net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* multicast groups */
  51 enum nl80211_multicast_groups {
  52         NL80211_MCGRP_CONFIG,
  53         NL80211_MCGRP_SCAN,
  54         NL80211_MCGRP_REGULATORY,
  55         NL80211_MCGRP_MLME,
  56         NL80211_MCGRP_VENDOR,
  57         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  58 };
  59
  60 static const struct genl_multicast_group nl80211_mcgrps[] = {
  61         [NL80211_MCGRP_CONFIG] = { .name = "config", },
  62         [NL80211_MCGRP_SCAN] = { .name = "scan", },
  63         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
  64         [NL80211_MCGRP_MLME] = { .name = "mlme", },
  65         [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
  66 #ifdef CONFIG_NL80211_TESTMODE
  67         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
  68 #endif
  69 };
  70
  71 /* returns ERR_PTR values */
  72 static struct wireless_dev *
  73 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  74 {
  75         struct cfg80211_registered_device *rdev;
  76         struct wireless_dev *result = NULL;
  77         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  78         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  79         u64 wdev_id;
  80         int wiphy_idx = -1;
  81         int ifidx = -1;
  82
  83         ASSERT_RTNL();
  84
  85         if (!have_ifidx && !have_wdev_id)
  86                 return ERR_PTR(-EINVAL);
  87
  88         if (have_ifidx)
  89                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  90         if (have_wdev_id) {
  91                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  92                 wiphy_idx = wdev_id >> 32;
  93         }
  94
  95         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  96                 struct wireless_dev *wdev;
  97
  98                 if (wiphy_net(&rdev->wiphy) != netns)
  99                         continue;
 100
 101                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 102                         continue;
 103
 104                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 105                         if (have_ifidx && wdev->netdev &&
 106                             wdev->netdev->ifindex == ifidx) {
 107                                 result = wdev;
 108                                 break;
 109                         }
 110                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 111                                 result = wdev;
 112                                 break;
 113                         }
 114                 }
 115
 116                 if (result)
 117                         break;
 118         }
 119
 120         if (result)
 121                 return result;
 122         return ERR_PTR(-ENODEV);
 123 }
 124
 125 static struct cfg80211_registered_device *
 126 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 127 {
 128         struct cfg80211_registered_device *rdev = NULL, *tmp;
 129         struct net_device *netdev;
 130
 131         ASSERT_RTNL();
 132
 133         if (!attrs[NL80211_ATTR_WIPHY] &&
 134             !attrs[NL80211_ATTR_IFINDEX] &&
 135             !attrs[NL80211_ATTR_WDEV])
 136                 return ERR_PTR(-EINVAL);
 137
 138         if (attrs[NL80211_ATTR_WIPHY])
 139                 rdev = cfg80211_rdev_by_wiphy_idx(
 140                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 141
 142         if (attrs[NL80211_ATTR_WDEV]) {
 143                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 144                 struct wireless_dev *wdev;
 145                 bool found = false;
 146
 147                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 148                 if (tmp) {
 149                         /* make sure wdev exists */
 150                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 151                                 if (wdev->identifier != (u32)wdev_id)
 152                                         continue;
 153                                 found = true;
 154                                 break;
 155                         }
 156
 157                         if (!found)
 158                                 tmp = NULL;
 159
 160                         if (rdev && tmp != rdev)
 161                                 return ERR_PTR(-EINVAL);
 162                         rdev = tmp;
 163                 }
 164         }
 165
 166         if (attrs[NL80211_ATTR_IFINDEX]) {
 167                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 168                 netdev = __dev_get_by_index(netns, ifindex);
 169                 if (netdev) {
 170                         if (netdev->ieee80211_ptr)
 171                                 tmp = wiphy_to_rdev(
 172                                         netdev->ieee80211_ptr->wiphy);
 173                         else
 174                                 tmp = NULL;
 175
 176                         /* not wireless device -- return error */
 177                         if (!tmp)
 178                                 return ERR_PTR(-EINVAL);
 179
 180                         /* mismatch -- return error */
 181                         if (rdev && tmp != rdev)
 182                                 return ERR_PTR(-EINVAL);
 183
 184                         rdev = tmp;
 185                 }
 186         }
 187
 188         if (!rdev)
 189                 return ERR_PTR(-ENODEV);
 190
 191         if (netns != wiphy_net(&rdev->wiphy))
 192                 return ERR_PTR(-ENODEV);
 193
 194         return rdev;
 195 }
 196
 197 /*
 198  * This function returns a pointer to the driver
 199  * that the genl_info item that is passed refers to.
 200  *
 201  * The result of this can be a PTR_ERR and hence must
 202  * be checked with IS_ERR() for errors.
 203  */
 204 static struct cfg80211_registered_device *
 205 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 206 {
 207         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 208 }
 209
 210 /* policy for the attributes */
 211 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 212         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 213         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 214                                       .len = 20-1 },
 215         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 216
 217         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 218         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 219         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 220         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 222
 223         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 224         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 225         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 226         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 228
 229         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 231         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 232
 233         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 234         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 235
 236         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 237         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 238                                     .len = WLAN_MAX_KEY_LEN },
 239         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 240         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 241         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 242         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 243         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 244
 245         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 246         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 247         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 248                                        .len = IEEE80211_MAX_DATA_LEN },
 249         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 252         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 253         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 255                                                .len = NL80211_MAX_SUPP_RATES },
 256         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 257         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 258         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 259         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 260                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 261         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 262
 263         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 264         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 265
 266         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 267         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 268         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 270                                            .len = NL80211_MAX_SUPP_RATES },
 271         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 272
 273         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 274         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 275
 276         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 277
 278         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 280                               .len = IEEE80211_MAX_DATA_LEN },
 281         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 282         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 283
 284         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 285                                 .len = IEEE80211_MAX_SSID_LEN },
 286         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 287         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 288         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 289         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 290         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 291         [NL80211_ATTR_STA_FLAGS2] = {
 292                 .len = sizeof(struct nl80211_sta_flag_update),
 293         },
 294         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 295         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 296         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 298         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 300         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 301         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 302         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 303                                  .len = WLAN_PMKID_LEN },
 304         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 305         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 306         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 307         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 308                                  .len = IEEE80211_MAX_DATA_LEN },
 309         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 310         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 311         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 312         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 313         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 314         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 315         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 316         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 317         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 318         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 319         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 320         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 321         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 322         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 323         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 324         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 325         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 327         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 328         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 329                                          .len = IEEE80211_MAX_DATA_LEN },
 330         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 333         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 336         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 337         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 339         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 342                                       .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 344         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 346                 .len = NL80211_HT_CAPABILITY_LEN
 347         },
 348         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 349         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 350         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 351         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 352         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 353         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 354         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 355         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 356         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 357         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 358         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 359         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 360         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 361         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 362         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 363         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 364         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 365                 .len = NL80211_VHT_CAPABILITY_LEN,
 366         },
 367         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 368         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 369                                   .len = IEEE80211_MAX_DATA_LEN },
 370         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 371         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 372         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 373         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 374         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 375         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 376         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 377         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 378         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 379         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 380         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 381         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 382         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 383         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 384                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 385         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 386         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 387         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 388         [NL80211_ATTR_IFACE_SOCKET_OWNER] = { .type = NLA_FLAG },
 389         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 390 };
 391
 392 /* policy for the key attributes */
 393 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 394         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 395         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 396         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 397         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 398         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 399         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 400         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 401         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 402 };
 403
 404 /* policy for the key default flags */
 405 static const struct nla_policy
 406 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 407         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 408         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 409 };
 410
 411 /* policy for WoWLAN attributes */
 412 static const struct nla_policy
 413 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 414         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 415         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 416         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 417         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 418         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 419         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 420         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 421         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 422         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 423 };
 424
 425 static const struct nla_policy
 426 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 427         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 428         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 429         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 430         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 431         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 432         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 433         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 434                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 435         },
 436         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 437                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 438         },
 439         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 440         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 441         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 442 };
 443
 444 /* policy for coalesce rule attributes */
 445 static const struct nla_policy
 446 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 447         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 448         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 449         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 450 };
 451
 452 /* policy for GTK rekey offload attributes */
 453 static const struct nla_policy
 454 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 455         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 456         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 457         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 458 };
 459
 460 static const struct nla_policy
 461 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 462         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 463                                                  .len = IEEE80211_MAX_SSID_LEN },
 464         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 465 };
 466
 467 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 468                                      struct netlink_callback *cb,
 469                                      struct cfg80211_registered_device **rdev,
 470                                      struct wireless_dev **wdev)
 471 {
 472         int err;
 473
 474         rtnl_lock();
 475
 476         if (!cb->args[0]) {
 477                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 478                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 479                                   nl80211_policy);
 480                 if (err)
 481                         goto out_unlock;
 482
 483                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 484                                                    nl80211_fam.attrbuf);
 485                 if (IS_ERR(*wdev)) {
 486                         err = PTR_ERR(*wdev);
 487                         goto out_unlock;
 488                 }
 489                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 490                 /* 0 is the first index - add 1 to parse only once */
 491                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 492                 cb->args[1] = (*wdev)->identifier;
 493         } else {
 494                 /* subtract the 1 again here */
 495                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 496                 struct wireless_dev *tmp;
 497
 498                 if (!wiphy) {
 499                         err = -ENODEV;
 500                         goto out_unlock;
 501                 }
 502                 *rdev = wiphy_to_rdev(wiphy);
 503                 *wdev = NULL;
 504
 505                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 506                         if (tmp->identifier == cb->args[1]) {
 507                                 *wdev = tmp;
 508                                 break;
 509                         }
 510                 }
 511
 512                 if (!*wdev) {
 513                         err = -ENODEV;
 514                         goto out_unlock;
 515                 }
 516         }
 517
 518         return 0;
 519  out_unlock:
 520         rtnl_unlock();
 521         return err;
 522 }
 523
 524 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 525 {
 526         rtnl_unlock();
 527 }
 528
 529 /* IE validation */
 530 static bool is_valid_ie_attr(const struct nlattr *attr)
 531 {
 532         const u8 *pos;
 533         int len;
 534
 535         if (!attr)
 536                 return true;
 537
 538         pos = nla_data(attr);
 539         len = nla_len(attr);
 540
 541         while (len) {
 542                 u8 elemlen;
 543
 544                 if (len < 2)
 545                         return false;
 546                 len -= 2;
 547
 548                 elemlen = pos[1];
 549                 if (elemlen > len)
 550                         return false;
 551
 552                 len -= elemlen;
 553                 pos += 2 + elemlen;
 554         }
 555
 556         return true;
 557 }
 558
 559 /* message building helper */
 560 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 561                                    int flags, u8 cmd)
 562 {
 563         /* since there is no private header just add the generic one */
 564         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 565 }
 566
 567 static int nl80211_msg_put_channel(struct sk_buff *msg,
 568                                    struct ieee80211_channel *chan,
 569                                    bool large)
 570 {
 571         /* Some channels must be completely excluded from the
 572          * list to protect old user-space tools from breaking
 573          */
 574         if (!large && chan->flags &
 575             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 576                 return 0;
 577
 578         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 579                         chan->center_freq))
 580                 goto nla_put_failure;
 581
 582         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 583             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 584                 goto nla_put_failure;
 585         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 586                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 587                         goto nla_put_failure;
 588                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 589                         goto nla_put_failure;
 590         }
 591         if (chan->flags & IEEE80211_CHAN_RADAR) {
 592                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 593                         goto nla_put_failure;
 594                 if (large) {
 595                         u32 time;
 596
 597                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 598
 599                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 600                                         chan->dfs_state))
 601                                 goto nla_put_failure;
 602                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 603                                         time))
 604                                 goto nla_put_failure;
 605                         if (nla_put_u32(msg,
 606                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 607                                         chan->dfs_cac_ms))
 608                                 goto nla_put_failure;
 609                 }
 610         }
 611
 612         if (large) {
 613                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 614                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 615                         goto nla_put_failure;
 616                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 617                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 618                         goto nla_put_failure;
 619                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 620                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 621                         goto nla_put_failure;
 622                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 623                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 624                         goto nla_put_failure;
 625                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 626                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 627                         goto nla_put_failure;
 628                 if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
 629                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
 630                         goto nla_put_failure;
 631                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 632                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 633                         goto nla_put_failure;
 634                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 635                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 636                         goto nla_put_failure;
 637         }
 638
 639         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 640                         DBM_TO_MBM(chan->max_power)))
 641                 goto nla_put_failure;
 642
 643         return 0;
 644
 645  nla_put_failure:
 646         return -ENOBUFS;
 647 }
 648
 649 /* netlink command implementations */
 650
 651 struct key_parse {
 652         struct key_params p;
 653         int idx;
 654         int type;
 655         bool def, defmgmt;
 656         bool def_uni, def_multi;
 657 };
 658
 659 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 660 {
 661         struct nlattr *tb[NL80211_KEY_MAX + 1];
 662         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 663                                    nl80211_key_policy);
 664         if (err)
 665                 return err;
 666
 667         k->def = !!tb[NL80211_KEY_DEFAULT];
 668         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 669
 670         if (k->def) {
 671                 k->def_uni = true;
 672                 k->def_multi = true;
 673         }
 674         if (k->defmgmt)
 675                 k->def_multi = true;
 676
 677         if (tb[NL80211_KEY_IDX])
 678                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 679
 680         if (tb[NL80211_KEY_DATA]) {
 681                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 682                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 683         }
 684
 685         if (tb[NL80211_KEY_SEQ]) {
 686                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 687                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 688         }
 689
 690         if (tb[NL80211_KEY_CIPHER])
 691                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 692
 693         if (tb[NL80211_KEY_TYPE]) {
 694                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 695                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 696                         return -EINVAL;
 697         }
 698
 699         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 700                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 701                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 702                                        tb[NL80211_KEY_DEFAULT_TYPES],
 703                                        nl80211_key_default_policy);
 704                 if (err)
 705                         return err;
 706
 707                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 708                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 709         }
 710
 711         return 0;
 712 }
 713
 714 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 715 {
 716         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 717                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 718                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 719         }
 720
 721         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 722                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 723                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 724         }
 725
 726         if (info->attrs[NL80211_ATTR_KEY_IDX])
 727                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 728
 729         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 730                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 731
 732         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 733         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 734
 735         if (k->def) {
 736                 k->def_uni = true;
 737                 k->def_multi = true;
 738         }
 739         if (k->defmgmt)
 740                 k->def_multi = true;
 741
 742         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 743                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 744                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 745                         return -EINVAL;
 746         }
 747
 748         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 749                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 750                 int err = nla_parse_nested(
 751                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 752                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 753                                 nl80211_key_default_policy);
 754                 if (err)
 755                         return err;
 756
 757                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 758                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 759         }
 760
 761         return 0;
 762 }
 763
 764 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 765 {
 766         int err;
 767
 768         memset(k, 0, sizeof(*k));
 769         k->idx = -1;
 770         k->type = -1;
 771
 772         if (info->attrs[NL80211_ATTR_KEY])
 773                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 774         else
 775                 err = nl80211_parse_key_old(info, k);
 776
 777         if (err)
 778                 return err;
 779
 780         if (k->def && k->defmgmt)
 781                 return -EINVAL;
 782
 783         if (k->defmgmt) {
 784                 if (k->def_uni || !k->def_multi)
 785                         return -EINVAL;
 786         }
 787
 788         if (k->idx != -1) {
 789                 if (k->defmgmt) {
 790                         if (k->idx < 4 || k->idx > 5)
 791                                 return -EINVAL;
 792                 } else if (k->def) {
 793                         if (k->idx < 0 || k->idx > 3)
 794                                 return -EINVAL;
 795                 } else {
 796                         if (k->idx < 0 || k->idx > 5)
 797                                 return -EINVAL;
 798                 }
 799         }
 800
 801         return 0;
 802 }
 803
 804 static struct cfg80211_cached_keys *
 805 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 806                        struct nlattr *keys, bool *no_ht)
 807 {
 808         struct key_parse parse;
 809         struct nlattr *key;
 810         struct cfg80211_cached_keys *result;
 811         int rem, err, def = 0;
 812
 813         result = kzalloc(sizeof(*result), GFP_KERNEL);
 814         if (!result)
 815                 return ERR_PTR(-ENOMEM);
 816
 817         result->def = -1;
 818         result->defmgmt = -1;
 819
 820         nla_for_each_nested(key, keys, rem) {
 821                 memset(&parse, 0, sizeof(parse));
 822                 parse.idx = -1;
 823
 824                 err = nl80211_parse_key_new(key, &parse);
 825                 if (err)
 826                         goto error;
 827                 err = -EINVAL;
 828                 if (!parse.p.key)
 829                         goto error;
 830                 if (parse.idx < 0 || parse.idx > 4)
 831                         goto error;
 832                 if (parse.def) {
 833                         if (def)
 834                                 goto error;
 835                         def = 1;
 836                         result->def = parse.idx;
 837                         if (!parse.def_uni || !parse.def_multi)
 838                                 goto error;
 839                 } else if (parse.defmgmt)
 840                         goto error;
 841                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 842                                                      parse.idx, false, NULL);
 843                 if (err)
 844                         goto error;
 845                 result->params[parse.idx].cipher = parse.p.cipher;
 846                 result->params[parse.idx].key_len = parse.p.key_len;
 847                 result->params[parse.idx].key = result->data[parse.idx];
 848                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 849
 850                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 851                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 852                         if (no_ht)
 853                                 *no_ht = true;
 854                 }
 855         }
 856
 857         return result;
 858  error:
 859         kfree(result);
 860         return ERR_PTR(err);
 861 }
 862
 863 static int nl80211_key_allowed(struct wireless_dev *wdev)
 864 {
 865         ASSERT_WDEV_LOCK(wdev);
 866
 867         switch (wdev->iftype) {
 868         case NL80211_IFTYPE_AP:
 869         case NL80211_IFTYPE_AP_VLAN:
 870         case NL80211_IFTYPE_P2P_GO:
 871         case NL80211_IFTYPE_MESH_POINT:
 872                 break;
 873         case NL80211_IFTYPE_ADHOC:
 874         case NL80211_IFTYPE_STATION:
 875         case NL80211_IFTYPE_P2P_CLIENT:
 876                 if (!wdev->current_bss)
 877                         return -ENOLINK;
 878                 break;
 879         default:
 880                 return -EINVAL;
 881         }
 882
 883         return 0;
 884 }
 885
 886 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 887                                                         struct nlattr *tb)
 888 {
 889         struct ieee80211_channel *chan;
 890
 891         if (tb == NULL)
 892                 return NULL;
 893         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 894         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 895                 return NULL;
 896         return chan;
 897 }
 898
 899 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 900 {
 901         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 902         int i;
 903
 904         if (!nl_modes)
 905                 goto nla_put_failure;
 906
 907         i = 0;
 908         while (ifmodes) {
 909                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 910                         goto nla_put_failure;
 911                 ifmodes >>= 1;
 912                 i++;
 913         }
 914
 915         nla_nest_end(msg, nl_modes);
 916         return 0;
 917
 918 nla_put_failure:
 919         return -ENOBUFS;
 920 }
 921
 922 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 923                                           struct sk_buff *msg,
 924                                           bool large)
 925 {
 926         struct nlattr *nl_combis;
 927         int i, j;
 928
 929         nl_combis = nla_nest_start(msg,
 930                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 931         if (!nl_combis)
 932                 goto nla_put_failure;
 933
 934         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 935                 const struct ieee80211_iface_combination *c;
 936                 struct nlattr *nl_combi, *nl_limits;
 937
 938                 c = &wiphy->iface_combinations[i];
 939
 940                 nl_combi = nla_nest_start(msg, i + 1);
 941                 if (!nl_combi)
 942                         goto nla_put_failure;
 943
 944                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 945                 if (!nl_limits)
 946                         goto nla_put_failure;
 947
 948                 for (j = 0; j < c->n_limits; j++) {
 949                         struct nlattr *nl_limit;
 950
 951                         nl_limit = nla_nest_start(msg, j + 1);
 952                         if (!nl_limit)
 953                                 goto nla_put_failure;
 954                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 955                                         c->limits[j].max))
 956                                 goto nla_put_failure;
 957                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 958                                                 c->limits[j].types))
 959                                 goto nla_put_failure;
 960                         nla_nest_end(msg, nl_limit);
 961                 }
 962
 963                 nla_nest_end(msg, nl_limits);
 964
 965                 if (c->beacon_int_infra_match &&
 966                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 967                         goto nla_put_failure;
 968                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 969                                 c->num_different_channels) ||
 970                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 971                                 c->max_interfaces))
 972                         goto nla_put_failure;
 973                 if (large &&
 974                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 975                                 c->radar_detect_widths) ||
 976                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
 977                                 c->radar_detect_regions)))
 978                         goto nla_put_failure;
 979
 980                 nla_nest_end(msg, nl_combi);
 981         }
 982
 983         nla_nest_end(msg, nl_combis);
 984
 985         return 0;
 986 nla_put_failure:
 987         return -ENOBUFS;
 988 }
 989
 990 #ifdef CONFIG_PM
 991 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 992                                         struct sk_buff *msg)
 993 {
 994         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 995         struct nlattr *nl_tcp;
 996
 997         if (!tcp)
 998                 return 0;
 999
1000         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1001         if (!nl_tcp)
1002                 return -ENOBUFS;
1003
1004         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1005                         tcp->data_payload_max))
1006                 return -ENOBUFS;
1007
1008         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1009                         tcp->data_payload_max))
1010                 return -ENOBUFS;
1011
1012         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1013                 return -ENOBUFS;
1014
1015         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1016                                 sizeof(*tcp->tok), tcp->tok))
1017                 return -ENOBUFS;
1018
1019         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1020                         tcp->data_interval_max))
1021                 return -ENOBUFS;
1022
1023         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1024                         tcp->wake_payload_max))
1025                 return -ENOBUFS;
1026
1027         nla_nest_end(msg, nl_tcp);
1028         return 0;
1029 }
1030
1031 static int nl80211_send_wowlan(struct sk_buff *msg,
1032                                struct cfg80211_registered_device *rdev,
1033                                bool large)
1034 {
1035         struct nlattr *nl_wowlan;
1036
1037         if (!rdev->wiphy.wowlan)
1038                 return 0;
1039
1040         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1041         if (!nl_wowlan)
1042                 return -ENOBUFS;
1043
1044         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1045              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1046             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1047              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1048             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1049              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1050             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1051              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1052             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1053              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1054             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1055              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1056             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1057              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1058             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1059              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1060                 return -ENOBUFS;
1061
1062         if (rdev->wiphy.wowlan->n_patterns) {
1063                 struct nl80211_pattern_support pat = {
1064                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1065                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1066                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1067                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1068                 };
1069
1070                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1071                             sizeof(pat), &pat))
1072                         return -ENOBUFS;
1073         }
1074
1075         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1076                 return -ENOBUFS;
1077
1078         nla_nest_end(msg, nl_wowlan);
1079
1080         return 0;
1081 }
1082 #endif
1083
1084 static int nl80211_send_coalesce(struct sk_buff *msg,
1085                                  struct cfg80211_registered_device *rdev)
1086 {
1087         struct nl80211_coalesce_rule_support rule;
1088
1089         if (!rdev->wiphy.coalesce)
1090                 return 0;
1091
