYMBOL(cfg80211_probe_status);
8918
8919 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
8920                                  const u8 *frame, size_t len,
8921                                  int freq, int sig_dbm, gfp_t gfp)
8922 {
8923         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
8924         struct sk_buff *msg;
8925         void *hdr;
8926         u32 nlportid = ACCESS_ONCE(rdev->ap_beacons_nlportid);
8927
8928         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
8929
8930         if (!nlportid)
8931                 return;
8932
8933         msg = nlmsg_new(len + 100, gfp);
8934         if (!msg)
8935                 return;
8936
8937         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
8938         if (!hdr) {
8939                 nlmsg_free(msg);
8940                 return;
8941         }
8942
8943         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8944             (freq &&
8945              nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
8946             (sig_dbm &&
8947              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
8948             nla_put(msg, NL80211_ATTR_FRAME, len, frame))
8949                 goto nla_put_failure;
8950
8951         genlmsg_end(msg, hdr);
8952
8953         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8954         return;
8955
8956  nla_put_failure:
8957         genlmsg_cancel(msg, hdr);
8958         nlmsg_free(msg);
8959 }
8960 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
8961
8962 static int nl80211_netlink_notify(struct notifier_block * nb,
8963                                   unsigned long state,
8964                                   void *_notify)
8965 {
8966         struct netlink_notify *notify = _notify;
8967         struct cfg80211_registered_device *rdev;
8968         struct wireless_dev *wdev;
8969
8970         if (state != NETLINK_URELEASE)
8971                 return NOTIFY_DONE;
8972
8973         rcu_read_lock();
8974
8975         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8976                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
8977                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
8978                 if (rdev->ap_beacons_nlportid == notify->portid)
8979                         rdev->ap_beacons_nlportid = 0;
8980         }
8981
8982         rcu_read_unlock();
8983
8984         return NOTIFY_DONE;
8985 }
8986
8987 static struct notifier_block nl80211_netlink_notifier = {
8988         .notifier_call = nl80211_netlink_notify,
8989 };
8990
8991 /* initialisation/exit functions */
8992
8993 int nl80211_init(void)
8994 {
8995         int err;
8996
8997         err = genl_register_family_with_ops(&nl80211_fam,
8998                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
8999         if (err)
9000                 return err;
9001
9002         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
9003         if (err)
9004                 goto err_out;
9005
9006         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
9007         if (err)
9008                 goto err_out;
9009
9010         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
9011         if (err)
9012                 goto err_out;
9013
9014         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
9015         if (err)
9016                 goto err_out;
9017
9018 #ifdef CONFIG_NL80211_TESTMODE
9019         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
9020         if (err)
9021                 goto err_out;
9022 #endif
9023
9024         err = netlink_register_notifier(&nl80211_netlink_notifier);
9025         if (err)
9026                 goto err_out;
9027
9028         return 0;
9029  err_out:
9030         genl_unregister_family(&nl80211_fam);
9031         return err;
9032 }
9033
9034 void nl80211_exit(void)
9035 {
9036         netlink_unregister_notifier(&nl80211_netlink_notifier);
9037         genl_unregister_family(&nl80211_fam);
9038 }