1092         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1093         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1094         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1095         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1096         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1097         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1098
1099         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1100                 return -ENOBUFS;
1101
1102         return 0;
1103 }
1104
1105 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1106                                       struct ieee80211_supported_band *sband)
1107 {
1108         struct nlattr *nl_rates, *nl_rate;
1109         struct ieee80211_rate *rate;
1110         int i;
1111
1112         /* add HT info */
1113         if (sband->ht_cap.ht_supported &&
1114             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1115                      sizeof(sband->ht_cap.mcs),
1116                      &sband->ht_cap.mcs) ||
1117              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1118                          sband->ht_cap.cap) ||
1119              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1120                         sband->ht_cap.ampdu_factor) ||
1121              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1122                         sband->ht_cap.ampdu_density)))
1123                 return -ENOBUFS;
1124
1125         /* add VHT info */
1126         if (sband->vht_cap.vht_supported &&
1127             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1128                      sizeof(sband->vht_cap.vht_mcs),
1129                      &sband->vht_cap.vht_mcs) ||
1130              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1131                          sband->vht_cap.cap)))
1132                 return -ENOBUFS;
1133
1134         /* add bitrates */
1135         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1136         if (!nl_rates)
1137                 return -ENOBUFS;
1138
1139         for (i = 0; i < sband->n_bitrates; i++) {
1140                 nl_rate = nla_nest_start(msg, i);
1141                 if (!nl_rate)
1142                         return -ENOBUFS;
1143
1144                 rate = &sband->bitrates[i];
1145                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1146                                 rate->bitrate))
1147                         return -ENOBUFS;
1148                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1149                     nla_put_flag(msg,
1150                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1151                         return -ENOBUFS;
1152
1153                 nla_nest_end(msg, nl_rate);
1154         }
1155
1156         nla_nest_end(msg, nl_rates);
1157
1158         return 0;
1159 }
1160
1161 static int
1162 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1163                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1164 {
1165         u16 stypes;
1166         struct nlattr *nl_ftypes, *nl_ifs;
1167         enum nl80211_iftype ift;
1168         int i;
1169
1170         if (!mgmt_stypes)
1171                 return 0;
1172
1173         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1174         if (!nl_ifs)
1175                 return -ENOBUFS;
1176
1177         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1178                 nl_ftypes = nla_nest_start(msg, ift);
1179                 if (!nl_ftypes)
1180                         return -ENOBUFS;
1181                 i = 0;
1182                 stypes = mgmt_stypes[ift].tx;
1183                 while (stypes) {
1184                         if ((stypes & 1) &&
1185                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1186                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1187                                 return -ENOBUFS;
1188                         stypes >>= 1;
1189                         i++;
1190                 }
1191                 nla_nest_end(msg, nl_ftypes);
1192         }
1193
1194         nla_nest_end(msg, nl_ifs);
1195
1196         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1197         if (!nl_ifs)
1198                 return -ENOBUFS;
1199
1200         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1201                 nl_ftypes = nla_nest_start(msg, ift);
1202                 if (!nl_ftypes)
1203                         return -ENOBUFS;
1204                 i = 0;
1205                 stypes = mgmt_stypes[ift].rx;
1206                 while (stypes) {
1207                         if ((stypes & 1) &&
1208                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1209                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1210                                 return -ENOBUFS;
1211                         stypes >>= 1;
1212                         i++;
1213                 }
1214                 nla_nest_end(msg, nl_ftypes);
1215         }
1216         nla_nest_end(msg, nl_ifs);
1217
1218         return 0;
1219 }
1220
1221 struct nl80211_dump_wiphy_state {
1222         s64 filter_wiphy;
1223         long start;
1224         long split_start, band_start, chan_start;
1225         bool split;
1226 };
1227
1228 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1229                               enum nl80211_commands cmd,
1230                               struct sk_buff *msg, u32 portid, u32 seq,
1231                               int flags, struct nl80211_dump_wiphy_state *state)
1232 {
1233         void *hdr;
1234         struct nlattr *nl_bands, *nl_band;
1235         struct nlattr *nl_freqs, *nl_freq;
1236         struct nlattr *nl_cmds;
1237         enum ieee80211_band band;
1238         struct ieee80211_channel *chan;
1239         int i;
1240         const struct ieee80211_txrx_stypes *mgmt_stypes =
1241                                 rdev->wiphy.mgmt_stypes;
1242         u32 features;
1243
1244         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1245         if (!hdr)
1246                 return -ENOBUFS;
1247
1248         if (WARN_ON(!state))
1249                 return -EINVAL;
1250
1251         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1252             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1253                            wiphy_name(&rdev->wiphy)) ||
1254             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1255                         cfg80211_rdev_list_generation))
1256                 goto nla_put_failure;
1257
1258         if (cmd != NL80211_CMD_NEW_WIPHY)
1259                 goto finish;
1260
1261         switch (state->split_start) {
1262         case 0:
1263                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1264                                rdev->wiphy.retry_short) ||
1265                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1266                                rdev->wiphy.retry_long) ||
1267                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1268                                 rdev->wiphy.frag_threshold) ||
1269                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1270                                 rdev->wiphy.rts_threshold) ||
1271                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1272                                rdev->wiphy.coverage_class) ||
1273                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1274                                rdev->wiphy.max_scan_ssids) ||
1275                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1276                                rdev->wiphy.max_sched_scan_ssids) ||
1277                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1278                                 rdev->wiphy.max_scan_ie_len) ||
1279                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1280                                 rdev->wiphy.max_sched_scan_ie_len) ||
1281                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1282                                rdev->wiphy.max_match_sets))
1283                         goto nla_put_failure;
1284
1285                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1286                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1287                         goto nla_put_failure;
1288                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1289                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1290                         goto nla_put_failure;
1291                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1292                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1293                         goto nla_put_failure;
1294                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1295                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1296                         goto nla_put_failure;
1297                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1298                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1299                         goto nla_put_failure;
1300                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1301                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1302                         goto nla_put_failure;
1303                 state->split_start++;
1304                 if (state->split)
1305                         break;
1306         case 1:
1307                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1308                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1309                             rdev->wiphy.cipher_suites))
1310                         goto nla_put_failure;
1311
1312                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1313                                rdev->wiphy.max_num_pmkids))
1314                         goto nla_put_failure;
1315
1316                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1317                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1318                         goto nla_put_failure;
1319
1320                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1321                                 rdev->wiphy.available_antennas_tx) ||
1322                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1323                                 rdev->wiphy.available_antennas_rx))
1324                         goto nla_put_failure;
1325
1326                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1327                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1328                                 rdev->wiphy.probe_resp_offload))
1329                         goto nla_put_failure;
1330
1331                 if ((rdev->wiphy.available_antennas_tx ||
1332                      rdev->wiphy.available_antennas_rx) &&
1333                     rdev->ops->get_antenna) {
1334                         u32 tx_ant = 0, rx_ant = 0;
1335                         int res;
1336                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1337                         if (!res) {
1338                                 if (nla_put_u32(msg,
1339                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1340                                                 tx_ant) ||
1341                                     nla_put_u32(msg,
1342                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1343                                                 rx_ant))
1344                                         goto nla_put_failure;
1345                         }
1346                 }
1347
1348                 state->split_start++;
1349                 if (state->split)
1350                         break;
1351         case 2:
1352                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1353                                         rdev->wiphy.interface_modes))
1354                                 goto nla_put_failure;
1355                 state->split_start++;
1356                 if (state->split)
1357                         break;
1358         case 3:
1359                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1360                 if (!nl_bands)
1361                         goto nla_put_failure;
1362
1363                 for (band = state->band_start;
1364                      band < IEEE80211_NUM_BANDS; band++) {
1365                         struct ieee80211_supported_band *sband;
1366
1367                         sband = rdev->wiphy.bands[band];
1368
1369                         if (!sband)
1370                                 continue;
1371
1372                         nl_band = nla_nest_start(msg, band);
1373                         if (!nl_band)
1374                                 goto nla_put_failure;
1375
1376                         switch (state->chan_start) {
1377                         case 0:
1378                                 if (nl80211_send_band_rateinfo(msg, sband))
1379                                         goto nla_put_failure;
1380                                 state->chan_start++;
1381                                 if (state->split)
1382                                         break;
1383                         default:
1384                                 /* add frequencies */
1385                                 nl_freqs = nla_nest_start(
1386                                         msg, NL80211_BAND_ATTR_FREQS);
1387                                 if (!nl_freqs)
1388                                         goto nla_put_failure;
1389
1390                                 for (i = state->chan_start - 1;
1391                                      i < sband->n_channels;
1392                                      i++) {
1393                                         nl_freq = nla_nest_start(msg, i);
1394                                         if (!nl_freq)
1395                                                 goto nla_put_failure;
1396
1397                                         chan = &sband->channels[i];
1398
1399                                         if (nl80211_msg_put_channel(
1400                                                         msg, chan,
1401                                                         state->split))
1402                                                 goto nla_put_failure;
1403
1404                                         nla_nest_end(msg, nl_freq);
1405                                         if (state->split)
1406                                                 break;
1407                                 }
1408                                 if (i < sband->n_channels)
1409                                         state->chan_start = i + 2;
1410                                 else
1411                                         state->chan_start = 0;
1412                                 nla_nest_end(msg, nl_freqs);
1413                         }
1414
1415                         nla_nest_end(msg, nl_band);
1416
1417                         if (state->split) {
1418                                 /* start again here */
1419                                 if (state->chan_start)
1420                                         band--;
1421                                 break;
1422                         }
1423                 }
1424                 nla_nest_end(msg, nl_bands);
1425
1426                 if (band < IEEE80211_NUM_BANDS)
1427                         state->band_start = band + 1;
1428                 else
1429                         state->band_start = 0;
1430
1431                 /* if bands & channels are done, continue outside */
1432                 if (state->band_start == 0 && state->chan_start == 0)
1433                         state->split_start++;
1434                 if (state->split)
1435                         break;
1436         case 4:
1437                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1438                 if (!nl_cmds)
1439                         goto nla_put_failure;
1440
1441                 i = 0;
1442 #define CMD(op, n)                                                      \
1443                  do {                                                   \
1444                         if (rdev->ops->op) {                            \
1445                                 i++;                                    \
1446                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1447                                         goto nla_put_failure;           \
1448                         }                                               \
1449                 } while (0)
1450
1451                 CMD(add_virtual_intf, NEW_INTERFACE);
1452                 CMD(change_virtual_intf, SET_INTERFACE);
1453                 CMD(add_key, NEW_KEY);
1454                 CMD(start_ap, START_AP);
1455                 CMD(add_station, NEW_STATION);
1456                 CMD(add_mpath, NEW_MPATH);
1457                 CMD(update_mesh_config, SET_MESH_CONFIG);
1458                 CMD(change_bss, SET_BSS);
1459                 CMD(auth, AUTHENTICATE);
1460                 CMD(assoc, ASSOCIATE);
1461                 CMD(deauth, DEAUTHENTICATE);
1462                 CMD(disassoc, DISASSOCIATE);
1463                 CMD(join_ibss, JOIN_IBSS);
1464                 CMD(join_mesh, JOIN_MESH);
1465                 CMD(set_pmksa, SET_PMKSA);
1466                 CMD(del_pmksa, DEL_PMKSA);
1467                 CMD(flush_pmksa, FLUSH_PMKSA);
1468                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1469                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1470                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1471                 CMD(mgmt_tx, FRAME);
1472                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1473                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1474                         i++;
1475                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1476                                 goto nla_put_failure;
1477                 }
1478                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1479                     rdev->ops->join_mesh) {
1480                         i++;
1481                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1482                                 goto nla_put_failure;
1483                 }
1484                 CMD(set_wds_peer, SET_WDS_PEER);
1485                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1486                         CMD(tdls_mgmt, TDLS_MGMT);
1487                         CMD(tdls_oper, TDLS_OPER);
1488                 }
1489                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1490                         CMD(sched_scan_start, START_SCHED_SCAN);
1491                 CMD(probe_client, PROBE_CLIENT);
1492                 CMD(set_noack_map, SET_NOACK_MAP);
1493                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1494                         i++;
1495                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1496                                 goto nla_put_failure;
1497                 }
1498                 CMD(start_p2p_device, START_P2P_DEVICE);
1499                 CMD(set_mcast_rate, SET_MCAST_RATE);
1500                 if (state->split) {
1501                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1502                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1503                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1504                                 CMD(channel_switch, CHANNEL_SWITCH);
1505                 }
1506                 CMD(set_qos_map, SET_QOS_MAP);
1507
1508 #ifdef CONFIG_NL80211_TESTMODE
1509                 CMD(testmode_cmd, TESTMODE);
1510 #endif
1511
1512 #undef CMD
1513
1514                 if (rdev->ops->connect || rdev->ops->auth) {
1515                         i++;
1516                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1517                                 goto nla_put_failure;
1518                 }
1519
1520                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1521                         i++;
1522                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1523                                 goto nla_put_failure;
1524                 }
1525
1526                 nla_nest_end(msg, nl_cmds);
1527                 state->split_start++;
1528                 if (state->split)
1529                         break;
1530         case 5:
1531                 if (rdev->ops->remain_on_channel &&
1532                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1533                     nla_put_u32(msg,
1534                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1535                                 rdev->wiphy.max_remain_on_channel_duration))
1536                         goto nla_put_failure;
1537
1538                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1539                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1540                         goto nla_put_failure;
1541
1542                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1543                         goto nla_put_failure;
1544                 state->split_start++;
1545                 if (state->split)
1546                         break;
1547         case 6:
1548 #ifdef CONFIG_PM
1549                 if (nl80211_send_wowlan(msg, rdev, state->split))
1550                         goto nla_put_failure;
1551                 state->split_start++;
1552                 if (state->split)
1553                         break;
1554 #else
1555                 state->split_start++;
1556 #endif
1557         case 7:
1558                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1559                                         rdev->wiphy.software_iftypes))
1560                         goto nla_put_failure;
1561
1562                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1563                                                    state->split))
1564                         goto nla_put_failure;
1565
1566                 state->split_start++;
1567                 if (state->split)
1568                         break;
1569         case 8:
1570                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1571                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1572                                 rdev->wiphy.ap_sme_capa))
1573                         goto nla_put_failure;
1574
1575                 features = rdev->wiphy.features;
1576                 /*
1577                  * We can only add the per-channel limit information if the
1578                  * dump is split, otherwise it makes it too big. Therefore
1579                  * only advertise it in that case.
1580                  */
1581                 if (state->split)
1582                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1583                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1584                         goto nla_put_failure;
1585
1586                 if (rdev->wiphy.ht_capa_mod_mask &&
1587                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1588                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1589                             rdev->wiphy.ht_capa_mod_mask))
1590                         goto nla_put_failure;
1591
1592                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1593                     rdev->wiphy.max_acl_mac_addrs &&
1594                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1595                                 rdev->wiphy.max_acl_mac_addrs))
1596                         goto nla_put_failure;
1597
1598                 /*
1599                  * Any information below this point is only available to
1600                  * applications that can deal with it being split. This
1601                  * helps ensure that newly added capabilities don't break
1602                  * older tools by overrunning their buffers.
1603                  *
1604                  * We still increment split_start so that in the split
1605                  * case we'll continue with more data in the next round,
1606                  * but break unconditionally so unsplit data stops here.
1607                  */
1608                 state->split_start++;
1609                 break;
1610         case 9:
1611                 if (rdev->wiphy.extended_capabilities &&
1612                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1613                              rdev->wiphy.extended_capabilities_len,
1614                              rdev->wiphy.extended_capabilities) ||
1615                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1616                              rdev->wiphy.extended_capabilities_len,
1617                              rdev->wiphy.extended_capabilities_mask)))
1618                         goto nla_put_failure;
1619
1620                 if (rdev->wiphy.vht_capa_mod_mask &&
1621                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1622                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1623                             rdev->wiphy.vht_capa_mod_mask))
1624                         goto nla_put_failure;
1625
1626                 state->split_start++;
1627                 break;
1628         case 10:
1629                 if (nl80211_send_coalesce(msg, rdev))
1630                         goto nla_put_failure;
1631
1632                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1633                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1634                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1635                         goto nla_put_failure;
1636
1637                 if (rdev->wiphy.max_ap_assoc_sta &&
1638                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1639                                 rdev->wiphy.max_ap_assoc_sta))
1640                         goto nla_put_failure;
1641
1642                 state->split_start++;
1643                 break;
1644         case 11:
1645                 if (rdev->wiphy.n_vendor_commands) {
1646                         const struct nl80211_vendor_cmd_info *info;
1647                         struct nlattr *nested;
1648
1649                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1650                         if (!nested)
1651                                 goto nla_put_failure;
1652
1653                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1654                                 info = &rdev->wiphy.vendor_commands[i].info;
1655                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1656                                         goto nla_put_failure;
1657                         }
1658                         nla_nest_end(msg, nested);
1659                 }
1660
1661                 if (rdev->wiphy.n_vendor_events) {
1662                         const struct nl80211_vendor_cmd_info *info;
1663                         struct nlattr *nested;
1664
1665                         nested = nla_nest_start(msg,
1666                                                 NL80211_ATTR_VENDOR_EVENTS);
1667                         if (!nested)
1668                                 goto nla_put_failure;
1669
1670                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1671                                 info = &rdev->wiphy.vendor_events[i];
1672                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1673                                         goto nla_put_failure;
1674                         }
1675                         nla_nest_end(msg, nested);
1676                 }
1677                 state->split_start++;
1678                 break;
1679         case 12:
1680                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1681                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1682                                rdev->wiphy.max_num_csa_counters))
1683                         goto nla_put_failure;
1684
1685                 /* done */
1686                 state->split_start = 0;
1687                 break;
1688         }
1689  finish:
1690         return genlmsg_end(msg, hdr);
1691
1692  nla_put_failure:
1693         genlmsg_cancel(msg, hdr);
1694         return -EMSGSIZE;
1695 }
1696
1697 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1698                                     struct netlink_callback *cb,
1699                                     struct nl80211_dump_wiphy_state *state)
1700 {
1701         struct nlattr **tb = nl80211_fam.attrbuf;
1702         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1703                               tb, nl80211_fam.maxattr, nl80211_policy);
1704         /* ignore parse errors for backward compatibility */
1705         if (ret)
1706                 return 0;
1707
1708         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1709         if (tb[NL80211_ATTR_WIPHY])
1710                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1711         if (tb[NL80211_ATTR_WDEV])
1712                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1713         if (tb[NL80211_ATTR_IFINDEX]) {
1714                 struct net_device *netdev;
1715                 struct cfg80211_registered_device *rdev;
1716                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1717
1718                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1719                 if (!netdev)
1720                         return -ENODEV;
1721                 if (netdev->ieee80211_ptr) {
1722                         rdev = wiphy_to_rdev(
1723                                 netdev->ieee80211_ptr->wiphy);
1724                         state->filter_wiphy = rdev->wiphy_idx;
1725                 }
1726         }
1727
1728         return 0;
1729 }
1730
1731 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1732 {
1733         int idx = 0, ret;
1734         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1735         struct cfg80211_registered_device *rdev;
1736
1737         rtnl_lock();
1738         if (!state) {
1739                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1740                 if (!state) {
1741                         rtnl_unlock();
1742                         return -ENOMEM;
1743                 }
1744                 state->filter_wiphy = -1;
1745                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1746                 if (ret) {
1747                         kfree(state);
1748                         rtnl_unlock();
1749                         return ret;
1750                 }
1751                 cb->args[0] = (long)state;
1752         }
1753
1754         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1755                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1756                         continue;
1757                 if (++idx <= state->start)
1758                         continue;
1759                 if (state->filter_wiphy != -1 &&
1760                     state->filter_wiphy != rdev->wiphy_idx)
1761                         continue;
1762                 /* attempt to fit multiple wiphy data chunks into the skb */
1763                 do {
1764                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1765                                                  skb,
1766                                                  NETLINK_CB(cb->skb).portid,
1767                                                  cb->nlh->nlmsg_seq,
1768                                                  NLM_F_MULTI, state);
1769                         if (ret < 0) {
1770                                 /*
1771                                  * If sending the wiphy data didn't fit (ENOBUFS
1772                                  * or EMSGSIZE returned), this SKB is still
1773                                  * empty (so it's not too big because another
1774                                  * wiphy dataset is already in the skb) and
1775                                  * we've not tried to adjust the dump allocation
1776                                  * yet ... then adjust the alloc size to be
1777                                  * bigger, and return 1 but with the empty skb.
1778                                  * This results in an empty message being RX'ed
1779                                  * in userspace, but that is ignored.
1780                                  *
1781                                  * We can then retry with the larger buffer.
1782                                  */
1783                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1784                                     !skb->len && !state->split &&
1785                                     cb->min_dump_alloc < 4096) {
1786                                         cb->min_dump_alloc = 4096;
1787                                         state->split_start = 0;
1788                                         rtnl_unlock();
1789                                         return 1;
1790                                 }
1791                                 idx--;
1792                                 break;
1793                         }
1794                 } while (state->split_start > 0);
1795                 break;
1796         }
1797         rtnl_unlock();
1798
1799         state->start = idx;
1800
1801         return skb->len;
1802 }
1803
1804 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1805 {
1806         kfree((void *)cb->args[0]);
1807         return 0;
1808 }
1809
1810 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1811 {
1812         struct sk_buff *msg;
1813         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1814         struct nl80211_dump_wiphy_state state = {};
1815
1816         msg = nlmsg_new(4096, GFP_KERNEL);
1817         if (!msg)
1818                 return -ENOMEM;
1819
1820         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1821                                info->snd_portid, info->snd_seq, 0,
1822                                &state) < 0) {
1823                 nlmsg_free(msg);
1824                 return -ENOBUFS;
1825         }
1826
1827         return genlmsg_reply(msg, info);
1828 }
1829
1830 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1831         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1832         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1833         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1834         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1835         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1836 };
1837
1838 static int parse_txq_params(struct nlattr *tb[],
1839                             struct ieee80211_txq_params *txq_params)
1840 {
1841         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1842             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1843             !tb[NL80211_TXQ_ATTR_AIFS])
1844                 return -EINVAL;
1845
1846         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1847         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1848         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1849         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1850         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1851
1852         if (txq_params->ac >= NL80211_NUM_ACS)
1853                 return -EINVAL;
1854
1855         return 0;
1856 }
1857
1858 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1859 {
1860         /*
1861          * You can only set the channel explicitly for WDS interfaces,
1862          * all others have their channel managed via their respective
1863          * "establish a connection" command (connect, join, ...)
1864          *
1865          * For AP/GO and mesh mode, the channel can be set with the
1866          * channel userspace API, but is only stored and passed to the
1867          * low-level driver when the AP starts or the mesh is joined.
1868          * This is for backward compatibility, userspace can also give
1869          * the channel in the start-ap or join-mesh commands instead.
1870          *
1871          * Monitors are special as they are normally slaved to
1872          * whatever else is going on, so they have their own special
1873          * operation to set the monitor channel if possible.
1874          */
1875         return !wdev ||
1876                 wdev->iftype == NL80211_IFTYPE_AP ||
1877                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1878                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1879                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1880 }
1881
1882 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1883                                  struct genl_info *info,
1884                                  struct cfg80211_chan_def *chandef)
1885 {
1886         u32 control_freq;
1887
1888         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1889                 return -EINVAL;
1890
1891         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1892
1893         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1894         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1895         chandef->center_freq1 = control_freq;
1896         chandef->center_freq2 = 0;
1897
1898         /* Primary channel not allowed */
1899         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1900                 return -EINVAL;
1901
1902         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1903                 enum nl80211_channel_type chantype;
1904
1905                 chantype = nla_get_u32(
1906                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1907
1908                 switch (chantype) {
1909                 case NL80211_CHAN_NO_HT:
1910                 case NL80211_CHAN_HT20:
1911                 case NL80211_CHAN_HT40PLUS:
1912                 case NL80211_CHAN_HT40MINUS:
1913                         cfg80211_chandef_create(chandef, chandef->chan,
1914                                                 chantype);
1915                         break;
1916                 default:
1917                         return -EINVAL;
1918                 }
1919         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1920                 chandef->width =
1921                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1922                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1923                         chandef->center_freq1 =
1924                                 nla_get_u32(
1925                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1926                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1927                         chandef->center_freq2 =
1928                                 nla_get_u32(
1929                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1930         }
1931
1932         if (!cfg80211_chandef_valid(chandef))
1933                 return -EINVAL;
1934
1935         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1936                                      IEEE80211_CHAN_DISABLED))
1937                 return -EINVAL;
1938
1939         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1940              chandef->width == NL80211_CHAN_WIDTH_10) &&
1941             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1942                 return -EINVAL;
1943
1944         return 0;
1945 }
1946
1947 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1948                                  struct net_device *dev,
1949                                  struct genl_info *info)
1950 {
1951         struct cfg80211_chan_def chandef;
1952         int result;
1953         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1954         struct wireless_dev *wdev = NULL;
1955
1956         if (dev)
1957                 wdev = dev->ieee80211_ptr;
1958         if (!nl80211_can_set_dev_channel(wdev))
1959                 return -EOPNOTSUPP;
1960         if (wdev)
1961                 iftype = wdev->iftype;
1962
1963         result = nl80211_parse_chandef(rdev, info, &chandef);
1964         if (result)
1965                 return result;
1966
1967         switch (iftype) {
1968         case NL80211_IFTYPE_AP:
1969         case NL80211_IFTYPE_P2P_GO:
1970                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
1971                         result = -EINVAL;
1972                         break;
1973                 }
1974                 if (wdev->beacon_interval) {
1975                         if (!dev || !rdev->ops->set_ap_chanwidth ||
1976                             !(rdev->wiphy.features &
1977                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
1978                                 result = -EBUSY;
1979                                 break;
1980                         }
1981
1982                         /* Only allow dynamic channel width changes */
1983                         if (chandef.chan != wdev->preset_chandef.chan) {
1984                                 result = -EBUSY;
1985                                 break;
1986                         }
1987                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
1988                         if (result)
1989                                 break;
1990                 }
1991                 wdev->preset_chandef = chandef;
1992                 result = 0;
1993                 break;
1994         case NL80211_IFTYPE_MESH_POINT:
1995                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1996                 break;
1997         case NL80211_IFTYPE_MONITOR:
1998                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1999                 break;
2000         default:
2001                 result = -EINVAL;
2002         }
2003
2004         return result;
2005 }
2006
2007 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2008 {
2009         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2010         struct net_device *netdev = info->user_ptr[1];
2011
2012         return __nl80211_set_channel(rdev, netdev, info);
2013 }
2014
2015 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2016 {
2017         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2018         struct net_device *dev = info->user_ptr[1];
2019         struct wireless_dev *wdev = dev->ieee80211_ptr;
2020         const u8 *bssid;
2021
2022         if (!info->attrs[NL80211_ATTR_MAC])
2023                 return -EINVAL;
2024
2025         if (netif_running(dev))
2026                 return -EBUSY;
2027
2028         if (!rdev->ops->set_wds_peer)
2029                 return -EOPNOTSUPP;
2030
2031         if (wdev->iftype != NL80211_IFTYPE_WDS)
2032                 return -EOPNOTSUPP;
2033
2034         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2035         return rdev_set_wds_peer(rdev, dev, bssid);
2036 }
2037
2038
2039 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2040 {
2041         struct cfg80211_registered_device *rdev;
2042         struct net_device *netdev = NULL;
2043         struct wireless_dev *wdev;
2044         int result = 0, rem_txq_params = 0;
2045         struct nlattr *nl_txq_params;
2046         u32 changed;
2047         u8 retry_short = 0, retry_long = 0;
2048         u32 frag_threshold = 0, rts_threshold = 0;
2049         u8 coverage_class = 0;
2050
2051         ASSERT_RTNL();
2052
2053         /*
2054          * Try to find the wiphy and netdev. Normally this
2055          * function shouldn't need the netdev, but this is
2056          * done for backward compatibility -- previously
2057          * setting the channel was done per wiphy, but now
2058          * it is per netdev. Previous userland like hostapd
2059          * also passed a netdev to set_wiphy, so that it is
2060          * possible to let that go to the right netdev!
2061          */
2062
2063         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2064                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2065
2066                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2067                 if (netdev && netdev->ieee80211_ptr)
2068                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2069                 else
2070                         netdev = NULL;
2071         }
2072
2073         if (!netdev) {
2074                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2075                                                   info->attrs);
2076                 if (IS_ERR(rdev))
2077                         return PTR_ERR(rdev);
2078                 wdev = NULL;
2079                 netdev = NULL;
2080                 result = 0;
2081         } else
2082                 wdev = netdev->ieee80211_ptr;
2083
2084         /*
2085          * end workaround code, by now the rdev is available
2086          * and locked, and wdev may or may not be NULL.
2087          */
2088
2089         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2090                 result = cfg80211_dev_rename(
2091                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2092
2093         if (result)
2094                 return result;
2095
2096         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2097                 struct ieee80211_txq_params txq_params;
2098                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2099
2100                 if (!rdev->ops->set_txq_params)
2101                         return -EOPNOTSUPP;
2102
2103                 if (!netdev)
2104                         return -EINVAL;
2105
2106                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2107                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2108                         return -EINVAL;
2109
2110                 if (!netif_running(netdev))
2111                         return -ENETDOWN;
2112
2113                 nla_for_each_nested(nl_txq_params,
2114                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2115                                     rem_txq_params) {
2116                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2117                                            nla_data(nl_txq_params),
2118                                            nla_len(nl_txq_params),
2119                                            txq_params_policy);
2120                         if (result)
2121                                 return result;
2122                         result = parse_txq_params(tb, &txq_params);
2123                         if (result)
2124                                 return result;
2125
2126                         result = rdev_set_txq_params(rdev, netdev,
2127                                                      &txq_params);
2128                         if (result)
2129                                 return result;
2130                 }
2131         }
2132
2133         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2134                 result = __nl80211_set_channel(
2135                         rdev,
2136                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2137                         info);
2138                 if (result)
2139                         return result;
2140         }
2141
2142         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2143                 struct wireless_dev *txp_wdev = wdev;
2144                 enum nl80211_tx_power_setting type;
2145                 int idx, mbm = 0;
2146
2147                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2148                         txp_wdev = NULL;
2149
2150                 if (!rdev->ops->set_tx_power)
2151                         return -EOPNOTSUPP;
2152
2153                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2154                 type = nla_get_u32(info->attrs[idx]);
2155
2156                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2157                     (type != NL80211_TX_POWER_AUTOMATIC))
2158                         return -EINVAL;
2159
2160                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2161                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2162                         mbm = nla_get_u32(info->attrs[idx]);
2163                 }
2164
2165                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2166                 if (result)
2167                         return result;
2168         }
2169
2170         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2171             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2172                 u32 tx_ant, rx_ant;
2173                 if ((!rdev->wiphy.available_antennas_tx &&
2174                      !rdev->wiphy.available_antennas_rx) ||
2175                     !rdev->ops->set_antenna)
2176                         return -EOPNOTSUPP;
2177
2178                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2179                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2180
2181                 /* reject antenna configurations which don't match the
2182                  * available antenna masks, except for the "all" mask */
2183                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2184                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2185                         return -EINVAL;
2186
2187                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2188                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2189
2190                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2191                 if (result)
2192                         return result;
2193         }
2194
2195         changed = 0;
2196
2197         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2198                 retry_short = nla_get_u8(
2199                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2200                 if (retry_short == 0)
2201                         return -EINVAL;
2202
2203                 changed |= WIPHY_PARAM_RETRY_SHORT;
2204         }
2205
2206         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2207                 retry_long = nla_get_u8(
2208                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2209                 if (retry_long == 0)
2210                         return -EINVAL;
2211
2212                 changed |= WIPHY_PARAM_RETRY_LONG;
2213         }
2214
2215         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2216                 frag_threshold = nla_get_u32(
2217                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2218                 if (frag_threshold < 256)
2219                         return -EINVAL;
2220
2221                 if (frag_threshold != (u32) -1) {
2222                         /*
2223                          * Fragments (apart from the last one) are required to
2224                          * have even length. Make the fragmentation code
2225                          * simpler by stripping LSB should someone try to use
2226                          * odd threshold value.
2227                          */
2228                         frag_threshold &= ~0x1;
2229                 }
2230                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2231         }
2232
2233         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2234                 rts_threshold = nla_get_u32(
2235                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2236                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2237         }
2238
2239         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2240                 coverage_class = nla_get_u8(
2241                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2242                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2243         }
2244
2245         if (changed) {
2246                 u8 old_retry_short, old_retry_long;
2247                 u32 old_frag_threshold, old_rts_threshold;
2248                 u8 old_coverage_class;
2249
2250                 if (!rdev->ops->set_wiphy_params)
2251                         return -EOPNOTSUPP;
2252
2253                 old_retry_short = rdev->wiphy.retry_short;
2254                 old_retry_long = rdev->wiphy.retry_long;
2255                 old_frag_threshold = rdev->wiphy.frag_threshold;
2256                 old_rts_threshold = rdev->wiphy.rts_threshold;
2257                 old_coverage_class = rdev->wiphy.coverage_class;
2258
2259                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2260                         rdev->wiphy.retry_short = retry_short;
2261                 if (changed & WIPHY_PARAM_RETRY_LONG)
2262                         rdev->wiphy.retry_long = retry_long;
2263                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2264                         rdev->wiphy.frag_threshold = frag_threshold;
2265                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2266                         rdev->wiphy.rts_threshold = rts_threshold;
2267                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2268                         rdev->wiphy.coverage_class = coverage_class;
2269
2270                 result = rdev_set_wiphy_params(rdev, changed);
2271                 if (result) {
2272                         rdev->wiphy.retry_short = old_retry_short;
2273                         rdev->wiphy.retry_long = old_retry_long;
2274                         rdev->wiphy.frag_threshold = old_frag_threshold;
2275                         rdev->wiphy.rts_threshold = old_rts_threshold;
2276                         rdev->wiphy.coverage_class = old_coverage_class;
2277                 }
2278         }
2279         return 0;
2280 }
2281
2282 static inline u64 wdev_id(struct wireless_dev *wdev)
2283 {
2284         return (u64)wdev->identifier |
2285                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2286 }
2287
2288 static int nl80211_send_chandef(struct sk_buff *msg,
2289                                 const struct cfg80211_chan_def *chandef)
2290 {
2291         WARN_ON(!cfg80211_chandef_valid(chandef));
2292
2293         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2294                         chandef->chan->center_freq))
2295                 return -ENOBUFS;
2296         switch (chandef->width) {
2297         case NL80211_CHAN_WIDTH_20_NOHT:
2298         case NL80211_CHAN_WIDTH_20:
2299         case NL80211_CHAN_WIDTH_40:
2300                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2301                                 cfg80211_get_chandef_type(chandef)))
2302                         return -ENOBUFS;
2303                 break;
2304         default:
2305                 break;
2306         }
2307         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2308                 return -ENOBUFS;
2309         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2310                 return -ENOBUFS;
2311         if (chandef->center_freq2 &&
2312             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2313                 return -ENOBUFS;
2314         return 0;
2315 }
2316
2317 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2318                               struct cfg80211_registered_device *rdev,
2319                               struct wireless_dev *wdev)
2320 {
2321         struct net_device *dev = wdev->netdev;
2322         void *hdr;
2323
2324         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2325         if (!hdr)
2326                 return -1;
2327
2328         if (dev &&
2329             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2330              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2331                 goto nla_put_failure;
2332
2333         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2334             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2335             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2336             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2337             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2338                         rdev->devlist_generation ^
2339                         (cfg80211_rdev_list_generation << 2)))
2340                 goto nla_put_failure;
2341
2342         if (rdev->ops->get_channel) {
2343                 int ret;
2344                 struct cfg80211_chan_def chandef;
2345
2346                 ret = rdev_get_channel(rdev, wdev, &chandef);
2347                 if (ret == 0) {
2348                         if (nl80211_send_chandef(msg, &chandef))
2349                                 goto nla_put_failure;
2350                 }
2351         }
2352
2353         if (wdev->ssid_len) {
2354                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2355                         goto nla_put_failure;
2356         }
2357
2358         return genlmsg_end(msg, hdr);
2359
2360  nla_put_failure:
2361         genlmsg_cancel(msg, hdr);
2362         return -EMSGSIZE;
2363 }
2364
2365 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2366 {
2367         int wp_idx = 0;
2368         int if_idx = 0;
2369         int wp_start = cb->args[0];
2370         int if_start = cb->args[1];
2371         struct cfg80211_registered_device *rdev;
2372         struct wireless_dev *wdev;
2373
2374         rtnl_lock();
2375         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2376                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2377                         continue;
2378                 if (wp_idx < wp_start) {
2379                         wp_idx++;
2380                         continue;
2381                 }
2382                 if_idx = 0;
2383
2384                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2385                         if (if_idx < if_start) {
2386                                 if_idx++;
2387                                 continue;
2388                         }
2389                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2390                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2391                                                rdev, wdev) < 0) {
2392                                 goto out;
2393                         }
2394                         if_idx++;
2395                 }
2396
2397                 wp_idx++;
2398         }
2399  out:
2400         rtnl_unlock();
2401
2402         cb->args[0] = wp_idx;
2403         cb->args[1] = if_idx;
2404
2405         return skb->len;
2406 }
2407
2408 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2409 {
2410         struct sk_buff *msg;
2411         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2412         struct wireless_dev *wdev = info->user_ptr[1];
2413
2414         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2415         if (!msg)
2416                 return -ENOMEM;
2417
2418         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2419                                rdev, wdev) < 0) {
2420                 nlmsg_free(msg);
2421                 return -ENOBUFS;
2422         }
2423
2424         return genlmsg_reply(msg, info);
2425 }
2426
2427 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2428         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2429         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2430         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2431         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2432         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2433         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2434 };
2435
2436 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2437 {
2438         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2439         int flag;
2440
2441         *mntrflags = 0;
2442
2443         if (!nla)
2444                 return -EINVAL;
2445
2446         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2447                              nla, mntr_flags_policy))
2448                 return -EINVAL;
2449
2450         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2451                 if (flags[flag])
2452                         *mntrflags |= (1<<flag);
2453
2454         return 0;
2455 }
2456
2457 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2458                                struct net_device *netdev, u8 use_4addr,
2459                                enum nl80211_iftype iftype)
2460 {
2461         if (!use_4addr) {
2462                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2463                         return -EBUSY;
2464                 return 0;
2465         }
2466
2467         switch (iftype) {
2468         case NL80211_IFTYPE_AP_VLAN:
2469                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2470                         return 0;
2471                 break;
2472         case NL80211_IFTYPE_STATION:
2473                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2474                         return 0;
2475                 break;
2476         default:
2477                 break;
2478         }
2479
2480         return -EOPNOTSUPP;
2481 }
2482
2483 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2484 {
2485         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2486         struct vif_params params;
2487         int err;
2488         enum nl80211_iftype otype, ntype;
2489         struct net_device *dev = info->user_ptr[1];
2490         u32 _flags, *flags = NULL;
2491         bool change = false;
2492
2493         memset(&params, 0, sizeof(params));
2494
2495         otype = ntype = dev->ieee80211_ptr->iftype;
2496
2497         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2498                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2499                 if (otype != ntype)
2500                         change = true;
2501                 if (ntype > NL80211_IFTYPE_MAX)
2502                         return -EINVAL;
2503         }
2504
2505         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2506                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2507
2508                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2509                         return -EINVAL;
2510                 if (netif_running(dev))
2511                         return -EBUSY;
2512
2513                 wdev_lock(wdev);
2514                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2515                              IEEE80211_MAX_MESH_ID_LEN);
2516                 wdev->mesh_id_up_len =
2517                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2518                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2519                        wdev->mesh_id_up_len);
2520                 wdev_unlock(wdev);
2521         }
2522
2523         if (info->attrs[NL80211_ATTR_4ADDR]) {
2524                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2525                 change = true;
2526                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2527                 if (err)
2528                         return err;
2529         } else {
2530                 params.use_4addr = -1;
2531         }
2532
2533         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2534                 if (ntype != NL80211_IFTYPE_MONITOR)
2535                         return -EINVAL;
2536                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2537                                           &_flags);
2538                 if (err)
2539                         return err;
2540
2541                 flags = &_flags;
2542                 change = true;
2543         }
2544
2545         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2546             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2547                 return -EOPNOTSUPP;
2548
2549         if (change)
2550                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2551         else
2552                 err = 0;
2553
2554         if (!err && params.use_4addr != -1)
2555                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2556
2557         return err;
2558 }
2559
2560 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2561 {
2562         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2563         struct vif_params params;
2564         struct wireless_dev *wdev;
2565         struct sk_buff *msg;
2566         int err;
2567         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2568         u32 flags;
2569
2570         /* to avoid failing a new interface creation due to pending removal */
2571         cfg80211_destroy_ifaces(rdev);
2572
2573         memset(&params, 0, sizeof(params));
2574
2575         if (!info->attrs[NL80211_ATTR_IFNAME])
2576                 return -EINVAL;
2577
2578         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2579                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2580                 if (type > NL80211_IFTYPE_MAX)
2581                         return -EINVAL;
2582         }
2583
2584         if (!rdev->ops->add_virtual_intf ||
2585             !(rdev->wiphy.interface_modes & (1 << type)))
2586                 return -EOPNOTSUPP;
2587
2588         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2589                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2590                            ETH_ALEN);
2591                 if (!is_valid_ether_addr(params.macaddr))
2592                         return -EADDRNOTAVAIL;
2593         }
2594
2595         if (info->attrs[NL80211_ATTR_4ADDR]) {
2596                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2597                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2598                 if (err)
2599                         return err;
2600         }
2601
2602         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2603         if (!msg)
2604                 return -ENOMEM;
2605
2606         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2607                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2608                                   &flags);
2609
2610         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2611             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2612                 return -EOPNOTSUPP;
2613
2614         wdev = rdev_add_virtual_intf(rdev,
2615                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2616                                 type, err ? NULL : &flags, &params);
2617         if (IS_ERR(wdev)) {
2618                 nlmsg_free(msg);
2619                 return PTR_ERR(wdev);
2620         }
2621
2622         if (info->attrs[NL80211_ATTR_IFACE_SOCKET_OWNER])
2623                 wdev->owner_nlportid = info->snd_portid;
2624
2625         switch (type) {
2626         case NL80211_IFTYPE_MESH_POINT:
2627                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2628                         break;
2629                 wdev_lock(wdev);
2630                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2631                              IEEE80211_MAX_MESH_ID_LEN);
2632                 wdev->mesh_id_up_len =
2633                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2634                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2635                        wdev->mesh_id_up_len);
2636                 wdev_unlock(wdev);
2637                 break;
2638         case NL80211_IFTYPE_P2P_DEVICE:
2639                 /*
2640                  * P2P Device doesn't have a netdev, so doesn't go
2641                  * through the netdev notifier and must be added here
2642                  */
2643                 mutex_init(&wdev->mtx);
2644                 INIT_LIST_HEAD(&wdev->event_list);
2645                 spin_lock_init(&wdev->event_lock);
2646                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2647                 spin_lock_init(&wdev->mgmt_registrations_lock);
2648
2649                 wdev->identifier = ++rdev->wdev_id;
2650                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2651                 rdev->devlist_generation++;
2652                 break;
2653         default:
2654                 break;
2655         }
2656
2657         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2658                                rdev, wdev) < 0) {
2659                 nlmsg_free(msg);
2660                 return -ENOBUFS;
2661         }
2662
2663         return genlmsg_reply(msg, info);
2664 }
2665
2666 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2667 {
2668         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2669         struct wireless_dev *wdev = info->user_ptr[1];
2670
2671         if (!rdev->ops->del_virtual_intf)
2672                 return -EOPNOTSUPP;
2673
2674         /*
2675          * If we remove a wireless device without a netdev then clear
2676          * user_ptr[1] so that nl80211_post_doit won't dereference it
2677          * to check if it needs to do dev_put(). Otherwise it crashes
2678          * since the wdev has been freed, unlike with a netdev where
2679          * we need the dev_put() for the netdev to really be freed.
2680          */
2681         if (!wdev->netdev)
2682                 info->user_ptr[1] = NULL;
2683
2684         return rdev_del_virtual_intf(rdev, wdev);
2685 }
2686
2687 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2688 {
2689         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2690         struct net_device *dev = info->user_ptr[1];
2691         u16 noack_map;
2692
2693         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2694                 return -EINVAL;
2695
2696         if (!rdev->ops->set_noack_map)
2697                 return -EOPNOTSUPP;
2698
2699         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2700
2701         return rdev_set_noack_map(rdev, dev, noack_map);
2702 }
2703
2704 struct get_key_cookie {
2705         struct sk_buff *msg;
2706         int error;
2707         int idx;
2708 };
2709
2710 static void get_key_callback(void *c, struct key_params *params)
2711 {
2712         struct nlattr *key;
2713         struct get_key_cookie *cookie = c;
2714
2715         if ((params->key &&
2716              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2717                      params->key_len, params->key)) ||
2718             (params->seq &&
2719              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2720                      params->seq_len, params->seq)) ||
2721             (params->cipher &&
2722              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2723                          params->cipher)))
2724                 goto nla_put_failure;
2725
2726         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2727         if (!key)
2728                 goto nla_put_failure;
2729
2730         if ((params->key &&
2731              nla_put(cookie->msg, NL80211_KEY_DATA,
2732                      params->key_len, params->key)) ||
2733             (params->seq &&
2734              nla_put(cookie->msg, NL80211_KEY_SEQ,
2735                      params->seq_len, params->seq)) ||
2736             (params->cipher &&
2737              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2738                          params->cipher)))
2739                 goto nla_put_failure;
2740
2741         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2742                 goto nla_put_failure;
2743
2744         nla_nest_end(cookie->msg, key);
2745
2746         return;
2747  nla_put_failure:
2748         cookie->error = 1;
2749 }
2750
2751 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2752 {
2753         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2754         int err;
2755         struct net_device *dev = info->user_ptr[1];
2756         u8 key_idx = 0;
2757         const u8 *mac_addr = NULL;
2758         bool pairwise;
2759         struct get_key_cookie cookie = {
2760                 .error = 0,
2761         };
2762         void *hdr;
2763         struct sk_buff *msg;
2764
2765         if (info->attrs[NL80211_ATTR_KEY_IDX])
2766                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2767
2768         if (key_idx > 5)
2769                 return -EINVAL;
2770
2771         if (info->attrs[NL80211_ATTR_MAC])
2772                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2773
2774         pairwise = !!mac_addr;
2775         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2776                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2777                 if (kt >= NUM_NL80211_KEYTYPES)
2778                         return -EINVAL;
2779                 if (kt != NL80211_KEYTYPE_GROUP &&
2780                     kt != NL80211_KEYTYPE_PAIRWISE)
2781                         return -EINVAL;
2782                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2783         }
2784
2785         if (!rdev->ops->get_key)
2786                 return -EOPNOTSUPP;
2787
2788         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2789         if (!msg)
2790                 return -ENOMEM;
2791
2792         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2793                              NL80211_CMD_NEW_KEY);
2794         if (!hdr)
2795                 goto nla_put_failure;
2796
2797         cookie.msg = msg;
2798         cookie.idx = key_idx;
2799
2800         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2801             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2802                 goto nla_put_failure;
2803         if (mac_addr &&
2804             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2805                 goto nla_put_failure;
2806
2807         if (pairwise && mac_addr &&
2808             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2809                 return -ENOENT;
2810
2811         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2812                            get_key_callback);
2813
2814         if (err)
2815                 goto free_msg;
2816
2817         if (cookie.error)
2818                 goto nla_put_failure;
2819
2820         genlmsg_end(msg, hdr);
2821         return genlmsg_reply(msg, info);
2822
2823  nla_put_failure:
2824         err = -ENOBUFS;
2825  free_msg:
2826         nlmsg_free(msg);
2827         return err;
2828 }
2829
2830 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2831 {
2832         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2833         struct key_parse key;
2834         int err;
2835         struct net_device *dev = info->user_ptr[1];
2836
2837         err = nl80211_parse_key(info, &key);
2838         if (err)
2839                 return err;
2840
2841         if (key.idx < 0)
2842                 return -EINVAL;
2843
2844         /* only support setting default key */
2845         if (!key.def && !key.defmgmt)
2846                 return -EINVAL;
2847
2848         wdev_lock(dev->ieee80211_ptr);
2849
2850         if (key.def) {
2851                 if (!rdev->ops->set_default_key) {
2852                         err = -EOPNOTSUPP;
2853                         goto out;
2854                 }
2855
2856                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2857                 if (err)
2858                         goto out;
2859
2860                 err = rdev_set_default_key(rdev, dev, key.idx,
2861                                                  key.def_uni, key.def_multi);
2862
2863                 if (err)
2864                         goto out;
2865
2866 #ifdef CONFIG_CFG80211_WEXT
2867                 dev->ieee80211_ptr->wext.default_key = key.idx;
2868 #endif
2869         } else {
2870                 if (key.def_uni || !key.def_multi) {
2871                         err = -EINVAL;
2872                         goto out;
2873                 }
2874
2875                 if (!rdev->ops->set_default_mgmt_key) {
2876                         err = -EOPNOTSUPP;
2877                         goto out;
2878                 }
2879
2880                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2881                 if (err)
2882                         goto out;
2883
2884                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2885                 if (err)
2886                         goto out;
2887
2888 #ifdef CONFIG_CFG80211_WEXT
2889                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2890 #endif
2891         }
2892
2893  out:
2894         wdev_unlock(dev->ieee80211_ptr);
2895
2896         return err;
2897 }
2898
2899 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2900 {
2901         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2902         int err;
2903         struct net_device *dev = info->user_ptr[1];
2904         struct key_parse key;
2905         const u8 *mac_addr = NULL;
2906
2907         err = nl80211_parse_key(info, &key);
2908         if (err)
2909                 return err;
2910
2911         if (!key.p.key)
2912                 return -EINVAL;
2913
2914         if (info->attrs[NL80211_ATTR_MAC])
2915                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2916
2917         if (key.type == -1) {
2918                 if (mac_addr)
2919                         key.type = NL80211_KEYTYPE_PAIRWISE;
2920                 else
2921                         key.type = NL80211_KEYTYPE_GROUP;
2922         }
2923
2924         /* for now */
2925         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2926             key.type != NL80211_KEYTYPE_GROUP)
2927                 return -EINVAL;
2928
2929         if (!rdev->ops->add_key)
2930                 return -EOPNOTSUPP;
2931
2932         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2933                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2934                                            mac_addr))
2935                 return -EINVAL;
2936
2937         wdev_lock(dev->ieee80211_ptr);
2938         err = nl80211_key_allowed(dev->ieee80211_ptr);
2939         if (!err)
2940                 err = rdev_add_key(rdev, dev, key.idx,
2941                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2942                                     mac_addr, &key.p);
2943         wdev_unlock(dev->ieee80211_ptr);
2944
2945         return err;
2946 }
2947
2948 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2949 {
2950         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2951         int err;
2952         struct net_device *dev = info->user_ptr[1];
2953         u8 *mac_addr = NULL;
2954         struct key_parse key;
2955
2956         err = nl80211_parse_key(info, &key);
2957         if (err)
2958                 return err;
2959
2960         if (info->attrs[NL80211_ATTR_MAC])
2961                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2962
2963         if (key.type == -1) {
2964                 if (mac_addr)
2965                         key.type = NL80211_KEYTYPE_PAIRWISE;
2966                 else
2967                         key.type = NL80211_KEYTYPE_GROUP;
2968         }
2969
2970         /* for now */
2971         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2972             key.type != NL80211_KEYTYPE_GROUP)
2973                 return -EINVAL;
2974
2975         if (!rdev->ops->del_key)
2976                 return -EOPNOTSUPP;
2977
2978         wdev_lock(dev->ieee80211_ptr);
2979         err = nl80211_key_allowed(dev->ieee80211_ptr);
2980
2981         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2982             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2983                 err = -ENOENT;
2984
2985         if (!err)
2986                 err = rdev_del_key(rdev, dev, key.idx,
2987                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2988                                    mac_addr);
2989
2990 #ifdef CONFIG_CFG80211_WEXT
2991         if (!err) {
2992                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2993                         dev->ieee80211_ptr->wext.default_key = -1;
2994                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2995                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2996         }
2997 #endif
2998         wdev_unlock(dev->ieee80211_ptr);
2999
3000         return err;
3001 }
3002
3003 /* This function returns an error or the number of nested attributes */
3004 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3005 {
3006         struct nlattr *attr;
3007         int n_entries = 0, tmp;
3008
3009         nla_for_each_nested(attr, nl_attr, tmp) {
3010                 if (nla_len(attr) != ETH_ALEN)
3011                         return -EINVAL;
3012
3013                 n_entries++;
3014         }
3015
3016         return n_entries;
3017 }
3018
3019 /*
3020  * This function parses ACL information and allocates memory for ACL data.
3021  * On successful return, the calling function is responsible to free the
3022  * ACL buffer returned by this function.
3023  */
3024 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3025                                                 struct genl_info *info)
3026 {
3027         enum nl80211_acl_policy acl_policy;
3028         struct nlattr *attr;
3029         struct cfg80211_acl_data *acl;
3030         int i = 0, n_entries, tmp;
3031
3032         if (!wiphy->max_acl_mac_addrs)
3033                 return ERR_PTR(-EOPNOTSUPP);
3034
3035         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3036                 return ERR_PTR(-EINVAL);
3037
3038         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3039         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3040             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3041                 return ERR_PTR(-EINVAL);
3042
3043         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3044                 return ERR_PTR(-EINVAL);
3045
3046         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3047         if (n_entries < 0)
3048                 return ERR_PTR(n_entries);
3049
3050         if (n_entries > wiphy->max_acl_mac_addrs)
3051                 return ERR_PTR(-ENOTSUPP);
3052
3053         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3054                       GFP_KERNEL);
3055         if (!acl)
3056                 return ERR_PTR(-ENOMEM);
3057
3058         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3059                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3060                 i++;
3061         }
3062
3063         acl->n_acl_entries = n_entries;
3064         acl->acl_policy = acl_policy;
3065
3066         return acl;
3067 }
3068
3069 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3070 {
3071         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3072         struct net_device *dev = info->user_ptr[1];
3073         struct cfg80211_acl_data *acl;
3074         int err;
3075
3076         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3077             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3078                 return -EOPNOTSUPP;
3079
3080         if (!dev->ieee80211_ptr->beacon_interval)
3081                 return -EINVAL;
3082
3083         acl = parse_acl_data(&rdev->wiphy, info);
3084         if (IS_ERR(acl))
3085                 return PTR_ERR(acl);
3086
3087         err = rdev_set_mac_acl(rdev, dev, acl);
3088
3089         kfree(acl);
3090
3091         return err;
3092 }
3093
3094 static int nl80211_parse_beacon(struct nlattr *attrs[],
3095                                 struct cfg80211_beacon_data *bcn)
3096 {
3097         bool haveinfo = false;
3098
3099         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3100             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3101             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3102             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3103                 return -EINVAL;
3104
3105         memset(bcn, 0, sizeof(*bcn));
3106
3107         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3108                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3109                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3110                 if (!bcn->head_len)
3111                         return -EINVAL;
3112                 haveinfo = true;
3113         }
3114
3115         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3116                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3117                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3118                 haveinfo = true;
3119         }
3120
3121         if (!haveinfo)
3122                 return -EINVAL;
3123
3124         if (attrs[NL80211_ATTR_IE]) {
3125                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3126                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3127         }
3128
3129         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3130                 bcn->proberesp_ies =
3131                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3132                 bcn->proberesp_ies_len =
3133                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3134         }
3135
3136         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3137                 bcn->assocresp_ies =
3138                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3139                 bcn->assocresp_ies_len =
3140                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3141         }
3142
3143         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3144                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3145                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3146         }
3147
3148         return 0;
3149 }
3150
3151 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3152                                    struct cfg80211_ap_settings *params)
3153 {
3154         struct wireless_dev *wdev;
3155         bool ret = false;
3156
3157         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3158                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3159                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3160                         continue;
3161
3162                 if (!wdev->preset_chandef.chan)
3163                         continue;
3164
3165                 params->chandef = wdev->preset_chandef;
3166                 ret = true;
3167                 break;
3168         }
3169
3170         return ret;
3171 }
3172
3173 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3174                                     enum nl80211_auth_type auth_type,
3175                                     enum nl80211_commands cmd)
3176 {
3177         if (auth_type > NL80211_AUTHTYPE_MAX)
3178                 return false;
3179
3180         switch (cmd) {
3181         case NL80211_CMD_AUTHENTICATE:
3182                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3183                     auth_type == NL80211_AUTHTYPE_SAE)
3184                         return false;
3185                 return true;
3186         case NL80211_CMD_CONNECT:
3187         case NL80211_CMD_START_AP:
3188                 /* SAE not supported yet */
3189                 if (auth_type == NL80211_AUTHTYPE_SAE)
3190                         return false;
3191                 return true;
3192         default:
3193                 return false;
3194         }
3195 }
3196
3197 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3198 {
3199         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3200         struct net_device *dev = info->user_ptr[1];
3201         struct wireless_dev *wdev = dev->ieee80211_ptr;
3202         struct cfg80211_ap_settings params;
3203         int err;
3204
3205         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3206             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3207                 return -EOPNOTSUPP;
3208
3209         if (!rdev->ops->start_ap)
3210                 return -EOPNOTSUPP;
3211
3212         if (wdev->beacon_interval)
3213                 return -EALREADY;
3214
3215         memset(&params, 0, sizeof(params));
3216
3217         /* these are required for START_AP */
3218         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3219             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3220             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3221                 return -EINVAL;
3222
3223         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3224         if (err)
3225                 return err;
3226
3227         params.beacon_interval =
3228                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3229         params.dtim_period =
3230                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3231
3232         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3233         if (err)
3234                 return err;
3235
3236         /*
3237          * In theory, some of these attributes should be required here
3238          * but since they were not used when the command was originally
3239          * added, keep them optional for old user space programs to let
3240          * them continue to work with drivers that do not need the
3241          * additional information -- drivers must check!
3242          */
3243         if (info->attrs[NL80211_ATTR_SSID]) {
3244                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3245                 params.ssid_len =
3246                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3247                 if (params.ssid_len == 0 ||
3248                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3249                         return -EINVAL;
3250         }
3251
3252         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3253                 params.hidden_ssid = nla_get_u32(
3254                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3255                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3256                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3257                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3258                         return -EINVAL;
3259         }
3260
3261         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3262
3263         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3264                 params.auth_type = nla_get_u32(
3265                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3266                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3267                                              NL80211_CMD_START_AP))
3268                         return -EINVAL;
3269         } else
3270                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3271
3272         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3273                                       NL80211_MAX_NR_CIPHER_SUITES);
3274         if (err)
3275                 return err;
3276
3277         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3278                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3279                         return -EOPNOTSUPP;
3280                 params.inactivity_timeout = nla_get_u16(
3281                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3282         }
3283
3284         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3285                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3286                         return -EINVAL;
3287                 params.p2p_ctwindow =
3288                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3289                 if (params.p2p_ctwindow > 127)
3290                         return -EINVAL;
3291                 if (params.p2p_ctwindow != 0 &&
3292                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3293                         return -EINVAL;
3294         }
3295
3296         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3297                 u8 tmp;
3298
3299                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3300                         return -EINVAL;
3301                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3302                 if (tmp > 1)
3303                         return -EINVAL;
3304                 params.p2p_opp_ps = tmp;
3305                 if (params.p2p_opp_ps != 0 &&
3306                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3307                         return -EINVAL;
3308         }
3309
3310         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3311                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3312                 if (err)
3313                         return err;
3314         } else if (wdev->preset_chandef.chan) {
3315                 params.chandef = wdev->preset_chandef;
3316         } else if (!nl80211_get_ap_channel(rdev, &params))
3317                 return -EINVAL;
3318
3319         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
3320                                      wdev->iftype))
3321                 return -EINVAL;
3322
3323         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3324                 params.acl = parse_acl_data(&rdev->wiphy, info);
3325                 if (IS_ERR(params.acl))
3326                         return PTR_ERR(params.acl);
3327         }
3328
3329         wdev_lock(wdev);
3330         err = rdev_start_ap(rdev, dev, &params);
3331         if (!err) {
3332                 wdev->preset_chandef = params.chandef;
3333                 wdev->beacon_interval = params.beacon_interval;
3334                 wdev->chandef = params.chandef;
3335                 wdev->ssid_len = params.ssid_len;
3336                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3337         }
3338         wdev_unlock(wdev);
3339
3340         kfree(params.acl);
3341
3342         return err;
3343 }
3344
3345 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3346 {
3347         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3348         struct net_device *dev = info->user_ptr[1];
3349         struct wireless_dev *wdev = dev->ieee80211_ptr;
3350         struct cfg80211_beacon_data params;
3351         int err;
3352
3353         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3354             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3355                 return -EOPNOTSUPP;
3356
3357         if (!rdev->ops->change_beacon)
3358                 return -EOPNOTSUPP;
3359
3360         if (!wdev->beacon_interval)
3361                 return -EINVAL;
3362
3363         err = nl80211_parse_beacon(info->attrs, &params);
3364         if (err)
3365                 return err;
3366
3367         wdev_lock(wdev);
3368         err = rdev_change_beacon(rdev, dev, &params);
3369         wdev_unlock(wdev);
3370
3371         return err;
3372 }
3373
3374 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3375 {
3376         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3377         struct net_device *dev = info->user_ptr[1];
3378
3379         return cfg80211_stop_ap(rdev, dev, false);
3380 }
3381
3382 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3383         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3384         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3385         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3386         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3387         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3388         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3389 };
3390
3391 static int parse_station_flags(struct genl_info *info,
3392                                enum nl80211_iftype iftype,
3393                                struct station_parameters *params)
3394 {
3395         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3396         struct nlattr *nla;
3397         int flag;
3398
3399         /*
3400          * Try parsing the new attribute first so userspace
3401          * can specify both for older kernels.
3402          */
3403         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3404         if (nla) {
3405                 struct nl80211_sta_flag_update *sta_flags;
3406
3407                 sta_flags = nla_data(nla);
3408                 params->sta_flags_mask = sta_flags->mask;
3409                 params->sta_flags_set = sta_flags->set;
3410                 params->sta_flags_set &= params->sta_flags_mask;
3411                 if ((params->sta_flags_mask |
3412                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3413                         return -EINVAL;
3414                 return 0;
3415         }
3416
3417         /* if present, parse the old attribute */
3418
3419         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3420         if (!nla)
3421                 return 0;
3422
3423         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3424                              nla, sta_flags_policy))
3425                 return -EINVAL;
3426
3427         /*
3428          * Only allow certain flags for interface types so that
3429          * other attributes are silently ignored. Remember that
3430          * this is backward compatibility code with old userspace
3431          * and shouldn't be hit in other cases anyway.
3432          */
3433         switch (iftype) {
3434         case NL80211_IFTYPE_AP:
3435         case NL80211_IFTYPE_AP_VLAN:
3436         case NL80211_IFTYPE_P2P_GO:
3437                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3438                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3439                                          BIT(NL80211_STA_FLAG_WME) |
3440                                          BIT(NL80211_STA_FLAG_MFP);
3441                 break;
3442         case NL80211_IFTYPE_P2P_CLIENT:
3443         case NL80211_IFTYPE_STATION:
3444                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3445                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3446                 break;
3447         case NL80211_IFTYPE_MESH_POINT:
3448                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3449                                          BIT(NL80211_STA_FLAG_MFP) |
3450                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3451         default:
3452                 return -EINVAL;
3453         }
3454
3455         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3456                 if (flags[flag]) {
3457                         params->sta_flags_set |= (1<<flag);
3458
3459                         /* no longer support new API additions in old API */
3460                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3461                                 return -EINVAL;
3462                 }
3463         }
3464
3465         return 0;
3466 }
3467
3468 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3469                                  int attr)
3470 {
3471         struct nlattr *rate;
3472         u32 bitrate;
3473         u16 bitrate_compat;
3474
3475         rate = nla_nest_start(msg, attr);
3476         if (!rate)
3477                 return false;
3478
3479         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3480         bitrate = cfg80211_calculate_bitrate(info);
3481         /* report 16-bit bitrate only if we can */
3482         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3483         if (bitrate > 0 &&
3484             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3485                 return false;
3486         if (bitrate_compat > 0 &&
3487             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3488                 return false;
3489
3490         if (info->flags & RATE_INFO_FLAGS_MCS) {
3491                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3492                         return false;
3493                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3494                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3495                         return false;
3496                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3497                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3498                         return false;
3499         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3500                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3501                         return false;
3502                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3503                         return false;
3504                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3505                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3506                         return false;
3507                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3508                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3509                         return false;
3510                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3511                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3512                         return false;
3513                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3514                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3515                         return false;
3516                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3517                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3518                         return false;
3519         }
3520
3521         nla_nest_end(msg, rate);
3522         return true;
3523 }
3524
3525 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3526                                int id)
3527 {
3528         void *attr;
3529         int i = 0;
3530
3531         if (!mask)
3532                 return true;
3533
3534         attr = nla_nest_start(msg, id);
3535         if (!attr)
3536                 return false;
3537
3538         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3539                 if (!(mask & BIT(i)))
3540                         continue;
3541
3542                 if (nla_put_u8(msg, i, signal[i]))
3543                         return false;
3544         }
3545
3546         nla_nest_end(msg, attr);
3547
3548         return true;
3549 }
3550
3551 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3552                                 int flags,
3553                                 struct cfg80211_registered_device *rdev,
3554                                 struct net_device *dev,
3555                                 const u8 *mac_addr, struct station_info *sinfo)
3556 {
3557         void *hdr;
3558         struct nlattr *sinfoattr, *bss_param;
3559
3560         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3561         if (!hdr)
3562                 return -1;
3563
3564         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3565             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3566             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3567                 goto nla_put_failure;
3568
3569         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3570         if (!sinfoattr)
3571                 goto nla_put_failure;
3572         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3573             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3574                         sinfo->connected_time))
3575                 goto nla_put_failure;
3576         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3577             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3578                         sinfo->inactive_time))
3579                 goto nla_put_failure;
3580         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3581                               STATION_INFO_RX_BYTES64)) &&
3582             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3583                         (u32)sinfo->rx_bytes))
3584                 goto nla_put_failure;
3585         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3586                               STATION_INFO_TX_BYTES64)) &&
3587             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3588                         (u32)sinfo->tx_bytes))
3589                 goto nla_put_failure;
3590         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3591             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3592                         sinfo->rx_bytes))
3593                 goto nla_put_failure;
3594         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3595             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3596                         sinfo->tx_bytes))
3597                 goto nla_put_failure;
3598         if ((sinfo->filled & STATION_INFO_LLID) &&
3599             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3600                 goto nla_put_failure;
3601         if ((sinfo->filled & STATION_INFO_PLID) &&
3602             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3603                 goto nla_put_failure;
3604         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3605             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3606                        sinfo->plink_state))
3607                 goto nla_put_failure;
3608         switch (rdev->wiphy.signal_type) {
3609         case CFG80211_SIGNAL_TYPE_MBM:
3610                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3611                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3612                                sinfo->signal))
3613                         goto nla_put_failure;
3614                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3615                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3616                                sinfo->signal_avg))
3617                         goto nla_put_failure;
3618                 break;
3619         default:
3620                 break;
3621         }
3622         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3623                 if (!nl80211_put_signal(msg, sinfo->chains,
3624                                         sinfo->chain_signal,
3625                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3626                         goto nla_put_failure;
3627         }
3628         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3629                 if (!nl80211_put_signal(msg, sinfo->chains,
3630                                         sinfo->chain_signal_avg,
3631                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3632                         goto nla_put_failure;
3633         }
3634         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3635                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3636                                           NL80211_STA_INFO_TX_BITRATE))
3637                         goto nla_put_failure;
3638         }
3639         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3640                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3641                                           NL80211_STA_INFO_RX_BITRATE))
3642                         goto nla_put_failure;
3643         }
3644         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3645             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3646                         sinfo->rx_packets))
3647                 goto nla_put_failure;
3648         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3649             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3650                         sinfo->tx_packets))
3651                 goto nla_put_failure;
3652         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3653             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3654                         sinfo->tx_retries))
3655                 goto nla_put_failure;
3656         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3657             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3658                         sinfo->tx_failed))
3659                 goto nla_put_failure;
3660         if ((sinfo->filled & STATION_INFO_EXPECTED_THROUGHPUT) &&
3661             nla_put_u32(msg, NL80211_STA_INFO_EXPECTED_THROUGHPUT,
3662                         sinfo->expected_throughput))
3663                 goto nla_put_failure;
3664         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3665             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3666                         sinfo->beacon_loss_count))
3667                 goto nla_put_failure;
3668         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3669             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3670                         sinfo->local_pm))
3671                 goto nla_put_failure;
3672         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3673             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3674                         sinfo->peer_pm))
3675                 goto nla_put_failure;
3676         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3677             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3678                         sinfo->nonpeer_pm))
3679                 goto nla_put_failure;
3680         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3681                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3682                 if (!bss_param)
3683                         goto nla_put_failure;
3684
3685                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3686                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3687                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3688                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3689                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3690                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3691                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3692                                sinfo->bss_param.dtim_period) ||
3693                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3694                                 sinfo->bss_param.beacon_interval))
3695                         goto nla_put_failure;
3696
3697                 nla_nest_end(msg, bss_param);
3698         }
3699         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3700             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3701                     sizeof(struct nl80211_sta_flag_update),
3702                     &sinfo->sta_flags))
3703                 goto nla_put_failure;
3704         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3705                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3706                             sinfo->t_offset))
3707                 goto nla_put_failure;
3708         nla_nest_end(msg, sinfoattr);
3709
3710         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3711             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3712                     sinfo->assoc_req_ies))
3713                 goto nla_put_failure;
3714
3715         return genlmsg_end(msg, hdr);
3716
3717  nla_put_failure:
3718         genlmsg_cancel(msg, hdr);
3719         return -EMSGSIZE;
3720 }
3721
3722 static int nl80211_dump_station(struct sk_buff *skb,
3723                                 struct netlink_callback *cb)
3724 {
3725         struct station_info sinfo;
3726         struct cfg80211_registered_device *rdev;
3727         struct wireless_dev *wdev;
3728         u8 mac_addr[ETH_ALEN];
3729         int sta_idx = cb->args[2];
3730         int err;
3731
3732         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3733         if (err)
3734                 return err;
3735
3736         if (!wdev->netdev) {
3737                 err = -EINVAL;
3738                 goto out_err;
3739         }
3740
3741         if (!rdev->ops->dump_station) {
3742                 err = -EOPNOTSUPP;
3743                 goto out_err;
3744         }
3745
3746         while (1) {
3747                 memset(&sinfo, 0, sizeof(sinfo));
3748                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3749                                         mac_addr, &sinfo);
3750                 if (err == -ENOENT)
3751                         break;
3752                 if (err)
3753                         goto out_err;
3754
3755                 if (nl80211_send_station(skb,
3756                                 NETLINK_CB(cb->skb).portid,
3757                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3758                                 rdev, wdev->netdev, mac_addr,
3759                                 &sinfo) < 0)
3760                         goto out;
3761
3762                 sta_idx++;
3763         }
3764
3765
3766  out:
3767         cb->args[2] = sta_idx;
3768         err = skb->len;
3769  out_err:
3770         nl80211_finish_wdev_dump(rdev);
3771
3772         return err;
3773 }
3774
3775 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3776 {
3777         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3778         struct net_device *dev = info->user_ptr[1];
3779         struct station_info sinfo;
3780         struct sk_buff *msg;
3781         u8 *mac_addr = NULL;
3782         int err;
3783
3784         memset(&sinfo, 0, sizeof(sinfo));
3785
3786         if (!info->attrs[NL80211_ATTR_MAC])
3787                 return -EINVAL;
3788
3789         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3790
3791         if (!rdev->ops->get_station)
3792                 return -EOPNOTSUPP;
3793
3794         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3795         if (err)
3796                 return err;
3797
3798         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3799         if (!msg)
3800                 return -ENOMEM;
3801
3802         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3803                                  rdev, dev, mac_addr, &sinfo) < 0) {
3804                 nlmsg_free(msg);
3805                 return -ENOBUFS;
3806         }
3807
3808         return genlmsg_reply(msg, info);
3809 }
3810
3811 int cfg80211_check_station_change(struct wiphy *wiphy,
3812                                   struct station_parameters *params,
3813                                   enum cfg80211_station_type statype)
3814 {
3815         if (params->listen_interval != -1)
3816                 return -EINVAL;
3817         if (params->aid)
3818                 return -EINVAL;
3819
3820         /* When you run into this, adjust the code below for the new flag */
3821         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3822
3823         switch (statype) {
3824         case CFG80211_STA_MESH_PEER_KERNEL:
3825         case CFG80211_STA_MESH_PEER_USER:
3826                 /*
3827                  * No ignoring the TDLS flag here -- the userspace mesh
3828                  * code doesn't have the bug of including TDLS in the
3829                  * mask everywhere.
3830                  */
3831                 if (params->sta_flags_mask &
3832                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3833                                   BIT(NL80211_STA_FLAG_MFP) |
3834                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3835                         return -EINVAL;
3836                 break;
3837         case CFG80211_STA_TDLS_PEER_SETUP:
3838         case CFG80211_STA_TDLS_PEER_ACTIVE:
3839                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3840                         return -EINVAL;
3841                 /* ignore since it can't change */
3842                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3843                 break;
3844         default:
3845                 /* disallow mesh-specific things */
3846                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3847                         return -EINVAL;
3848                 if (params->local_pm)
3849                         return -EINVAL;
3850                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3851                         return -EINVAL;
3852         }
3853
3854         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3855             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3856                 /* TDLS can't be set, ... */
3857                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3858                         return -EINVAL;
3859                 /*
3860                  * ... but don't bother the driver with it. This works around
3861                  * a hostapd/wpa_supplicant issue -- it always includes the
3862                  * TLDS_PEER flag in the mask even for AP mode.
3863                  */
3864                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3865         }
3866
3867         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3868                 /* reject other things that can't change */
3869                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3870                         return -EINVAL;
3871                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3872                         return -EINVAL;
3873                 if (params->supported_rates)
3874                         return -EINVAL;
3875                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3876                         return -EINVAL;
3877         }
3878
3879         if (statype != CFG80211_STA_AP_CLIENT) {
3880                 if (params->vlan)
3881                         return -EINVAL;
3882         }
3883
3884         switch (statype) {
3885         case CFG80211_STA_AP_MLME_CLIENT:
3886                 /* Use this only for authorizing/unauthorizing a station */
3887                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3888                         return -EOPNOTSUPP;
3889                 break;
3890         case CFG80211_STA_AP_CLIENT:
3891                 /* accept only the listed bits */
3892                 if (params->sta_flags_mask &
3893                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3894                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3895                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3896                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3897                                   BIT(NL80211_STA_FLAG_WME) |
3898                                   BIT(NL80211_STA_FLAG_MFP)))
3899                         return -EINVAL;
3900
3901                 /* but authenticated/associated only if driver handles it */
3902                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3903                     params->sta_flags_mask &
3904                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3905                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3906                         return -EINVAL;
3907                 break;
3908         case CFG80211_STA_IBSS:
3909         case CFG80211_STA_AP_STA:
3910                 /* reject any changes other than AUTHORIZED */
3911                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3912                         return -EINVAL;
3913                 break;
3914         case CFG80211_STA_TDLS_PEER_SETUP:
3915                 /* reject any changes other than AUTHORIZED or WME */
3916                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3917                                                BIT(NL80211_STA_FLAG_WME)))
3918                         return -EINVAL;
3919                 /* force (at least) rates when authorizing */
3920                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3921                     !params->supported_rates)
3922                         return -EINVAL;
3923                 break;
3924         case CFG80211_STA_TDLS_PEER_ACTIVE:
3925                 /* reject any changes */
3926                 return -EINVAL;
3927         case CFG80211_STA_MESH_PEER_KERNEL:
3928                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3929                         return -EINVAL;
3930                 break;
3931         case CFG80211_STA_MESH_PEER_USER:
3932                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3933                         return -EINVAL;
3934                 break;
3935         }
3936
3937         return 0;
3938 }
3939 EXPORT_SYMBOL(cfg80211_check_station_change);
3940
3941 /*
3942  * Get vlan interface making sure it is running and on the right wiphy.
3943  */
3944 static struct net_device *get_vlan(struct genl_info *info,
3945                                    struct cfg80211_registered_device *rdev)
3946 {
3947         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3948         struct net_device *v;
3949         int ret;
3950
3951         if (!vlanattr)
3952                 return NULL;
3953
3954         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3955         if (!v)
3956                 return ERR_PTR(-ENODEV);
3957
3958         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3959                 ret = -EINVAL;
3960                 goto error;
3961         }
3962
3963         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3964             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3965             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3966                 ret = -EINVAL;
3967                 goto error;
3968         }
3969
3970         if (!netif_running(v)) {
3971                 ret = -ENETDOWN;
3972                 goto error;
3973         }
3974
3975         return v;
3976  error:
3977         dev_put(v);
3978         return ERR_PTR(ret);
3979 }
3980
3981 static const struct nla_policy
3982 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
3983         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3984         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3985 };
3986
3987 static int nl80211_parse_sta_wme(struct genl_info *info,
3988                                  struct station_parameters *params)
3989 {
3990         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3991         struct nlattr *nla;
3992         int err;
3993
3994         /* parse WME attributes if present */
3995         if (!info->attrs[NL80211_ATTR_STA_WME])
3996                 return 0;
3997
3998         nla = info->attrs[NL80211_ATTR_STA_WME];
3999         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4000                                nl80211_sta_wme_policy);
4001         if (err)
4002                 return err;
4003
4004         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4005                 params->uapsd_queues = nla_get_u8(
4006                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4007         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4008                 return -EINVAL;
4009
4010         if (tb[NL80211_STA_WME_MAX_SP])
4011                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4012
4013         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4014                 return -EINVAL;
4015
4016         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4017
4018         return 0;
4019 }
4020
4021 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4022                                       struct station_parameters *params)
4023 {
4024         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4025                 params->supported_channels =
4026                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4027                 params->supported_channels_len =
4028                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4029                 /*
4030                  * Need to include at least one (first channel, number of
4031                  * channels) tuple for each subband, and must have proper
4032                  * tuples for the rest of the data as well.
4033                  */
4034                 if (params->supported_channels_len < 2)
4035                         return -EINVAL;
4036                 if (params->supported_channels_len % 2)
4037                         return -EINVAL;
4038         }
4039
4040         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4041                 params->supported_oper_classes =
4042                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4043                 params->supported_oper_classes_len =
4044                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4045                 /*
4046                  * The value of the Length field of the Supported Operating
4047                  * Classes element is between 2 and 253.
4048                  */
4049                 if (params->supported_oper_classes_len < 2 ||
4050                     params->supported_oper_classes_len > 253)
4051                         return -EINVAL;
4052         }
4053         return 0;
4054 }
4055
4056 static int nl80211_set_station_tdls(struct genl_info *info,
4057                                     struct station_parameters *params)
4058 {
4059         int err;
4060         /* Dummy STA entry gets updated once the peer capabilities are known */
4061         if (info->attrs[NL80211_ATTR_PEER_AID])
4062                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4063         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4064                 params->ht_capa =
4065                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4066         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4067                 params->vht_capa =
4068                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4069
4070         err = nl80211_parse_sta_channel_info(info, params);
4071         if (err)
4072                 return err;
4073
4074         return nl80211_parse_sta_wme(info, params);
4075 }
4076
4077 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4078 {
4079         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4080         struct net_device *dev = info->user_ptr[1];
4081         struct station_parameters params;
4082         u8 *mac_addr;
4083         int err;
4084
4085         memset(&params, 0, sizeof(params));
4086
4087         params.listen_interval = -1;
4088
4089         if (!rdev->ops->change_station)
4090                 return -EOPNOTSUPP;
4091
4092         if (info->attrs[NL80211_ATTR_STA_AID])
4093                 return -EINVAL;
4094
4095         if (!info->attrs[NL80211_ATTR_MAC])
4096                 return -EINVAL;
4097
4098         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4099
4100         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4101                 params.supported_rates =
4102                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4103                 params.supported_rates_len =
4104                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4105         }
4106
4107         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4108                 params.capability =
4109                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4110                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4111         }
4112
4113         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4114                 params.ext_capab =
4115                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4116                 params.ext_capab_len =
4117                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4118         }
4119
4120         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4121                 return -EINVAL;
4122
4123         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4124                 return -EINVAL;
4125
4126         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4127                 params.plink_action =
4128                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4129                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4130                         return -EINVAL;
4131         }
4132
4133         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4134                 params.plink_state =
4135                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4136                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4137                         return -EINVAL;
4138                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4139         }
4140
4141         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4142                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4143                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4144
4145                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4146                     pm > NL80211_MESH_POWER_MAX)
4147                         return -EINVAL;
4148
4149                 params.local_pm = pm;
4150         }
4151
4152         /* Include parameters for TDLS peer (will check later) */
4153         err = nl80211_set_station_tdls(info, &params);
4154         if (err)
4155                 return err;
4156
4157         params.vlan = get_vlan(info, rdev);
4158         if (IS_ERR(params.vlan))
4159                 return PTR_ERR(params.vlan);
4160
4161         switch (dev->ieee80211_ptr->iftype) {
4162         case NL80211_IFTYPE_AP:
4163         case NL80211_IFTYPE_AP_VLAN:
4164         case NL80211_IFTYPE_P2P_GO:
4165         case NL80211_IFTYPE_P2P_CLIENT:
4166         case NL80211_IFTYPE_STATION:
4167         case NL80211_IFTYPE_ADHOC:
4168         case NL80211_IFTYPE_MESH_POINT:
4169                 break;
4170         default:
4171                 err = -EOPNOTSUPP;
4172                 goto out_put_vlan;
4173         }
4174
4175         /* driver will call cfg80211_check_station_change() */
4176         err = rdev_change_station(rdev, dev, mac_addr, &params);
4177
4178  out_put_vlan:
4179         if (params.vlan)
4180                 dev_put(params.vlan);
4181
4182         return err;
4183 }
4184
4185 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4186 {
4187         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4188         int err;
4189         struct net_device *dev = info->user_ptr[1];
4190         struct station_parameters params;
4191         u8 *mac_addr = NULL;
4192
4193         memset(&params, 0, sizeof(params));
4194
4195         if (!rdev->ops->add_station)
4196                 return -EOPNOTSUPP;
4197
4198         if (!info->attrs[NL80211_ATTR_MAC])
4199                 return -EINVAL;
4200
4201         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4202                 return -EINVAL;
4203
4204         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4205                 return -EINVAL;
4206
4207         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4208             !info->attrs[NL80211_ATTR_PEER_AID])
4209                 return -EINVAL;
4210
4211         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4212         params.supported_rates =
4213                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4214         params.supported_rates_len =
4215                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4216         params.listen_interval =
4217                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4218
4219         if (info->attrs[NL80211_ATTR_PEER_AID])
4220                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4221         else
4222                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4223         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4224                 return -EINVAL;
4225
4226         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4227                 params.capability =
4228                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4229                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4230         }
4231
4232         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4233                 params.ext_capab =
4234                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4235                 params.ext_capab_len =
4236                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4237         }
4238
4239         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4240                 params.ht_capa =
4241                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4242
4243         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4244                 params.vht_capa =
4245                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4246
4247         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4248                 params.opmode_notif_used = true;
4249                 params.opmode_notif =
4250                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4251         }
4252
4253         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4254                 params.plink_action =
4255                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4256                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4257                         return -EINVAL;
4258         }
4259
4260         err = nl80211_parse_sta_channel_info(info, &params);
4261         if (err)
4262                 return err;
4263
4264         err = nl80211_parse_sta_wme(info, &params);
4265         if (err)
4266                 return err;
4267
4268         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4269                 return -EINVAL;
4270
4271         /* When you run into this, adjust the code below for the new flag */
4272         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4273
4274         switch (dev->ieee80211_ptr->iftype) {
4275         case NL80211_IFTYPE_AP:
4276         case NL80211_IFTYPE_AP_VLAN:
4277         case NL80211_IFTYPE_P2P_GO:
4278                 /* ignore WME attributes if iface/sta is not capable */
4279                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4280                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4281                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4282
4283                 /* TDLS peers cannot be added */
4284                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4285                     info->attrs[NL80211_ATTR_PEER_AID])
4286                         return -EINVAL;
4287                 /* but don't bother the driver with it */
4288                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4289
4290                 /* allow authenticated/associated only if driver handles it */
4291                 if (!(rdev->wiphy.features &
4292                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4293                     params.sta_flags_mask &
4294                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4295                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4296                         return -EINVAL;
4297
4298                 /* must be last in here for error handling */
4299                 params.vlan = get_vlan(info, rdev);
4300                 if (IS_ERR(params.vlan))
4301                         return PTR_ERR(params.vlan);
4302                 break;
4303         case NL80211_IFTYPE_MESH_POINT:
4304                 /* ignore uAPSD data */
4305                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4306
4307                 /* associated is disallowed */
4308                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4309                         return -EINVAL;
4310                 /* TDLS peers cannot be added */
4311                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4312                     info->attrs[NL80211_ATTR_PEER_AID])
4313                         return -EINVAL;
4314                 break;
4315         case NL80211_IFTYPE_STATION:
4316         case NL80211_IFTYPE_P2P_CLIENT:
4317                 /* ignore uAPSD data */
4318                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4319
4320                 /* these are disallowed */
4321                 if (params.sta_flags_mask &
4322                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4323                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4324                         return -EINVAL;
4325                 /* Only TDLS peers can be added */
4326                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4327                         return -EINVAL;
4328                 /* Can only add if TDLS ... */
4329                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4330                         return -EOPNOTSUPP;
4331                 /* ... with external setup is supported */
4332                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4333                         return -EOPNOTSUPP;
4334                 /*
4335                  * Older wpa_supplicant versions always mark the TDLS peer
4336                  * as authorized, but it shouldn't yet be.
4337                  */
4338                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4339                 break;
4340         default:
4341                 return -EOPNOTSUPP;
4342         }
4343
4344         /* be aware of params.vlan when changing code here */
4345
4346         err = rdev_add_station(rdev, dev, mac_addr, &params);
4347
4348         if (params.vlan)
4349                 dev_put(params.vlan);
4350         return err;
4351 }
4352
4353 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4354 {
4355         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4356         struct net_device *dev = info->user_ptr[1];
4357         u8 *mac_addr = NULL;
4358
4359         if (info->attrs[NL80211_ATTR_MAC])
4360                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4361
4362         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4363             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4364             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4365             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4366                 return -EINVAL;
4367
4368         if (!rdev->ops->del_station)
4369                 return -EOPNOTSUPP;
4370
4371         return rdev_del_station(rdev, dev, mac_addr);
4372 }
4373
4374 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4375                                 int flags, struct net_device *dev,
4376                                 u8 *dst, u8 *next_hop,
4377                                 struct mpath_info *pinfo)
4378 {
4379         void *hdr;
4380         struct nlattr *pinfoattr;
4381
4382         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4383         if (!hdr)
4384                 return -1;
4385
4386         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4387             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4388             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4389             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4390                 goto nla_put_failure;
4391
4392         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4393         if (!pinfoattr)
4394                 goto nla_put_failure;
4395         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4396             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4397                         pinfo->frame_qlen))
4398                 goto nla_put_failure;
4399         if (((pinfo->filled & MPATH_INFO_SN) &&
4400              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4401             ((pinfo->filled & MPATH_INFO_METRIC) &&
4402              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4403                          pinfo->metric)) ||
4404             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4405              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4406                          pinfo->exptime)) ||
4407             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4408              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4409                         pinfo->flags)) ||
4410             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4411              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4412                          pinfo->discovery_timeout)) ||
4413             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4414              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4415                         pinfo->discovery_retries)))
4416                 goto nla_put_failure;
4417
4418         nla_nest_end(msg, pinfoattr);
4419
4420         return genlmsg_end(msg, hdr);
4421
4422  nla_put_failure:
4423         genlmsg_cancel(msg, hdr);
4424         return -EMSGSIZE;
4425 }
4426
4427 static int nl80211_dump_mpath(struct sk_buff *skb,
4428                               struct netlink_callback *cb)
4429 {
4430         struct mpath_info pinfo;
4431         struct cfg80211_registered_device *rdev;
4432         struct wireless_dev *wdev;
4433         u8 dst[ETH_ALEN];
4434         u8 next_hop[ETH_ALEN];
4435         int path_idx = cb->args[2];
4436         int err;
4437
4438         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4439         if (err)
4440                 return err;
4441
4442         if (!rdev->ops->dump_mpath) {
4443                 err = -EOPNOTSUPP;
4444                 goto out_err;
4445         }
4446
4447         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4448                 err = -EOPNOTSUPP;
4449                 goto out_err;
4450         }
4451
4452         while (1) {
4453                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4454                                       next_hop, &pinfo);
4455                 if (err == -ENOENT)
4456                         break;
4457                 if (err)
4458                         goto out_err;
4459
4460                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4461                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4462                                        wdev->netdev, dst, next_hop,
4463                                        &pinfo) < 0)
4464                         goto out;
4465
4466                 path_idx++;
4467         }
4468
4469
4470  out:
4471         cb->args[2] = path_idx;
4472         err = skb->len;
4473  out_err:
4474         nl80211_finish_wdev_dump(rdev);
4475         return err;
4476 }
4477
4478 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4479 {
4480         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4481         int err;
4482         struct net_device *dev = info->user_ptr[1];
4483         struct mpath_info pinfo;
4484         struct sk_buff *msg;
4485         u8 *dst = NULL;
4486         u8 next_hop[ETH_ALEN];
4487
4488         memset(&pinfo, 0, sizeof(pinfo));
4489
4490         if (!info->attrs[NL80211_ATTR_MAC])
4491                 return -EINVAL;
4492
4493         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4494
4495         if (!rdev->ops->get_mpath)
4496                 return -EOPNOTSUPP;
4497
4498         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4499                 return -EOPNOTSUPP;
4500
4501         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4502         if (err)
4503                 return err;
4504
4505         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4506         if (!msg)
4507                 return -ENOMEM;
4508
4509         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4510                                  dev, dst, next_hop, &pinfo) < 0) {
4511                 nlmsg_free(msg);
4512                 return -ENOBUFS;
4513         }
4514
4515         return genlmsg_reply(msg, info);
4516 }
4517
4518 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4519 {
4520         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4521         struct net_device *dev = info->user_ptr[1];
4522         u8 *dst = NULL;
4523         u8 *next_hop = NULL;
4524
4525         if (!info->attrs[NL80211_ATTR_MAC])
4526                 return -EINVAL;
4527
4528         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4529                 return -EINVAL;
4530
4531         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4532         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4533
4534         if (!rdev->ops->change_mpath)
4535                 return -EOPNOTSUPP;
4536
4537         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4538                 return -EOPNOTSUPP;
4539
4540         return rdev_change_mpath(rdev, dev, dst, next_hop);
4541 }
4542
4543 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4544 {
4545         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4546         struct net_device *dev = info->user_ptr[1];
4547         u8 *dst = NULL;
4548         u8 *next_hop = NULL;
4549
4550         if (!info->attrs[NL80211_ATTR_MAC])
4551                 return -EINVAL;
4552
4553         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4554                 return -EINVAL;
4555
4556         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4557         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4558
4559         if (!rdev->ops->add_mpath)
4560                 return -EOPNOTSUPP;
4561
4562         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4563                 return -EOPNOTSUPP;
4564
4565         return rdev_add_mpath(rdev, dev, dst, next_hop);
4566 }
4567
4568 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4569 {
4570         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4571         struct net_device *dev = info->user_ptr[1];
4572         u8 *dst = NULL;
4573
4574         if (info->attrs[NL80211_ATTR_MAC])
4575                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4576
4577         if (!rdev->ops->del_mpath)
4578                 return -EOPNOTSUPP;
4579
4580         return rdev_del_mpath(rdev, dev, dst);
4581 }
4582
4583 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4584 {
4585         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4586         struct net_device *dev = info->user_ptr[1];
4587         struct wireless_dev *wdev = dev->ieee80211_ptr;
4588         struct bss_parameters params;
4589         int err;
4590
4591         memset(&params, 0, sizeof(params));
4592         /* default to not changing parameters */
4593         params.use_cts_prot = -1;
4594         params.use_short_preamble = -1;
4595         params.use_short_slot_time = -1;
4596         params.ap_isolate = -1;
4597         params.ht_opmode = -1;
4598         params.p2p_ctwindow = -1;
4599         params.p2p_opp_ps = -1;
4600
4601         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4602                 params.use_cts_prot =
4603                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4604         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4605                 params.use_short_preamble =
4606                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4607         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4608                 params.use_short_slot_time =
4609                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4610         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4611                 params.basic_rates =
4612                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4613                 params.basic_rates_len =
4614                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4615         }
4616         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4617                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4618         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4619                 params.ht_opmode =
4620                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4621
4622         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4623                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4624                         return -EINVAL;
4625                 params.p2p_ctwindow =
4626                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4627                 if (params.p2p_ctwindow < 0)
4628                         return -EINVAL;
4629                 if (params.p2p_ctwindow != 0 &&
4630                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4631                         return -EINVAL;
4632         }
4633
4634         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4635                 u8 tmp;
4636
4637                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4638                         return -EINVAL;
4639                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4640                 if (tmp > 1)
4641                         return -EINVAL;
4642                 params.p2p_opp_ps = tmp;
4643                 if (params.p2p_opp_ps &&
4644                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4645                         return -EINVAL;
4646         }
4647
4648         if (!rdev->ops->change_bss)
4649                 return -EOPNOTSUPP;
4650
4651         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4652             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4653                 return -EOPNOTSUPP;
4654
4655         wdev_lock(wdev);
4656         err = rdev_change_bss(rdev, dev, &params);
4657         wdev_unlock(wdev);
4658
4659         return err;
4660 }
4661
4662 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4663         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4664         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4665         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4666         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4667         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4668         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4669         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
4670 };
4671
4672 static int parse_reg_rule(struct nlattr *tb[],
4673         struct ieee80211_reg_rule *reg_rule)
4674 {
4675         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4676         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4677
4678         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4679                 return -EINVAL;
4680         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4681                 return -EINVAL;
4682         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4683                 return -EINVAL;
4684         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4685                 return -EINVAL;
4686         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4687                 return -EINVAL;
4688
4689         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4690
4691         freq_range->start_freq_khz =
4692                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4693         freq_range->end_freq_khz =
4694                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4695         freq_range->max_bandwidth_khz =
4696                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4697
4698         power_rule->max_eirp =
4699                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4700
4701         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4702                 power_rule->max_antenna_gain =
4703                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4704
4705         if (tb[NL80211_ATTR_DFS_CAC_TIME])
4706                 reg_rule->dfs_cac_ms =
4707                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
4708
4709         return 0;
4710 }
4711
4712 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4713 {
4714         char *data = NULL;
4715         enum nl80211_user_reg_hint_type user_reg_hint_type;
4716
4717         /*
4718          * You should only get this when cfg80211 hasn't yet initialized
4719          * completely when built-in to the kernel right between the time
4720          * window between nl80211_init() and regulatory_init(), if that is
4721          * even possible.
4722          */
4723         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4724                 return -EINPROGRESS;
4725
4726         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4727                 user_reg_hint_type =
4728                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4729         else
4730                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4731
4732         switch (user_reg_hint_type) {
4733         case NL80211_USER_REG_HINT_USER:
4734         case NL80211_USER_REG_HINT_CELL_BASE:
4735                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4736                         return -EINVAL;
4737
4738                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4739                 return regulatory_hint_user(data, user_reg_hint_type);
4740         case NL80211_USER_REG_HINT_INDOOR:
4741                 return regulatory_hint_indoor_user();
4742         default:
4743                 return -EINVAL;
4744         }
4745 }
4746
4747 static int nl80211_get_mesh_config(struct sk_buff *skb,
4748                                    struct genl_info *info)
4749 {
4750         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4751         struct net_device *dev = info->user_ptr[1];
4752         struct wireless_dev *wdev = dev->ieee80211_ptr;
4753         struct mesh_config cur_params;
4754         int err = 0;
4755         void *hdr;
4756         struct nlattr *pinfoattr;
4757         struct sk_buff *msg;
4758
4759         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4760                 return -EOPNOTSUPP;
4761
4762         if (!rdev->ops->get_mesh_config)
4763                 return -EOPNOTSUPP;
4764
4765         wdev_lock(wdev);
4766         /* If not connected, get default parameters */
4767         if (!wdev->mesh_id_len)
4768                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4769         else
4770                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4771         wdev_unlock(wdev);
4772
4773         if (err)
4774                 return err;
4775
4776         /* Draw up a netlink message to send back */
4777         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4778         if (!msg)
4779                 return -ENOMEM;
4780         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4781                              NL80211_CMD_GET_MESH_CONFIG);
4782         if (!hdr)
4783                 goto out;
4784         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4785         if (!pinfoattr)
4786                 goto nla_put_failure;
4787         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4788             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4789                         cur_params.dot11MeshRetryTimeout) ||
4790             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4791                         cur_params.dot11MeshConfirmTimeout) ||
4792             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4793                         cur_params.dot11MeshHoldingTimeout) ||
4794             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4795                         cur_params.dot11MeshMaxPeerLinks) ||
4796             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4797                        cur_params.dot11MeshMaxRetries) ||
4798             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4799                        cur_params.dot11MeshTTL) ||
4800             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4801                        cur_params.element_ttl) ||
4802             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4803                        cur_params.auto_open_plinks) ||
4804             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4805                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4806             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4807                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4808             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4809                         cur_params.path_refresh_time) ||
4810             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4811                         cur_params.min_discovery_timeout) ||
4812             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4813                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4814             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4815                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4816             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4817                         cur_params.dot11MeshHWMPperrMinInterval) ||
4818             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4819                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4820             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4821                        cur_params.dot11MeshHWMPRootMode) ||
4822             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4823                         cur_params.dot11MeshHWMPRannInterval) ||
4824             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4825                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4826             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4827                        cur_params.dot11MeshForwarding) ||
4828             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4829                         cur_params.rssi_threshold) ||
4830             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4831                         cur_params.ht_opmode) ||
4832             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4833                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4834             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4835                         cur_params.dot11MeshHWMProotInterval) ||
4836             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4837                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4838             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4839                         cur_params.power_mode) ||
4840             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4841                         cur_params.dot11MeshAwakeWindowDuration) ||
4842             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4843                         cur_params.plink_timeout))
4844                 goto nla_put_failure;
4845         nla_nest_end(msg, pinfoattr);
4846         genlmsg_end(msg, hdr);
4847         return genlmsg_reply(msg, info);
4848
4849  nla_put_failure:
4850         genlmsg_cancel(msg, hdr);
4851  out:
4852         nlmsg_free(msg);
4853         return -ENOBUFS;
4854 }
4855
4856 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4857         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4858         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4859         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4860         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4861         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4862         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4863         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4864         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4865         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4866         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4867         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4868         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4869         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4870         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4871         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4872         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4873         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4874         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4875         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4876         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4877         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4878         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4879         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4880         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4881         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4882         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4883         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4884         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4885 };
4886
4887 static const struct nla_policy
4888         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4889         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4890         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4891         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4892         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4893         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4894         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4895         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4896                                     .len = IEEE80211_MAX_DATA_LEN },
4897         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4898 };
4899
4900 static int nl80211_parse_mesh_config(struct genl_info *info,
4901                                      struct mesh_config *cfg,
4902                                      u32 *mask_out)
4903 {
4904         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4905         u32 mask = 0;
4906
4907 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4908 do {                                                                        \
4909         if (tb[attr]) {                                                     \
4910                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4911                         return -EINVAL;                                     \
4912                 cfg->param = fn(tb[attr]);                                  \
4913                 mask |= (1 << (attr - 1));                                  \
4914         }                                                                   \
4915 } while (0)
4916
4917
4918         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4919                 return -EINVAL;
4920         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4921                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4922                              nl80211_meshconf_params_policy))
4923                 return -EINVAL;
4924
4925         /* This makes sure that there aren't more than 32 mesh config
4926          * parameters (otherwise our bitfield scheme would not work.) */
4927         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4928
4929         /* Fill in the params struct */
4930         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4931                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4932                                   nla_get_u16);
4933         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4934                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4935                                   nla_get_u16);
4936         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4937                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4938                                   nla_get_u16);
4939         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4940                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4941                                   nla_get_u16);
4942         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4943                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4944                                   nla_get_u8);
4945         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4946                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4947         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4948                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4949                                   nla_get_u8);
4950         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4951                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4952                                   nla_get_u8);
4953         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4954                                   1, 255, mask,
4955                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4956                                   nla_get_u32);
4957         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4958                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4959                                   nla_get_u8);
4960         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4961                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4962                                   nla_get_u32);
4963         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4964                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4965                                   nla_get_u16);
4966         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4967                                   1, 65535, mask,
4968                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4969                                   nla_get_u32);
4970         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4971                                   1, 65535, mask,
4972                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4973                                   nla_get_u16);
4974         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4975                                   1, 65535, mask,
4976                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4977                                   nla_get_u16);
4978         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4979                                   dot11MeshHWMPnetDiameterTraversalTime,
4980                                   1, 65535, mask,
4981                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4982                                   nla_get_u16);
4983         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4984                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4985                                   nla_get_u8);
4986         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4987                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4988                                   nla_get_u16);
4989         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4990                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4991                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4992                                   nla_get_u8);
4993         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4994                                   mask, NL80211_MESHCONF_FORWARDING,
4995                                   nla_get_u8);
4996         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
4997                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4998                                   nla_get_s32);
4999         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5000                                   mask, NL80211_MESHCONF_HT_OPMODE,
5001                                   nla_get_u16);
5002         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5003                                   1, 65535, mask,
5004                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5005                                   nla_get_u32);
5006         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5007                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5008                                   nla_get_u16);
5009         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5010                                   dot11MeshHWMPconfirmationInterval,
5011                                   1, 65535, mask,
5012                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5013                                   nla_get_u16);
5014         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5015                                   NL80211_MESH_POWER_ACTIVE,
5016                                   NL80211_MESH_POWER_MAX,
5017                                   mask, NL80211_MESHCONF_POWER_MODE,
5018                                   nla_get_u32);
5019         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5020                                   0, 65535, mask,
5021                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5022         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
5023                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5024                                   nla_get_u32);
5025         if (mask_out)
5026                 *mask_out = mask;
5027
5028         return 0;
5029
5030 #undef FILL_IN_MESH_PARAM_IF_SET
5031 }
5032
5033 static int nl80211_parse_mesh_setup(struct genl_info *info,
5034                                      struct mesh_setup *setup)
5035 {
5036         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5037         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5038
5039         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5040                 return -EINVAL;
5041         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5042                              info->attrs[NL80211_ATTR_MESH_SETUP],
5043                              nl80211_mesh_setup_params_policy))
5044                 return -EINVAL;
5045
5046         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5047                 setup->sync_method =
5048                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5049                  IEEE80211_SYNC_METHOD_VENDOR :
5050                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5051
5052         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5053                 setup->path_sel_proto =
5054                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5055                  IEEE80211_PATH_PROTOCOL_VENDOR :
5056                  IEEE80211_PATH_PROTOCOL_HWMP;
5057
5058         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5059                 setup->path_metric =
5060                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5061                  IEEE80211_PATH_METRIC_VENDOR :
5062                  IEEE80211_PATH_METRIC_AIRTIME;
5063
5064
5065         if (tb[NL80211_MESH_SETUP_IE]) {
5066                 struct nlattr *ieattr =
5067                         tb[NL80211_MESH_SETUP_IE];
5068                 if (!is_valid_ie_attr(ieattr))
5069                         return -EINVAL;
5070                 setup->ie = nla_data(ieattr);
5071                 setup->ie_len = nla_len(ieattr);
5072         }
5073         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5074             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5075                 return -EINVAL;
5076         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5077         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5078         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5079         if (setup->is_secure)
5080                 setup->user_mpm = true;
5081
5082         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5083                 if (!setup->user_mpm)
5084                         return -EINVAL;
5085                 setup->auth_id =
5086                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5087         }
5088
5089         return 0;
5090 }
5091
5092 static int nl80211_update_mesh_config(struct sk_buff *skb,
5093                                       struct genl_info *info)
5094 {
5095         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5096         struct net_device *dev = info->user_ptr[1];
5097         struct wireless_dev *wdev = dev->ieee80211_ptr;
5098         struct mesh_config cfg;
5099         u32 mask;
5100         int err;
5101
5102         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5103                 return -EOPNOTSUPP;
5104
5105         if (!rdev->ops->update_mesh_config)
5106                 return -EOPNOTSUPP;
5107
5108         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5109         if (err)
5110                 return err;
5111
5112         wdev_lock(wdev);
5113         if (!wdev->mesh_id_len)
5114                 err = -ENOLINK;
5115
5116         if (!err)
5117                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5118
5119         wdev_unlock(wdev);
5120
5121         return err;
5122 }
5123
5124 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
5125 {
5126         const struct ieee80211_regdomain *regdom;
5127         struct sk_buff *msg;
5128         void *hdr = NULL;
5129         struct nlattr *nl_reg_rules;
5130         unsigned int i;
5131
5132         if (!cfg80211_regdomain)
5133                 return -EINVAL;
5134
5135         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5136         if (!msg)
5137                 return -ENOBUFS;
5138
5139         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5140                              NL80211_CMD_GET_REG);
5141         if (!hdr)
5142                 goto put_failure;
5143
5144         if (reg_last_request_cell_base() &&
5145             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5146                         NL80211_USER_REG_HINT_CELL_BASE))
5147                 goto nla_put_failure;
5148
5149         rcu_read_lock();
5150         regdom = rcu_dereference(cfg80211_regdomain);
5151
5152         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5153             (regdom->dfs_region &&
5154              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5155                 goto nla_put_failure_rcu;
5156
5157         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5158         if (!nl_reg_rules)
5159                 goto nla_put_failure_rcu;
5160
5161         for (i = 0; i < regdom->n_reg_rules; i++) {
5162                 struct nlattr *nl_reg_rule;
5163                 const struct ieee80211_reg_rule *reg_rule;
5164                 const struct ieee80211_freq_range *freq_range;
5165                 const struct ieee80211_power_rule *power_rule;
5166                 unsigned int max_bandwidth_khz;
5167
5168                 reg_rule = &regdom->reg_rules[i];
5169                 freq_range = &reg_rule->freq_range;
5170                 power_rule = &reg_rule->power_rule;
5171
5172                 nl_reg_rule = nla_nest_start(msg, i);
5173                 if (!nl_reg_rule)
5174                         goto nla_put_failure_rcu;
5175
5176                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5177                 if (!max_bandwidth_khz)
5178                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5179                                                                   reg_rule);
5180
5181                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5182                                 reg_rule->flags) ||
5183                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5184                                 freq_range->start_freq_khz) ||
5185                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5186                                 freq_range->end_freq_khz) ||
5187                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5188                                 max_bandwidth_khz) ||
5189                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5190                                 power_rule->max_antenna_gain) ||
5191                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5192                                 power_rule->max_eirp) ||
5193                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5194                                 reg_rule->dfs_cac_ms))
5195                         goto nla_put_failure_rcu;
5196
5197                 nla_nest_end(msg, nl_reg_rule);
5198         }
5199         rcu_read_unlock();
5200
5201         nla_nest_end(msg, nl_reg_rules);
5202
5203         genlmsg_end(msg, hdr);
5204         return genlmsg_reply(msg, info);
5205
5206 nla_put_failure_rcu:
5207         rcu_read_unlock();
5208 nla_put_failure:
5209         genlmsg_cancel(msg, hdr);
5210 put_failure:
5211         nlmsg_free(msg);
5212         return -EMSGSIZE;
5213 }
5214
5215 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5216 {
5217         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5218         struct nlattr *nl_reg_rule;
5219         char *alpha2 = NULL;
5220         int rem_reg_rules = 0, r = 0;
5221         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5222         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5223         struct ieee80211_regdomain *rd = NULL;
5224
5225         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5226                 return -EINVAL;
5227
5228         if (!info->attrs[NL80211_ATTR_REG_RULES])
5229                 return -EINVAL;
5230
5231         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5232
5233         if (info->attrs[NL80211_ATTR_DFS_REGION])
5234                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5235
5236         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5237                             rem_reg_rules) {
5238                 num_rules++;
5239                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5240                         return -EINVAL;
5241         }
5242
5243         if (!reg_is_valid_request(alpha2))
5244                 return -EINVAL;
5245
5246         size_of_regd = sizeof(struct ieee80211_regdomain) +
5247                        num_rules * sizeof(struct ieee80211_reg_rule);
5248
5249         rd = kzalloc(size_of_regd, GFP_KERNEL);
5250         if (!rd)
5251                 return -ENOMEM;
5252
5253         rd->n_reg_rules = num_rules;
5254         rd->alpha2[0] = alpha2[0];
5255         rd->alpha2[1] = alpha2[1];
5256
5257         /*
5258          * Disable DFS master mode if the DFS region was
5259          * not supported or known on this kernel.
5260          */
5261         if (reg_supported_dfs_region(dfs_region))
5262                 rd->dfs_region = dfs_region;
5263
5264         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5265                             rem_reg_rules) {
5266                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5267                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5268                               reg_rule_policy);
5269                 if (r)
5270                         goto bad_reg;
5271                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5272                 if (r)
5273                         goto bad_reg;
5274
5275                 rule_idx++;
5276
5277                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5278                         r = -EINVAL;
5279                         goto bad_reg;
5280                 }
5281         }
5282
5283         r = set_regdom(rd);
5284         /* set_regdom took ownership */
5285         rd = NULL;
5286
5287  bad_reg:
5288         kfree(rd);
5289         return r;
5290 }
5291
5292 static int validate_scan_freqs(struct nlattr *freqs)
5293 {
5294         struct nlattr *attr1, *attr2;
5295         int n_channels = 0, tmp1, tmp2;
5296
5297         nla_for_each_nested(attr1, freqs, tmp1) {
5298                 n_channels++;
5299                 /*
5300                  * Some hardware has a limited channel list for
5301                  * scanning, and it is pretty much nonsensical
5302                  * to scan for a channel twice, so disallow that
5303                  * and don't require drivers to check that the
5304                  * channel list they get isn't longer than what
5305                  * they can scan, as long as they can scan all
5306                  * the channels they registered at once.
5307                  */
5308                 nla_for_each_nested(attr2, freqs, tmp2)
5309                         if (attr1 != attr2 &&
5310                             nla_get_u32(attr1) == nla_get_u32(attr2))
5311                                 return 0;
5312         }
5313
5314         return n_channels;
5315 }
5316
5317 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5318 {
5319         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5320         struct wireless_dev *wdev = info->user_ptr[1];
5321         struct cfg80211_scan_request *request;
5322         struct nlattr *attr;
5323         struct wiphy *wiphy;
5324         int err, tmp, n_ssids = 0, n_channels, i;
5325         size_t ie_len;
5326
5327         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5328                 return -EINVAL;
5329
5330         wiphy = &rdev->wiphy;
5331
5332         if (!rdev->ops->scan)
5333                 return -EOPNOTSUPP;
5334
5335         if (rdev->scan_req || rdev->scan_msg) {
5336                 err = -EBUSY;
5337                 goto unlock;
5338         }
5339
5340         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5341                 n_channels = validate_scan_freqs(
5342                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5343                 if (!n_channels) {
5344                         err = -EINVAL;
5345                         goto unlock;
5346                 }
5347         } else {
5348                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5349         }
5350
5351         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5352                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5353                         n_ssids++;
5354
5355         if (n_ssids > wiphy->max_scan_ssids) {
5356                 err = -EINVAL;
5357                 goto unlock;
5358         }
5359
5360         if (info->attrs[NL80211_ATTR_IE])
5361                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5362         else
5363                 ie_len = 0;
5364
5365         if (ie_len > wiphy->max_scan_ie_len) {
5366                 err = -EINVAL;
5367                 goto unlock;
5368         }
5369
5370         request = kzalloc(sizeof(*request)
5371                         + sizeof(*request->ssids) * n_ssids
5372                         + sizeof(*request->channels) * n_channels
5373                         + ie_len, GFP_KERNEL);
5374         if (!request) {
5375                 err = -ENOMEM;
5376                 goto unlock;
5377         }
5378
5379         if (n_ssids)
5380                 request->ssids = (void *)&request->channels[n_channels];
5381         request->n_ssids = n_ssids;
5382         if (ie_len) {
5383                 if (request->ssids)
5384                         request->ie = (void *)(request->ssids + n_ssids);
5385                 else
5386                         request->ie = (void *)(request->channels + n_channels);
5387         }
5388
5389         i = 0;
5390         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5391                 /* user specified, bail out if channel not found */
5392                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5393                         struct ieee80211_channel *chan;
5394
5395                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5396
5397                         if (!chan) {
5398                                 err = -EINVAL;
5399                                 goto out_free;
5400                         }
5401
5402                         /* ignore disabled channels */
5403                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5404                                 continue;
5405
5406                         request->channels[i] = chan;
5407                         i++;
5408                 }
5409         } else {
5410                 enum ieee80211_band band;
5411
5412                 /* all channels */
5413                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5414                         int j;
5415                         if (!wiphy->bands[band])
5416                                 continue;
5417                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5418                                 struct ieee80211_channel *chan;
5419
5420                                 chan = &wiphy->bands[band]->channels[j];
5421
5422                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5423                                         continue;
5424
5425                                 request->channels[i] = chan;
5426                                 i++;
5427                         }
5428                 }
5429         }
5430
5431         if (!i) {
5432                 err = -EINVAL;
5433                 goto out_free;
5434         }
5435
5436         request->n_channels = i;
5437
5438         i = 0;
5439         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5440                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5441                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5442                                 err = -EINVAL;
5443                                 goto out_free;
5444                         }
5445                         request->ssids[i].ssid_len = nla_len(attr);
5446                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5447                         i++;
5448                 }
5449         }
5450
5451         if (info->attrs[NL80211_ATTR_IE]) {
5452                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5453                 memcpy((void *)request->ie,
5454                        nla_data(info->attrs[NL80211_ATTR_IE]),
5455                        request->ie_len);
5456         }
5457
5458         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5459                 if (wiphy->bands[i])
5460                         request->rates[i] =
5461                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5462
5463         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5464                 nla_for_each_nested(attr,
5465                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5466                                     tmp) {
5467                         enum ieee80211_band band = nla_type(attr);
5468
5469                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5470                                 err = -EINVAL;
5471                                 goto out_free;
5472                         }
5473
5474                         if (!wiphy->bands[band])
5475                                 continue;
5476
5477                         err = ieee80211_get_ratemask(wiphy->bands[band],
5478                                                      nla_data(attr),
5479                                                      nla_len(attr),
5480                                                      &request->rates[band]);
5481                         if (err)
5482                                 goto out_free;
5483                 }
5484         }
5485
5486         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5487                 request->flags = nla_get_u32(
5488                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5489                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5490                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5491                         err = -EOPNOTSUPP;
5492                         goto out_free;
5493                 }
5494         }
5495
5496         request->no_cck =
5497                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5498
5499         request->wdev = wdev;
5500         request->wiphy = &rdev->wiphy;
5501         request->scan_start = jiffies;
5502
5503         rdev->scan_req = request;
5504         err = rdev_scan(rdev, request);
5505
5506         if (!err) {
5507                 nl80211_send_scan_start(rdev, wdev);
5508                 if (wdev->netdev)
5509                         dev_hold(wdev->netdev);
5510         } else {
5511  out_free:
5512                 rdev->scan_req = NULL;
5513                 kfree(request);
5514         }
5515
5516  unlock:
5517         return err;
5518 }
5519
5520 static int nl80211_start_sched_scan(struct sk_buff *skb,
5521                                     struct genl_info *info)
5522 {
5523         struct cfg80211_sched_scan_request *request;
5524         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5525         struct net_device *dev = info->user_ptr[1];
5526         struct nlattr *attr;
5527         struct wiphy *wiphy;
5528         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5529         u32 interval;
5530         enum ieee80211_band band;
5531         size_t ie_len;
5532         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5533         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
5534
5535         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5536             !rdev->ops->sched_scan_start)
5537                 return -EOPNOTSUPP;
5538
5539         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5540                 return -EINVAL;
5541
5542         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5543                 return -EINVAL;
5544
5545         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5546         if (interval == 0)
5547                 return -EINVAL;
5548
5549         wiphy = &rdev->wiphy;
5550
5551         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5552                 n_channels = validate_scan_freqs(
5553                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5554                 if (!n_channels)
5555                         return -EINVAL;
5556         } else {
5557                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5558         }
5559
5560         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5561                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5562                                     tmp)
5563                         n_ssids++;
5564
5565         if (n_ssids > wiphy->max_sched_scan_ssids)
5566                 return -EINVAL;
5567
5568         /*
5569          * First, count the number of 'real' matchsets. Due to an issue with
5570          * the old implementation, matchsets containing only the RSSI attribute
5571          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
5572          * RSSI for all matchsets, rather than their own matchset for reporting
5573          * all APs with a strong RSSI. This is needed to be compatible with
5574          * older userspace that treated a matchset with only the RSSI as the
5575          * global RSSI for all other matchsets - if there are other matchsets.
5576          */
5577         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5578                 nla_for_each_nested(attr,
5579                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5580                                     tmp) {
5581                         struct nlattr *rssi;
5582
5583                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5584                                         nla_data(attr), nla_len(attr),
5585                                         nl80211_match_policy);
5586                         if (err)
5587                                 return err;
5588                         /* add other standalone attributes here */
5589                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
5590                                 n_match_sets++;
5591                                 continue;
5592                         }
5593                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5594                         if (rssi)
5595                                 default_match_rssi = nla_get_s32(rssi);
5596                 }
5597         }
5598
5599         /* However, if there's no other matchset, add the RSSI one */
5600         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
5601                 n_match_sets = 1;
5602
5603         if (n_match_sets > wiphy->max_match_sets)
5604                 return -EINVAL;
5605
5606         if (info->attrs[NL80211_ATTR_IE])
5607                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5608         else
5609                 ie_len = 0;
5610
5611         if (ie_len > wiphy->max_sched_scan_ie_len)
5612                 return -EINVAL;
5613
5614         if (rdev->sched_scan_req) {
5615                 err = -EINPROGRESS;
5616                 goto out;
5617         }
5618
5619         request = kzalloc(sizeof(*request)
5620                         + sizeof(*request->ssids) * n_ssids
5621                         + sizeof(*request->match_sets) * n_match_sets
5622                         + sizeof(*request->channels) * n_channels
5623                         + ie_len, GFP_KERNEL);
5624         if (!request) {
5625                 err = -ENOMEM;
5626                 goto out;
5627         }
5628
5629         if (n_ssids)
5630                 request->ssids = (void *)&request->channels[n_channels];
5631         request->n_ssids = n_ssids;
5632         if (ie_len) {
5633                 if (request->ssids)
5634                         request->ie = (void *)(request->ssids + n_ssids);
5635                 else
5636                         request->ie = (void *)(request->channels + n_channels);
5637         }
5638
5639         if (n_match_sets) {
5640                 if (request->ie)
5641                         request->match_sets = (void *)(request->ie + ie_len);
5642                 else if (request->ssids)
5643                         request->match_sets =
5644                                 (void *)(request->ssids + n_ssids);
5645                 else
5646                         request->match_sets =
5647                                 (void *)(request->channels + n_channels);
5648         }
5649         request->n_match_sets = n_match_sets;
5650
5651         i = 0;
5652         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5653                 /* user specified, bail out if channel not found */
5654                 nla_for_each_nested(attr,
5655                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5656                                     tmp) {
5657                         struct ieee80211_channel *chan;
5658
5659                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5660
5661                         if (!chan) {
5662                                 err = -EINVAL;
5663                                 goto out_free;
5664                         }
5665
5666                         /* ignore disabled channels */
5667                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5668                                 continue;
5669
5670                         request->channels[i] = chan;
5671                         i++;
5672                 }
5673         } else {
5674                 /* all channels */
5675                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5676                         int j;
5677                         if (!wiphy->bands[band])
5678                                 continue;
5679                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5680                                 struct ieee80211_channel *chan;
5681
5682                                 chan = &wiphy->bands[band]->channels[j];
5683
5684                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5685                                         continue;
5686
5687                                 request->channels[i] = chan;
5688                                 i++;
5689                         }
5690                 }
5691         }
5692
5693         if (!i) {
5694                 err = -EINVAL;
5695                 goto out_free;
5696         }
5697
5698         request->n_channels = i;
5699
5700         i = 0;
5701         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5702                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5703                                     tmp) {
5704                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5705                                 err = -EINVAL;
5706                                 goto out_free;
5707                         }
5708                         request->ssids[i].ssid_len = nla_len(attr);
5709                         memcpy(request->ssids[i].ssid, nla_data(attr),
5710                                nla_len(attr));
5711                         i++;
5712                 }
5713         }
5714
5715         i = 0;
5716         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5717                 nla_for_each_nested(attr,
5718                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5719                                     tmp) {
5720                         struct nlattr *ssid, *rssi;
5721
5722                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5723                                         nla_data(attr), nla_len(attr),
5724                                         nl80211_match_policy);
5725                         if (err)
5726                                 goto out_free;
5727                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5728                         if (ssid) {
5729                                 if (WARN_ON(i >= n_match_sets)) {
5730                                         /* this indicates a programming error,
5731                                          * the loop above should have verified
5732                                          * things properly
5733                                          */
5734                                         err = -EINVAL;
5735                                         goto out_free;
5736                                 }
5737
5738                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5739                                         err = -EINVAL;
5740                                         goto out_free;
5741                                 }
5742                                 memcpy(request->match_sets[i].ssid.ssid,
5743                                        nla_data(ssid), nla_len(ssid));
5744                                 request->match_sets[i].ssid.ssid_len =
5745                                         nla_len(ssid);
5746                                 /* special attribute - old implemenation w/a */
5747                                 request->match_sets[i].rssi_thold =
5748                                         default_match_rssi;
5749                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5750                                 if (rssi)
5751                                         request->match_sets[i].rssi_thold =
5752                                                 nla_get_s32(rssi);
5753                         }
5754                         i++;
5755                 }
5756
5757                 /* there was no other matchset, so the RSSI one is alone */
5758                 if (i == 0)
5759                         request->match_sets[0].rssi_thold = default_match_rssi;
5760
5761                 request->min_rssi_thold = INT_MAX;
5762                 for (i = 0; i < n_match_sets; i++)
5763                         request->min_rssi_thold =
5764                                 min(request->match_sets[i].rssi_thold,
5765                                     request->min_rssi_thold);
5766         } else {
5767                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
5768         }
5769
5770         if (ie_len) {
5771                 request->ie_len = ie_len;
5772                 memcpy((void *)request->ie,
5773                        nla_data(info->attrs[NL80211_ATTR_IE]),
5774                        request->ie_len);
5775         }
5776
5777         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5778                 request->flags = nla_get_u32(
5779                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5780                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5781                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5782                         err = -EOPNOTSUPP;
5783                         goto out_free;
5784                 }
5785         }
5786
5787         request->dev = dev;
5788         request->wiphy = &rdev->wiphy;
5789         request->interval = interval;
5790         request->scan_start = jiffies;
5791
5792         err = rdev_sched_scan_start(rdev, dev, request);
5793         if (!err) {
5794                 rdev->sched_scan_req = request;
5795                 nl80211_send_sched_scan(rdev, dev,
5796                                         NL80211_CMD_START_SCHED_SCAN);
5797                 goto out;
5798         }
5799
5800 out_free:
5801         kfree(request);
5802 out:
5803         return err;
5804 }
5805
5806 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5807                                    struct genl_info *info)
5808 {
5809         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5810
5811         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5812             !rdev->ops->sched_scan_stop)
5813                 return -EOPNOTSUPP;
5814
5815         return __cfg80211_stop_sched_scan(rdev, false);
5816 }
5817
5818 static int nl80211_start_radar_detection(struct sk_buff *skb,
5819                                          struct genl_info *info)
5820 {
5821         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5822         struct net_device *dev = info->user_ptr[1];
5823         struct wireless_dev *wdev = dev->ieee80211_ptr;
5824         struct cfg80211_chan_def chandef;
5825         enum nl80211_dfs_regions dfs_region;
5826         unsigned int cac_time_ms;
5827         int err;
5828
5829         dfs_region = reg_get_dfs_region(wdev->wiphy);
5830         if (dfs_region == NL80211_DFS_UNSET)
5831                 return -EINVAL;
5832
5833         err = nl80211_parse_chandef(rdev, info, &chandef);
5834         if (err)
5835                 return err;
5836
5837         if (netif_carrier_ok(dev))
5838                 return -EBUSY;
5839
5840         if (wdev->cac_started)
5841                 return -EBUSY;
5842
5843         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
5844                                             wdev->iftype);
5845         if (err < 0)
5846                 return err;
5847
5848         if (err == 0)
5849                 return -EINVAL;
5850
5851         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
5852                 return -EINVAL;
5853
5854         if (!rdev->ops->start_radar_detection)
5855                 return -EOPNOTSUPP;
5856
5857         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
5858         if (WARN_ON(!cac_time_ms))
5859                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
5860
5861         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
5862                                                cac_time_ms);
5863         if (!err) {
5864                 wdev->chandef = chandef;
5865                 wdev->cac_started = true;
5866                 wdev->cac_start_time = jiffies;
5867                 wdev->cac_time_ms = cac_time_ms;
5868         }
5869         return err;
5870 }
5871
5872 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
5873 {
5874         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5875         struct net_device *dev = info->user_ptr[1];
5876         struct wireless_dev *wdev = dev->ieee80211_ptr;
5877         struct cfg80211_csa_settings params;
5878         /* csa_attrs is defined static to avoid waste of stack size - this
5879          * function is called under RTNL lock, so this should not be a problem.
5880          */
5881         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
5882         u8 radar_detect_width = 0;
5883         int err;
5884         bool need_new_beacon = false;
5885         int len, i;
5886
5887         if (!rdev->ops->channel_switch ||
5888             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
5889                 return -EOPNOTSUPP;
5890
5891         switch (dev->ieee80211_ptr->iftype) {
5892         case NL80211_IFTYPE_AP:
5893         case NL80211_IFTYPE_P2P_GO:
5894                 need_new_beacon = true;
5895
5896                 /* useless if AP is not running */
5897                 if (!wdev->beacon_interval)
5898                         return -ENOTCONN;
5899                 break;
5900         case NL80211_IFTYPE_ADHOC:
5901                 if (!wdev->ssid_len)
5902                         return -ENOTCONN;
5903                 break;
5904         case NL80211_IFTYPE_MESH_POINT:
5905                 if (!wdev->mesh_id_len)
5906                         return -ENOTCONN;
5907                 break;
5908         default:
5909                 return -EOPNOTSUPP;
5910         }
5911
5912         memset(&params, 0, sizeof(params));
5913
5914         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5915             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
5916                 return -EINVAL;
5917
5918         /* only important for AP, IBSS and mesh create IEs internally */
5919         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
5920                 return -EINVAL;
5921
5922         params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
5923
5924         if (!need_new_beacon)
5925                 goto skip_beacons;
5926
5927         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
5928         if (err)
5929                 return err;
5930
5931         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
5932                                info->attrs[NL80211_ATTR_CSA_IES],
5933                                nl80211_policy);
5934         if (err)
5935                 return err;
5936
5937         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
5938         if (err)
5939                 return err;
5940
5941         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
5942                 return -EINVAL;
5943
5944         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
5945         if (!len || (len % sizeof(u16)))
5946                 return -EINVAL;
5947
5948         params.n_counter_offsets_beacon = len / sizeof(u16);
5949         if (rdev->wiphy.max_num_csa_counters &&
5950             (params.n_counter_offsets_beacon >
5951              rdev->wiphy.max_num_csa_counters))
5952                 return -EINVAL;
5953
5954         params.counter_offsets_beacon =
5955                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
5956
5957         /* sanity checks - counters should fit and be the same */
5958         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
5959                 u16 offset = params.counter_offsets_beacon[i];
5960
5961                 if (offset >= params.beacon_csa.tail_len)
5962                         return -EINVAL;
5963
5964                 if (params.beacon_csa.tail[offset] != params.count)
5965                         return -EINVAL;
5966         }
5967
5968         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
5969                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
5970                 if (!len || (len % sizeof(u16)))
5971                         return -EINVAL;
5972
5973                 params.n_counter_offsets_presp = len / sizeof(u16);
5974                 if (rdev->wiphy.max_num_csa_counters &&
5975                     (params.n_counter_offsets_beacon >
5976                      rdev->wiphy.max_num_csa_counters))
5977                         return -EINVAL;
5978
5979                 params.counter_offsets_presp =
5980                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
5981
5982                 /* sanity checks - counters should fit and be the same */
5983                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
5984                         u16 offset = params.counter_offsets_presp[i];
5985
5986                         if (offset >= params.beacon_csa.probe_resp_len)
5987                                 return -EINVAL;
5988
5989                         if (params.beacon_csa.probe_resp[offset] !=
5990                             params.count)
5991                                 return -EINVAL;
5992                 }
5993         }
5994
5995 skip_beacons:
5996         err = nl80211_parse_chandef(rdev, info, &params.chandef);
5997         if (err)
5998                 return err;
5999
6000         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
6001                                      wdev->iftype))
6002                 return -EINVAL;
6003
6004         err = cfg80211_chandef_dfs_required(wdev->wiphy,
6005                                             &params.chandef,
6006                                             wdev->iftype);
6007         if (err < 0)
6008                 return err;
6009
6010         if (err > 0) {
6011                 radar_detect_width = BIT(params.chandef.width);
6012                 params.radar_required = true;
6013         }
6014
6015         /* TODO: I left this here for now.  With channel switch, the
6016          * verification is a bit more complicated, because we only do
6017          * it later when the channel switch really happens.
6018          */
6019         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
6020                                            params.chandef.chan,
6021                                            CHAN_MODE_SHARED,
6022                                            radar_detect_width);
6023         if (err)
6024                 return err;
6025
6026         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
6027                 params.block_tx = true;
6028
6029         wdev_lock(wdev);
6030         err = rdev_channel_switch(rdev, dev, &params);
6031         wdev_unlock(wdev);
6032
6033         return err;
6034 }
6035
6036 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
6037                             u32 seq, int flags,
6038                             struct cfg80211_registered_device *rdev,
6039                             struct wireless_dev *wdev,
6040                             struct cfg80211_internal_bss *intbss)
6041 {
6042         struct cfg80211_bss *res = &intbss->pub;
6043         const struct cfg80211_bss_ies *ies;
6044         void *hdr;
6045         struct nlattr *bss;
6046         bool tsf = false;
6047
6048         ASSERT_WDEV_LOCK(wdev);
6049
6050         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6051                              NL80211_CMD_NEW_SCAN_RESULTS);
6052         if (!hdr)
6053                 return -1;
6054
6055         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6056
6057         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6058                 goto nla_put_failure;
6059         if (wdev->netdev &&
6060             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6061                 goto nla_put_failure;
6062         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
6063                 goto nla_put_failure;
6064
6065         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6066         if (!bss)
6067                 goto nla_put_failure;
6068         if ((!is_zero_ether_addr(res->bssid) &&
6069              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6070                 goto nla_put_failure;
6071
6072         rcu_read_lock();
6073         ies = rcu_dereference(res->ies);
6074         if (ies) {
6075                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6076                         goto fail_unlock_rcu;
6077                 tsf = true;
6078                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6079                                         ies->len, ies->data))
6080                         goto fail_unlock_rcu;
6081         }
6082         ies = rcu_dereference(res->beacon_ies);
6083         if (ies) {
6084                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6085                         goto fail_unlock_rcu;
6086                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6087                                         ies->len, ies->data))
6088                         goto fail_unlock_rcu;
6089         }
6090         rcu_read_unlock();
6091
6092         if (res->beacon_interval &&
6093             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6094                 goto nla_put_failure;
6095         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6096             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6097             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6098             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6099                         jiffies_to_msecs(jiffies - intbss->ts)))
6100                 goto nla_put_failure;
6101
6102         switch (rdev->wiphy.signal_type) {
6103         case CFG80211_SIGNAL_TYPE_MBM:
6104                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6105                         goto nla_put_failure;
6106                 break;
6107         case CFG80211_SIGNAL_TYPE_UNSPEC:
6108                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6109                         goto nla_put_failure;
6110                 break;
6111         default:
6112                 break;
6113         }
6114
6115         switch (wdev->iftype) {
6116         case NL80211_IFTYPE_P2P_CLIENT:
6117         case NL80211_IFTYPE_STATION:
6118                 if (intbss == wdev->current_bss &&
6119                     nla_put_u32(msg, NL80211_BSS_STATUS,
6120                                 NL80211_BSS_STATUS_ASSOCIATED))
6121                         goto nla_put_failure;
6122                 break;
6123         case NL80211_IFTYPE_ADHOC:
6124                 if (intbss == wdev->current_bss &&
6125                     nla_put_u32(msg, NL80211_BSS_STATUS,
6126                                 NL80211_BSS_STATUS_IBSS_JOINED))
6127                         goto nla_put_failure;
6128                 break;
6129         default:
6130                 break;
6131         }
6132
6133         nla_nest_end(msg, bss);
6134
6135         return genlmsg_end(msg, hdr);
6136
6137  fail_unlock_rcu:
6138         rcu_read_unlock();
6139  nla_put_failure:
6140         genlmsg_cancel(msg, hdr);
6141         return -EMSGSIZE;
6142 }
6143
6144 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6145 {
6146         struct cfg80211_registered_device *rdev;
6147         struct cfg80211_internal_bss *scan;
6148         struct wireless_dev *wdev;
6149         int start = cb->args[2], idx = 0;
6150         int err;
6151
6152         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6153         if (err)
6154                 return err;
6155
6156         wdev_lock(wdev);
6157         spin_lock_bh(&rdev->bss_lock);
6158         cfg80211_bss_expire(rdev);
6159
6160         cb->seq = rdev->bss_generation;
6161
6162         list_for_each_entry(scan, &rdev->bss_list, list) {
6163                 if (++idx <= start)
6164                         continue;
6165                 if (nl80211_send_bss(skb, cb,
6166                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6167                                 rdev, wdev, scan) < 0) {
6168                         idx--;
6169                         break;
6170                 }
6171         }
6172
6173         spin_unlock_bh(&rdev->bss_lock);
6174         wdev_unlock(wdev);
6175
6176         cb->args[2] = idx;
6177         nl80211_finish_wdev_dump(rdev);
6178
6179         return skb->len;
6180 }
6181
6182 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6183                                 int flags, struct net_device *dev,
6184                                 struct survey_info *survey)
6185 {
6186         void *hdr;
6187         struct nlattr *infoattr;
6188
6189         hdr = nl80211hdr_put(msg, portid, seq, flags,
6190                              NL80211_CMD_NEW_SURVEY_RESULTS);
6191         if (!hdr)
6192                 return -ENOMEM;
6193
6194         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6195                 goto nla_put_failure;
6196
6197         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6198         if (!infoattr)
6199                 goto nla_put_failure;
6200
6201         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6202                         survey->channel->center_freq))
6203                 goto nla_put_failure;
6204
6205         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6206             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6207                 goto nla_put_failure;
6208         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6209             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6210                 goto nla_put_failure;
6211         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
6212             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
6213                         survey->channel_time))
6214                 goto nla_put_failure;
6215         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
6216             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
6217                         survey->channel_time_busy))
6218                 goto nla_put_failure;
6219         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
6220             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
6221                         survey->channel_time_ext_busy))
6222                 goto nla_put_failure;
6223         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
6224             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
6225                         survey->channel_time_rx))
6226                 goto nla_put_failure;
6227         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
6228             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
6229                         survey->channel_time_tx))
6230                 goto nla_put_failure;
6231
6232         nla_nest_end(msg, infoattr);
6233
6234         return genlmsg_end(msg, hdr);
6235
6236  nla_put_failure:
6237         genlmsg_cancel(msg, hdr);
6238         return -EMSGSIZE;
6239 }
6240
6241 static int nl80211_dump_survey(struct sk_buff *skb,
6242                         struct netlink_callback *cb)
6243 {
6244         struct survey_info survey;
6245         struct cfg80211_registered_device *rdev;
6246         struct wireless_dev *wdev;
6247         int survey_idx = cb->args[2];
6248         int res;
6249
6250         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6251         if (res)
6252                 return res;
6253
6254         if (!wdev->netdev) {
6255                 res = -EINVAL;
6256                 goto out_err;
6257         }
6258
6259         if (!rdev->ops->dump_survey) {
6260                 res = -EOPNOTSUPP;
6261                 goto out_err;
6262         }
6263
6264         while (1) {
6265                 struct ieee80211_channel *chan;
6266
6267                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6268                 if (res == -ENOENT)
6269                         break;
6270                 if (res)
6271                         goto out_err;
6272
6273                 /* Survey without a channel doesn't make sense */
6274                 if (!survey.channel) {
6275                         res = -EINVAL;
6276                         goto out;
6277                 }
6278
6279                 chan = ieee80211_get_channel(&rdev->wiphy,
6280                                              survey.channel->center_freq);
6281                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
6282                         survey_idx++;
6283                         continue;
6284                 }
6285
6286                 if (nl80211_send_survey(skb,
6287                                 NETLINK_CB(cb->skb).portid,
6288                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6289                                 wdev->netdev, &survey) < 0)
6290                         goto out;
6291                 survey_idx++;
6292         }
6293
6294  out:
6295         cb->args[2] = survey_idx;
6296         res = skb->len;
6297  out_err:
6298         nl80211_finish_wdev_dump(rdev);
6299         return res;
6300 }
6301
6302 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6303 {
6304         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6305                                   NL80211_WPA_VERSION_2));
6306 }
6307
6308 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6309 {
6310         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6311         struct net_device *dev = info->user_ptr[1];
6312         struct ieee80211_channel *chan;
6313         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6314         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6315         enum nl80211_auth_type auth_type;
6316         struct key_parse key;
6317         bool local_state_change;
6318
6319         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6320                 return -EINVAL;
6321
6322         if (!info->attrs[NL80211_ATTR_MAC])
6323                 return -EINVAL;
6324
6325         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6326                 return -EINVAL;
6327
6328         if (!info->attrs[NL80211_ATTR_SSID])
6329                 return -EINVAL;
6330
6331         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6332                 return -EINVAL;
6333
6334         err = nl80211_parse_key(info, &key);
6335         if (err)
6336                 return err;
6337
6338         if (key.idx >= 0) {
6339                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6340                         return -EINVAL;
6341                 if (!key.p.key || !key.p.key_len)
6342                         return -EINVAL;
6343                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6344                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6345                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6346                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6347                         return -EINVAL;
6348                 if (key.idx > 4)
6349                         return -EINVAL;
6350         } else {
6351                 key.p.key_len = 0;
6352                 key.p.key = NULL;
6353         }
6354
6355         if (key.idx >= 0) {
6356                 int i;
6357                 bool ok = false;
6358                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6359                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6360                                 ok = true;
6361                                 break;
6362                         }
6363                 }
6364                 if (!ok)
6365                         return -EINVAL;
6366         }
6367
6368         if (!rdev->ops->auth)
6369                 return -EOPNOTSUPP;
6370
6371         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6372             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6373                 return -EOPNOTSUPP;
6374
6375         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6376         chan = nl80211_get_valid_chan(&rdev->wiphy,
6377                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6378         if (!chan)
6379                 return -EINVAL;
6380
6381         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6382         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6383
6384         if (info->attrs[NL80211_ATTR_IE]) {
6385                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6386                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6387         }
6388
6389         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6390         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6391                 return -EINVAL;
6392
6393         if (auth_type == NL80211_AUTHTYPE_SAE &&
6394             !info->attrs[NL80211_ATTR_SAE_DATA])
6395                 return -EINVAL;
6396
6397         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6398                 if (auth_type != NL80211_AUTHTYPE_SAE)
6399                         return -EINVAL;
6400                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6401                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6402                 /* need to include at least Auth Transaction and Status Code */
6403                 if (sae_data_len < 4)
6404                         return -EINVAL;
6405         }
6406
6407         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6408
6409         /*
6410          * Since we no longer track auth state, ignore
6411          * requests to only change local state.
6412          */
6413         if (local_state_change)
6414                 return 0;
6415
6416         wdev_lock(dev->ieee80211_ptr);
6417         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6418                                  ssid, ssid_len, ie, ie_len,
6419                                  key.p.key, key.p.key_len, key.idx,
6420                                  sae_data, sae_data_len);
6421         wdev_unlock(dev->ieee80211_ptr);
6422         return err;
6423 }
6424
6425 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6426                                    struct genl_info *info,
6427                                    struct cfg80211_crypto_settings *settings,
6428                                    int cipher_limit)
6429 {
6430         memset(settings, 0, sizeof(*settings));
6431
6432         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6433
6434         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6435                 u16 proto;
6436                 proto = nla_get_u16(
6437                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6438                 settings->control_port_ethertype = cpu_to_be16(proto);
6439                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6440                     proto != ETH_P_PAE)
6441                         return -EINVAL;
6442                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6443                         settings->control_port_no_encrypt = true;
6444         } else
6445                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6446
6447         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6448                 void *data;
6449                 int len, i;
6450
6451                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6452                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6453                 settings->n_ciphers_pairwise = len / sizeof(u32);
6454
6455                 if (len % sizeof(u32))
6456                         return -EINVAL;
6457
6458                 if (settings->n_ciphers_pairwise > cipher_limit)
6459                         return -EINVAL;
6460
6461                 memcpy(settings->ciphers_pairwise, data, len);
6462
6463                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6464                         if (!cfg80211_supported_cipher_suite(
6465                                         &rdev->wiphy,
6466                                         settings->ciphers_pairwise[i]))
6467                                 return -EINVAL;
6468         }
6469
6470         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6471                 settings->cipher_group =
6472                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6473                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6474                                                      settings->cipher_group))
6475                         return -EINVAL;
6476         }
6477
6478         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6479                 settings->wpa_versions =
6480                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6481                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6482                         return -EINVAL;
6483         }
6484
6485         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6486                 void *data;
6487                 int len;
6488
6489                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6490                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6491                 settings->n_akm_suites = len / sizeof(u32);
6492
6493                 if (len % sizeof(u32))
6494                         return -EINVAL;
6495
6496                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6497                         return -EINVAL;
6498
6499                 memcpy(settings->akm_suites, data, len);
6500         }
6501
6502         return 0;
6503 }
6504
6505 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6506 {
6507         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6508         struct net_device *dev = info->user_ptr[1];
6509         struct ieee80211_channel *chan;
6510         struct cfg80211_assoc_request req = {};
6511         const u8 *bssid, *ssid;
6512         int err, ssid_len = 0;
6513
6514         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6515                 return -EINVAL;
6516
6517         if (!info->attrs[NL80211_ATTR_MAC] ||
6518             !info->attrs[NL80211_ATTR_SSID] ||
6519             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6520                 return -EINVAL;
6521
6522         if (!rdev->ops->assoc)
6523                 return -EOPNOTSUPP;
6524
6525         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6526             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6527                 return -EOPNOTSUPP;
6528
6529         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6530
6531         chan = nl80211_get_valid_chan(&rdev->wiphy,
6532                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6533         if (!chan)
6534                 return -EINVAL;
6535
6536         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6537         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6538
6539         if (info->attrs[NL80211_ATTR_IE]) {
6540                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6541                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6542         }
6543
6544         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6545                 enum nl80211_mfp mfp =
6546                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6547                 if (mfp == NL80211_MFP_REQUIRED)
6548                         req.use_mfp = true;
6549                 else if (mfp != NL80211_MFP_NO)
6550                         return -EINVAL;
6551         }
6552
6553         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6554                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6555
6556         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6557                 req.flags |= ASSOC_REQ_DISABLE_HT;
6558
6559         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6560                 memcpy(&req.ht_capa_mask,
6561                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6562                        sizeof(req.ht_capa_mask));
6563
6564         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6565                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6566                         return -EINVAL;
6567                 memcpy(&req.ht_capa,
6568                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6569                        sizeof(req.ht_capa));
6570         }
6571
6572         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6573                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6574
6575         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6576                 memcpy(&req.vht_capa_mask,
6577                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6578                        sizeof(req.vht_capa_mask));
6579
6580         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6581                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6582                         return -EINVAL;
6583                 memcpy(&req.vht_capa,
6584                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6585                        sizeof(req.vht_capa));
6586         }
6587
6588         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6589         if (!err) {
6590                 wdev_lock(dev->ieee80211_ptr);
6591                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6592                                           ssid, ssid_len, &req);
6593                 wdev_unlock(dev->ieee80211_ptr);
6594         }
6595
6596         return err;
6597 }
6598
6599 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6600 {
6601         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6602         struct net_device *dev = info->user_ptr[1];
6603         const u8 *ie = NULL, *bssid;
6604         int ie_len = 0, err;
6605         u16 reason_code;
6606         bool local_state_change;
6607
6608         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6609                 return -EINVAL;
6610
6611         if (!info->attrs[NL80211_ATTR_MAC])
6612                 return -EINVAL;
6613
6614         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6615                 return -EINVAL;
6616
6617         if (!rdev->ops->deauth)
6618                 return -EOPNOTSUPP;
6619
6620         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6621             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6622                 return -EOPNOTSUPP;
6623
6624         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6625
6626         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6627         if (reason_code == 0) {
6628                 /* Reason Code 0 is reserved */
6629                 return -EINVAL;
6630         }
6631
6632         if (info->attrs[NL80211_ATTR_IE]) {
6633                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6634                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6635         }
6636
6637         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6638
6639         wdev_lock(dev->ieee80211_ptr);
6640         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6641                                    local_state_change);
6642         wdev_unlock(dev->ieee80211_ptr);
6643         return err;
6644 }
6645
6646 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6647 {
6648         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6649         struct net_device *dev = info->user_ptr[1];
6650         const u8 *ie = NULL, *bssid;
6651         int ie_len = 0, err;
6652         u16 reason_code;
6653         bool local_state_change;
6654
6655         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6656                 return -EINVAL;
6657
6658         if (!info->attrs[NL80211_ATTR_MAC])
6659                 return -EINVAL;
6660
6661         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6662                 return -EINVAL;
6663
6664         if (!rdev->ops->disassoc)
6665                 return -EOPNOTSUPP;
6666
6667         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6668             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6669                 return -EOPNOTSUPP;
6670
6671         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6672
6673         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6674         if (reason_code == 0) {
6675                 /* Reason Code 0 is reserved */
6676                 return -EINVAL;
6677         }
6678
6679         if (info->attrs[NL80211_ATTR_IE]) {
6680                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6681                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6682         }
6683
6684         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6685
6686         wdev_lock(dev->ieee80211_ptr);
6687         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6688                                      local_state_change);
6689         wdev_unlock(dev->ieee80211_ptr);
6690         return err;
6691 }
6692
6693 static bool
6694 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6695                          int mcast_rate[IEEE80211_NUM_BANDS],
6696                          int rateval)
6697 {
6698         struct wiphy *wiphy = &rdev->wiphy;
6699         bool found = false;
6700         int band, i;
6701
6702         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6703                 struct ieee80211_supported_band *sband;
6704
6705                 sband = wiphy->bands[band];
6706                 if (!sband)
6707                         continue;
6708
6709                 for (i = 0; i < sband->n_bitrates; i++) {
6710                         if (sband->bitrates[i].bitrate == rateval) {
6711                                 mcast_rate[band] = i + 1;
6712                                 found = true;
6713                                 break;
6714                         }
6715                 }
6716         }
6717
6718         return found;
6719 }
6720
6721 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6722 {
6723         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6724         struct net_device *dev = info->user_ptr[1];
6725         struct cfg80211_ibss_params ibss;
6726         struct wiphy *wiphy;
6727         struct cfg80211_cached_keys *connkeys = NULL;
6728         int err;
6729
6730         memset(&ibss, 0, sizeof(ibss));
6731
6732         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6733                 return -EINVAL;
6734
6735         if (!info->attrs[NL80211_ATTR_SSID] ||
6736             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6737                 return -EINVAL;
6738
6739         ibss.beacon_interval = 100;
6740
6741         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6742                 ibss.beacon_interval =
6743                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6744                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6745                         return -EINVAL;
6746         }
6747
6748         if (!rdev->ops->join_ibss)
6749                 return -EOPNOTSUPP;
6750
6751         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6752                 return -EOPNOTSUPP;
6753
6754         wiphy = &rdev->wiphy;
6755
6756         if (info->attrs[NL80211_ATTR_MAC]) {
6757                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6758
6759                 if (!is_valid_ether_addr(ibss.bssid))
6760                         return -EINVAL;
6761         }
6762         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6763         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6764
6765         if (info->attrs[NL80211_ATTR_IE]) {
6766                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6767                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6768         }
6769
6770         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6771         if (err)
6772                 return err;
6773
6774         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
6775                                      NL80211_IFTYPE_ADHOC))
6776                 return -EINVAL;
6777
6778         switch (ibss.chandef.width) {
6779         case NL80211_CHAN_WIDTH_5:
6780         case NL80211_CHAN_WIDTH_10:
6781         case NL80211_CHAN_WIDTH_20_NOHT:
6782                 break;
6783         case NL80211_CHAN_WIDTH_20:
6784         case NL80211_CHAN_WIDTH_40:
6785                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6786                         break;
6787         default:
6788                 return -EINVAL;
6789         }
6790
6791         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6792         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6793
6794         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6795                 u8 *rates =
6796                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6797                 int n_rates =
6798                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6799                 struct ieee80211_supported_band *sband =
6800                         wiphy->bands[ibss.chandef.chan->band];
6801
6802                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6803                                              &ibss.basic_rates);
6804                 if (err)
6805                         return err;
6806         }
6807
6808         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6809                 memcpy(&ibss.ht_capa_mask,
6810                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6811                        sizeof(ibss.ht_capa_mask));
6812
6813         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6814                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6815                         return -EINVAL;
6816                 memcpy(&ibss.ht_capa,
6817                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6818                        sizeof(ibss.ht_capa));
6819         }
6820
6821         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6822             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6823                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6824                 return -EINVAL;
6825
6826         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6827                 bool no_ht = false;
6828
6829                 connkeys = nl80211_parse_connkeys(rdev,
6830                                           info->attrs[NL80211_ATTR_KEYS],
6831                                           &no_ht);
6832                 if (IS_ERR(connkeys))
6833                         return PTR_ERR(connkeys);
6834
6835                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6836                     no_ht) {
6837                         kfree(connkeys);
6838                         return -EINVAL;
6839                 }
6840         }
6841
6842         ibss.control_port =
6843                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6844
6845         ibss.userspace_handles_dfs =
6846                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
6847
6848         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6849         if (err)
6850                 kfree(connkeys);
6851         return err;
6852 }
6853
6854 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6855 {
6856         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6857         struct net_device *dev = info->user_ptr[1];
6858
6859         if (!rdev->ops->leave_ibss)
6860                 return -EOPNOTSUPP;
6861
6862         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6863                 return -EOPNOTSUPP;
6864
6865         return cfg80211_leave_ibss(rdev, dev, false);
6866 }
6867
6868 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6869 {
6870         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6871         struct net_device *dev = info->user_ptr[1];
6872         int mcast_rate[IEEE80211_NUM_BANDS];
6873         u32 nla_rate;
6874         int err;
6875
6876         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6877             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6878                 return -EOPNOTSUPP;
6879
6880         if (!rdev->ops->set_mcast_rate)
6881                 return -EOPNOTSUPP;
6882
6883         memset(mcast_rate, 0, sizeof(mcast_rate));
6884
6885         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6886                 return -EINVAL;
6887
6888         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6889         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6890                 return -EINVAL;
6891
6892         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6893
6894         return err;
6895 }
6896
6897 static struct sk_buff *
6898 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
6899                             int approxlen, u32 portid, u32 seq,
6900                             enum nl80211_commands cmd,
6901                             enum nl80211_attrs attr,
6902                             const struct nl80211_vendor_cmd_info *info,
6903                             gfp_t gfp)
6904 {
6905         struct sk_buff *skb;
6906         void *hdr;
6907         struct nlattr *data;
6908
6909         skb = nlmsg_new(approxlen + 100, gfp);
6910         if (!skb)
6911                 return NULL;
6912
6913         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
6914         if (!hdr) {
6915                 kfree_skb(skb);
6916                 return NULL;
6917         }
6918
6919         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6920                 goto nla_put_failure;
6921
6922         if (info) {
6923                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
6924                                 info->vendor_id))
6925                         goto nla_put_failure;
6926                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
6927                                 info->subcmd))
6928                         goto nla_put_failure;
6929         }
6930
6931         data = nla_nest_start(skb, attr);
6932
6933         ((void **)skb->cb)[0] = rdev;
6934         ((void **)skb->cb)[1] = hdr;
6935         ((void **)skb->cb)[2] = data;
6936
6937         return skb;
6938
6939  nla_put_failure:
6940         kfree_skb(skb);
6941         return NULL;
6942 }
6943
6944 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
6945                                            enum nl80211_commands cmd,
6946                                            enum nl80211_attrs attr,
6947                                            int vendor_event_idx,
6948                                            int approxlen, gfp_t gfp)
6949 {
6950         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
6951         const struct nl80211_vendor_cmd_info *info;
6952
6953         switch (cmd) {
6954         case NL80211_CMD_TESTMODE:
6955                 if (WARN_ON(vendor_event_idx != -1))
6956                         return NULL;
6957                 info = NULL;
6958                 break;
6959         case NL80211_CMD_VENDOR:
6960                 if (WARN_ON(vendor_event_idx < 0 ||
6961                             vendor_event_idx >= wiphy->n_vendor_events))
6962                         return NULL;
6963                 info = &wiphy->vendor_events[vendor_event_idx];
6964                 break;
6965         default:
6966                 WARN_ON(1);
6967                 return NULL;
6968         }
6969
6970         return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
6971                                            cmd, attr, info, gfp);
6972 }
6973 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
6974
6975 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
6976 {
6977         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6978         void *hdr = ((void **)skb->cb)[1];
6979         struct nlattr *data = ((void **)skb->cb)[2];
6980         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
6981
6982         nla_nest_end(skb, data);
6983         genlmsg_end(skb, hdr);
6984
6985         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
6986                 mcgrp = NL80211_MCGRP_VENDOR;
6987
6988         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
6989                                 mcgrp, gfp);
6990 }
6991 EXPORT_SYMBOL(__cfg80211_send_event_skb);
6992
6993 #ifdef CONFIG_NL80211_TESTMODE
6994 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6995 {
6996         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6997         struct wireless_dev *wdev =
6998                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
6999         int err;
7000
7001         if (!rdev->ops->testmode_cmd)
7002                 return -EOPNOTSUPP;
7003
7004         if (IS_ERR(wdev)) {
7005                 err = PTR_ERR(wdev);
7006                 if (err != -EINVAL)
7007                         return err;
7008                 wdev = NULL;
7009         } else if (wdev->wiphy != &rdev->wiphy) {
7010                 return -EINVAL;
7011         }
7012
7013         if (!info->attrs[NL80211_ATTR_TESTDATA])
7014                 return -EINVAL;
7015
7016         rdev->cur_cmd_info = info;
7017         err = rdev_testmode_cmd(rdev, wdev,
7018                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
7019                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
7020         rdev->cur_cmd_info = NULL;
7021
7022         return err;
7023 }
7024
7025 static int nl80211_testmode_dump(struct sk_buff *skb,
7026                                  struct netlink_callback *cb)
7027 {
7028         struct cfg80211_registered_device *rdev;
7029         int err;
7030         long phy_idx;
7031         void *data = NULL;
7032         int data_len = 0;
7033
7034         rtnl_lock();
7035
7036         if (cb->args[0]) {
7037                 /*
7038                  * 0 is a valid index, but not valid for args[0],
7039                  * so we need to offset by 1.
7040                  */
7041                 phy_idx = cb->args[0] - 1;
7042         } else {
7043                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
7044                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
7045                                   nl80211_policy);
7046                 if (err)
7047                         goto out_err;
7048
7049                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7050                                                   nl80211_fam.attrbuf);
7051                 if (IS_ERR(rdev)) {
7052                         err = PTR_ERR(rdev);
7053                         goto out_err;
7054                 }
7055                 phy_idx = rdev->wiphy_idx;
7056                 rdev = NULL;
7057
7058                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7059                         cb->args[1] =
7060                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7061         }
7062
7063         if (cb->args[1]) {
7064                 data = nla_data((void *)cb->args[1]);
7065                 data_len = nla_len((void *)cb->args[1]);
7066         }
7067
7068         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7069         if (!rdev) {
7070                 err = -ENOENT;
7071                 goto out_err;
7072         }
7073
7074         if (!rdev->ops->testmode_dump) {
7075                 err = -EOPNOTSUPP;
7076                 goto out_err;
7077         }
7078
7079         while (1) {
7080                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7081                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7082                                            NL80211_CMD_TESTMODE);
7083                 struct nlattr *tmdata;
7084
7085                 if (!hdr)
7086                         break;
7087
7088                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7089                         genlmsg_cancel(skb, hdr);
7090                         break;
7091                 }
7092
7093                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7094                 if (!tmdata) {
7095                         genlmsg_cancel(skb, hdr);
7096                         break;
7097                 }
7098                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7099                 nla_nest_end(skb, tmdata);
7100
7101                 if (err == -ENOBUFS || err == -ENOENT) {
7102                         genlmsg_cancel(skb, hdr);
7103                         break;
7104                 } else if (err) {
7105                         genlmsg_cancel(skb, hdr);
7106                         goto out_err;
7107                 }
7108
7109                 genlmsg_end(skb, hdr);
7110         }
7111
7112         err = skb->len;
7113         /* see above */
7114         cb->args[0] = phy_idx + 1;
7115  out_err:
7116         rtnl_unlock();
7117         return err;
7118 }
7119 #endif
7120
7121 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7122 {
7123         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7124         struct net_device *dev = info->user_ptr[1];
7125         struct cfg80211_connect_params connect;
7126         struct wiphy *wiphy;
7127         struct cfg80211_cached_keys *connkeys = NULL;
7128         int err;
7129
7130         memset(&connect, 0, sizeof(connect));
7131
7132         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7133                 return -EINVAL;
7134
7135         if (!info->attrs[NL80211_ATTR_SSID] ||
7136             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7137                 return -EINVAL;
7138
7139         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
7140                 connect.auth_type =
7141                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7142                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
7143                                              NL80211_CMD_CONNECT))
7144                         return -EINVAL;
7145         } else
7146                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7147
7148         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7149
7150         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7151                                       NL80211_MAX_NR_CIPHER_SUITES);
7152         if (err)
7153                 return err;
7154
7155         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7156             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7157                 return -EOPNOTSUPP;
7158
7159         wiphy = &rdev->wiphy;
7160
7161         connect.bg_scan_period = -1;
7162         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7163                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7164                 connect.bg_scan_period =
7165                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7166         }
7167
7168         if (info->attrs[NL80211_ATTR_MAC])
7169                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7170         else if (info->attrs[NL80211_ATTR_MAC_HINT])
7171                 connect.bssid_hint =
7172                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7173         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7174         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7175
7176         if (info->attrs[NL80211_ATTR_IE]) {
7177                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7178                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7179         }
7180
7181         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7182                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7183                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7184                     connect.mfp != NL80211_MFP_NO)
7185                         return -EINVAL;
7186         } else {
7187                 connect.mfp = NL80211_MFP_NO;
7188         }
7189
7190         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7191                 connect.channel = nl80211_get_valid_chan(
7192                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7193                 if (!connect.channel)
7194                         return -EINVAL;
7195         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7196                 connect.channel_hint = nl80211_get_valid_chan(
7197                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
7198                 if (!connect.channel_hint)
7199                         return -EINVAL;
7200         }
7201
7202         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7203                 connkeys = nl80211_parse_connkeys(rdev,
7204                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7205                 if (IS_ERR(connkeys))
7206                         return PTR_ERR(connkeys);
7207         }
7208
7209         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7210                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7211
7212         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7213                 memcpy(&connect.ht_capa_mask,
7214                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7215                        sizeof(connect.ht_capa_mask));
7216
7217         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7218                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7219                         kfree(connkeys);
7220                         return -EINVAL;
7221                 }
7222                 memcpy(&connect.ht_capa,
7223                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7224                        sizeof(connect.ht_capa));
7225         }
7226
7227         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7228                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7229
7230         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7231                 memcpy(&connect.vht_capa_mask,
7232                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7233                        sizeof(connect.vht_capa_mask));
7234
7235         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7236                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7237                         kfree(connkeys);
7238                         return -EINVAL;
7239                 }
7240                 memcpy(&connect.vht_capa,
7241                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7242                        sizeof(connect.vht_capa));
7243         }
7244
7245         wdev_lock(dev->ieee80211_ptr);
7246         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7247         wdev_unlock(dev->ieee80211_ptr);
7248         if (err)
7249                 kfree(connkeys);
7250         return err;
7251 }
7252
7253 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7254 {
7255         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7256         struct net_device *dev = info->user_ptr[1];
7257         u16 reason;
7258         int ret;
7259
7260         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7261                 reason = WLAN_REASON_DEAUTH_LEAVING;
7262         else
7263                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7264
7265         if (reason == 0)
7266                 return -EINVAL;
7267
7268         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7269             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7270                 return -EOPNOTSUPP;
7271
7272         wdev_lock(dev->ieee80211_ptr);
7273         ret = cfg80211_disconnect(rdev, dev, reason, true);
7274         wdev_unlock(dev->ieee80211_ptr);
7275         return ret;
7276 }
7277
7278 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7279 {
7280         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7281         struct net *net;
7282         int err;
7283         u32 pid;
7284
7285         if (!info->attrs[NL80211_ATTR_PID])
7286                 return -EINVAL;
7287
7288         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7289
7290         net = get_net_ns_by_pid(pid);
7291         if (IS_ERR(net))
7292                 return PTR_ERR(net);
7293
7294         err = 0;
7295
7296         /* check if anything to do */
7297         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7298                 err = cfg80211_switch_netns(rdev, net);
7299
7300         put_net(net);
7301         return err;
7302 }
7303
7304 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7305 {
7306         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7307         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7308                         struct cfg80211_pmksa *pmksa) = NULL;
7309         struct net_device *dev = info->user_ptr[1];
7310         struct cfg80211_pmksa pmksa;
7311
7312         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7313
7314         if (!info->attrs[NL80211_ATTR_MAC])
7315                 return -EINVAL;
7316
7317         if (!info->attrs[NL80211_ATTR_PMKID])
7318                 return -EINVAL;
7319
7320         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7321         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7322
7323         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7324             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7325                 return -EOPNOTSUPP;
7326
7327         switch (info->genlhdr->cmd) {
7328         case NL80211_CMD_SET_PMKSA:
7329                 rdev_ops = rdev->ops->set_pmksa;
7330                 break;
7331         case NL80211_CMD_DEL_PMKSA:
7332                 rdev_ops = rdev->ops->del_pmksa;
7333                 break;
7334         default:
7335                 WARN_ON(1);
7336                 break;
7337         }
7338
7339         if (!rdev_ops)
7340                 return -EOPNOTSUPP;
7341
7342         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7343 }
7344
7345 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7346 {
7347         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7348         struct net_device *dev = info->user_ptr[1];
7349
7350         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7351             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7352                 return -EOPNOTSUPP;
7353
7354         if (!rdev->ops->flush_pmksa)
7355                 return -EOPNOTSUPP;
7356
7357         return rdev_flush_pmksa(rdev, dev);
7358 }
7359
7360 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7361 {
7362         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7363         struct net_device *dev = info->user_ptr[1];
7364         u8 action_code, dialog_token;
7365         u32 peer_capability = 0;
7366         u16 status_code;
7367         u8 *peer;
7368
7369         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7370             !rdev->ops->tdls_mgmt)
7371                 return -EOPNOTSUPP;
7372
7373         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7374             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7375             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7376             !info->attrs[NL80211_ATTR_IE] ||
7377             !info->attrs[NL80211_ATTR_MAC])
7378                 return -EINVAL;
7379
7380         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7381         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7382         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7383         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7384         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
7385                 peer_capability =
7386                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
7387
7388         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7389                               dialog_token, status_code, peer_capability,
7390                               nla_data(info->attrs[NL80211_ATTR_IE]),
7391                               nla_len(info->attrs[NL80211_ATTR_IE]));
7392 }
7393
7394 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7395 {
7396         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7397         struct net_device *dev = info->user_ptr[1];
7398         enum nl80211_tdls_operation operation;
7399         u8 *peer;
7400
7401         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7402             !rdev->ops->tdls_oper)
7403                 return -EOPNOTSUPP;
7404
7405         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7406             !info->attrs[NL80211_ATTR_MAC])
7407                 return -EINVAL;
7408
7409         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7410         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7411
7412         return rdev_tdls_oper(rdev, dev, peer, operation);
7413 }
7414
7415 static int nl80211_remain_on_channel(struct sk_buff *skb,
7416                                      struct genl_info *info)
7417 {
7418         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7419         struct wireless_dev *wdev = info->user_ptr[1];
7420         struct cfg80211_chan_def chandef;
7421         struct sk_buff *msg;
7422         void *hdr;
7423         u64 cookie;
7424         u32 duration;
7425         int err;
7426
7427         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7428             !info->attrs[NL80211_ATTR_DURATION])
7429                 return -EINVAL;
7430
7431         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7432
7433         if (!rdev->ops->remain_on_channel ||
7434             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7435                 return -EOPNOTSUPP;
7436
7437         /*
7438          * We should be on that channel for at least a minimum amount of
7439          * time (10ms) but no longer than the driver supports.
7440          */
7441         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7442             duration > rdev->wiphy.max_remain_on_channel_duration)
7443                 return -EINVAL;
7444
7445         err = nl80211_parse_chandef(rdev, info, &chandef);
7446         if (err)
7447                 return err;
7448
7449         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7450         if (!msg)
7451                 return -ENOMEM;
7452
7453         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7454                              NL80211_CMD_REMAIN_ON_CHANNEL);
7455         if (!hdr) {
7456                 err = -ENOBUFS;
7457                 goto free_msg;
7458         }
7459
7460         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7461                                      duration, &cookie);
7462
7463         if (err)
7464                 goto free_msg;
7465
7466         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7467                 goto nla_put_failure;
7468
7469         genlmsg_end(msg, hdr);
7470
7471         return genlmsg_reply(msg, info);
7472
7473  nla_put_failure:
7474         err = -ENOBUFS;
7475  free_msg:
7476         nlmsg_free(msg);
7477         return err;
7478 }
7479
7480 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7481                                             struct genl_info *info)
7482 {
7483         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7484         struct wireless_dev *wdev = info->user_ptr[1];
7485         u64 cookie;
7486
7487         if (!info->attrs[NL80211_ATTR_COOKIE])
7488                 return -EINVAL;
7489
7490         if (!rdev->ops->cancel_remain_on_channel)
7491                 return -EOPNOTSUPP;
7492
7493         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7494
7495         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7496 }
7497
7498 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7499                            u8 *rates, u8 rates_len)
7500 {
7501         u8 i;
7502         u32 mask = 0;
7503
7504         for (i = 0; i < rates_len; i++) {
7505                 int rate = (rates[i] & 0x7f) * 5;
7506                 int ridx;
7507                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7508                         struct ieee80211_rate *srate =
7509                                 &sband->bitrates[ridx];
7510                         if (rate == srate->bitrate) {
7511                                 mask |= 1 << ridx;
7512                                 break;
7513                         }
7514                 }
7515                 if (ridx == sband->n_bitrates)
7516                         return 0; /* rate not found */
7517         }
7518
7519         return mask;
7520 }
7521
7522 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7523                                u8 *rates, u8 rates_len,
7524                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7525 {
7526         u8 i;
7527
7528         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7529
7530         for (i = 0; i < rates_len; i++) {
7531                 int ridx, rbit;
7532
7533                 ridx = rates[i] / 8;
7534                 rbit = BIT(rates[i] % 8);
7535
7536                 /* check validity */
7537                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7538                         return false;
7539
7540                 /* check availability */
7541                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7542                         mcs[ridx] |= rbit;
7543                 else
7544                         return false;
7545         }
7546
7547         return true;
7548 }
7549
7550 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
7551 {
7552         u16 mcs_mask = 0;
7553
7554         switch (vht_mcs_map) {
7555         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
7556                 break;
7557         case IEEE80211_VHT_MCS_SUPPORT_0_7:
7558                 mcs_mask = 0x00FF;
7559                 break;
7560         case IEEE80211_VHT_MCS_SUPPORT_0_8:
7561                 mcs_mask = 0x01FF;
7562                 break;
7563         case IEEE80211_VHT_MCS_SUPPORT_0_9:
7564                 mcs_mask = 0x03FF;
7565                 break;
7566         default:
7567                 break;
7568         }
7569
7570         return mcs_mask;
7571 }
7572
7573 static void vht_build_mcs_mask(u16 vht_mcs_map,
7574                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
7575 {
7576         u8 nss;
7577
7578         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
7579                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
7580                 vht_mcs_map >>= 2;
7581         }
7582 }
7583
7584 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
7585                              struct nl80211_txrate_vht *txrate,
7586                              u16 mcs[NL80211_VHT_NSS_MAX])
7587 {
7588         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7589         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
7590         u8 i;
7591
7592         if (!sband->vht_cap.vht_supported)
7593                 return false;
7594
7595         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
7596
7597         /* Build vht_mcs_mask from VHT capabilities */
7598         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
7599
7600         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
7601                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
7602                         mcs[i] = txrate->mcs[i];
7603                 else
7604                         return false;
7605         }
7606
7607         return true;
7608 }
7609
7610 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7611         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7612                                     .len = NL80211_MAX_SUPP_RATES },
7613         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
7614                                 .len = NL80211_MAX_SUPP_HT_RATES },
7615         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
7616         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
7617 };
7618
7619 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7620                                        struct genl_info *info)
7621 {
7622         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7623         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7624         struct cfg80211_bitrate_mask mask;
7625         int rem, i;
7626         struct net_device *dev = info->user_ptr[1];
7627         struct nlattr *tx_rates;
7628         struct ieee80211_supported_band *sband;
7629         u16 vht_tx_mcs_map;
7630
7631         if (!rdev->ops->set_bitrate_mask)
7632                 return -EOPNOTSUPP;
7633
7634         memset(&mask, 0, sizeof(mask));
7635         /* Default to all rates enabled */
7636         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7637                 sband = rdev->wiphy.bands[i];
7638
7639                 if (!sband)
7640                         continue;
7641
7642                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
7643                 memcpy(mask.control[i].ht_mcs,
7644                        sband->ht_cap.mcs.rx_mask,
7645                        sizeof(mask.control[i].ht_mcs));
7646
7647                 if (!sband->vht_cap.vht_supported)
7648                         continue;
7649
7650                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7651                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
7652         }
7653
7654         /* if no rates are given set it back to the defaults */
7655         if (!info->attrs[NL80211_ATTR_TX_RATES])
7656                 goto out;
7657
7658         /*
7659          * The nested attribute uses enum nl80211_band as the index. This maps
7660          * directly to the enum ieee80211_band values used in cfg80211.
7661          */
7662         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7663         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
7664                 enum ieee80211_band band = nla_type(tx_rates);
7665                 int err;
7666
7667                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7668                         return -EINVAL;
7669                 sband = rdev->wiphy.bands[band];
7670                 if (sband == NULL)
7671                         return -EINVAL;
7672                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7673                                 nla_len(tx_rates), nl80211_txattr_policy);
7674                 if (err)
7675                         return err;
7676                 if (tb[NL80211_TXRATE_LEGACY]) {
7677                         mask.control[band].legacy = rateset_to_mask(
7678                                 sband,
7679                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7680                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7681                         if ((mask.control[band].legacy == 0) &&
7682                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7683                                 return -EINVAL;
7684                 }
7685                 if (tb[NL80211_TXRATE_HT]) {
7686                         if (!ht_rateset_to_mask(
7687                                         sband,
7688                                         nla_data(tb[NL80211_TXRATE_HT]),
7689                                         nla_len(tb[NL80211_TXRATE_HT]),
7690                                         mask.control[band].ht_mcs))
7691                                 return -EINVAL;
7692                 }
7693                 if (tb[NL80211_TXRATE_VHT]) {
7694                         if (!vht_set_mcs_mask(
7695                                         sband,
7696                                         nla_data(tb[NL80211_TXRATE_VHT]),
7697                                         mask.control[band].vht_mcs))
7698                                 return -EINVAL;
7699                 }
7700                 if (tb[NL80211_TXRATE_GI]) {
7701                         mask.control[band].gi =
7702                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
7703                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
7704                                 return -EINVAL;
7705                 }
7706
7707                 if (mask.control[band].legacy == 0) {
7708                         /* don't allow empty legacy rates if HT or VHT
7709                          * are not even supported.
7710                          */
7711                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
7712                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
7713                                 return -EINVAL;
7714
7715                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7716                                 if (mask.control[band].ht_mcs[i])
7717                                         goto out;
7718
7719                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
7720                                 if (mask.control[band].vht_mcs[i])
7721                                         goto out;
7722
7723                         /* legacy and mcs rates may not be both empty */
7724                         return -EINVAL;
7725                 }
7726         }
7727
7728 out:
7729         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7730 }
7731
7732 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7733 {
7734         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7735         struct wireless_dev *wdev = info->user_ptr[1];
7736         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7737
7738         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7739                 return -EINVAL;
7740
7741         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7742                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7743
7744         switch (wdev->iftype) {
7745         case NL80211_IFTYPE_STATION:
7746         case NL80211_IFTYPE_ADHOC:
7747         case NL80211_IFTYPE_P2P_CLIENT:
7748         case NL80211_IFTYPE_AP:
7749         case NL80211_IFTYPE_AP_VLAN:
7750         case NL80211_IFTYPE_MESH_POINT:
7751         case NL80211_IFTYPE_P2P_GO:
7752         case NL80211_IFTYPE_P2P_DEVICE:
7753                 break;
7754         default:
7755                 return -EOPNOTSUPP;
7756         }
7757
7758         /* not much point in registering if we can't reply */
7759         if (!rdev->ops->mgmt_tx)
7760                 return -EOPNOTSUPP;
7761
7762         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7763                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7764                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7765 }
7766
7767 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7768 {
7769         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7770         struct wireless_dev *wdev = info->user_ptr[1];
7771         struct cfg80211_chan_def chandef;
7772         int err;
7773         void *hdr = NULL;
7774         u64 cookie;
7775         struct sk_buff *msg = NULL;
7776         struct cfg80211_mgmt_tx_params params = {
7777                 .dont_wait_for_ack =
7778                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
7779         };
7780
7781         if (!info->attrs[NL80211_ATTR_FRAME])
7782                 return -EINVAL;
7783
7784         if (!rdev->ops->mgmt_tx)
7785                 return -EOPNOTSUPP;
7786
7787         switch (wdev->iftype) {
7788         case NL80211_IFTYPE_P2P_DEVICE:
7789                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7790                         return -EINVAL;
7791         case NL80211_IFTYPE_STATION:
7792         case NL80211_IFTYPE_ADHOC:
7793         case NL80211_IFTYPE_P2P_CLIENT:
7794         case NL80211_IFTYPE_AP:
7795         case NL80211_IFTYPE_AP_VLAN:
7796         case NL80211_IFTYPE_MESH_POINT:
7797         case NL80211_IFTYPE_P2P_GO:
7798                 break;
7799         default:
7800                 return -EOPNOTSUPP;
7801         }
7802
7803         if (info->attrs[NL80211_ATTR_DURATION]) {
7804                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7805                         return -EINVAL;
7806                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7807
7808                 /*
7809                  * We should wait on the channel for at least a minimum amount
7810                  * of time (10ms) but no longer than the driver supports.
7811                  */
7812                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7813                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
7814                         return -EINVAL;
7815
7816         }
7817
7818         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7819
7820         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7821                 return -EINVAL;
7822
7823         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7824
7825         /* get the channel if any has been specified, otherwise pass NULL to
7826          * the driver. The latter will use the current one
7827          */
7828         chandef.chan = NULL;
7829         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7830                 err = nl80211_parse_chandef(rdev, info, &chandef);
7831                 if (err)
7832                         return err;
7833         }
7834
7835         if (!chandef.chan && params.offchan)
7836                 return -EINVAL;
7837
7838         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
7839         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
7840
7841         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
7842                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
7843                 int i;
7844
7845                 if (len % sizeof(u16))
7846                         return -EINVAL;
7847
7848                 params.n_csa_offsets = len / sizeof(u16);
7849                 params.csa_offsets =
7850                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
7851
7852                 /* check that all the offsets fit the frame */
7853                 for (i = 0; i < params.n_csa_offsets; i++) {
7854                         if (params.csa_offsets[i] >= params.len)
7855                                 return -EINVAL;
7856                 }
7857         }
7858
7859         if (!params.dont_wait_for_ack) {
7860                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7861                 if (!msg)
7862                         return -ENOMEM;
7863
7864                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7865                                      NL80211_CMD_FRAME);
7866                 if (!hdr) {
7867                         err = -ENOBUFS;
7868                         goto free_msg;
7869                 }
7870         }
7871
7872         params.chan = chandef.chan;
7873         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
7874         if (err)
7875                 goto free_msg;
7876
7877         if (msg) {
7878                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7879                         goto nla_put_failure;
7880
7881                 genlmsg_end(msg, hdr);
7882                 return genlmsg_reply(msg, info);
7883         }
7884
7885         return 0;
7886
7887  nla_put_failure:
7888         err = -ENOBUFS;
7889  free_msg:
7890         nlmsg_free(msg);
7891         return err;
7892 }
7893
7894 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7895 {
7896         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7897         struct wireless_dev *wdev = info->user_ptr[1];
7898         u64 cookie;
7899
7900         if (!info->attrs[NL80211_ATTR_COOKIE])
7901                 return -EINVAL;
7902
7903         if (!rdev->ops->mgmt_tx_cancel_wait)
7904                 return -EOPNOTSUPP;
7905
7906         switch (wdev->iftype) {
7907         case NL80211_IFTYPE_STATION:
7908         case NL80211_IFTYPE_ADHOC:
7909         case NL80211_IFTYPE_P2P_CLIENT:
7910         case NL80211_IFTYPE_AP:
7911         case NL80211_IFTYPE_AP_VLAN:
7912         case NL80211_IFTYPE_P2P_GO:
7913         case NL80211_IFTYPE_P2P_DEVICE:
7914                 break;
7915         default:
7916                 return -EOPNOTSUPP;
7917         }
7918
7919         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7920
7921         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7922 }
7923
7924 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7925 {
7926         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7927         struct wireless_dev *wdev;
7928         struct net_device *dev = info->user_ptr[1];
7929         u8 ps_state;
7930         bool state;
7931         int err;
7932
7933         if (!info->attrs[NL80211_ATTR_PS_STATE])
7934                 return -EINVAL;
7935
7936         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7937
7938         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7939                 return -EINVAL;
7940
7941         wdev = dev->ieee80211_ptr;
7942
7943         if (!rdev->ops->set_power_mgmt)
7944                 return -EOPNOTSUPP;
7945
7946         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7947
7948         if (state == wdev->ps)
7949                 return 0;
7950
7951         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7952         if (!err)
7953                 wdev->ps = state;
7954         return err;
7955 }
7956
7957 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7958 {
7959         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7960         enum nl80211_ps_state ps_state;
7961         struct wireless_dev *wdev;
7962         struct net_device *dev = info->user_ptr[1];
7963         struct sk_buff *msg;
7964         void *hdr;
7965         int err;
7966
7967         wdev = dev->ieee80211_ptr;
7968
7969         if (!rdev->ops->set_power_mgmt)
7970                 return -EOPNOTSUPP;
7971
7972         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7973         if (!msg)
7974                 return -ENOMEM;
7975
7976         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7977                              NL80211_CMD_GET_POWER_SAVE);
7978         if (!hdr) {
7979                 err = -ENOBUFS;
7980                 goto free_msg;
7981         }
7982
7983         if (wdev->ps)
7984                 ps_state = NL80211_PS_ENABLED;
7985         else
7986                 ps_state = NL80211_PS_DISABLED;
7987
7988         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7989                 goto nla_put_failure;
7990
7991         genlmsg_end(msg, hdr);
7992         return genlmsg_reply(msg, info);
7993
7994  nla_put_failure:
7995         err = -ENOBUFS;
7996  free_msg:
7997         nlmsg_free(msg);
7998         return err;
7999 }
8000
8001 static const struct nla_policy
8002 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
8003         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
8004         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
8005         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
8006         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
8007         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
8008         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
8009 };
8010
8011 static int nl80211_set_cqm_txe(struct genl_info *info,
8012                                u32 rate, u32 pkts, u32 intvl)
8013 {
8014         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8015         struct net_device *dev = info->user_ptr[1];
8016         struct wireless_dev *wdev = dev->ieee80211_ptr;
8017
8018         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
8019                 return -EINVAL;
8020
8021         if (!rdev->ops->set_cqm_txe_config)
8022                 return -EOPNOTSUPP;
8023
8024         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8025             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8026                 return -EOPNOTSUPP;
8027
8028         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
8029 }
8030
8031 static int nl80211_set_cqm_rssi(struct genl_info *info,
8032                                 s32 threshold, u32 hysteresis)
8033 {
8034         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8035         struct net_device *dev = info->user_ptr[1];
8036         struct wireless_dev *wdev = dev->ieee80211_ptr;
8037
8038         if (threshold > 0)
8039                 return -EINVAL;
8040
8041         /* disabling - hysteresis should also be zero then */
8042         if (threshold == 0)
8043                 hysteresis = 0;
8044
8045         if (!rdev->ops->set_cqm_rssi_config)
8046                 return -EOPNOTSUPP;
8047
8048         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8049             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8050                 return -EOPNOTSUPP;
8051
8052         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
8053 }
8054
8055 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
8056 {
8057         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
8058         struct nlattr *cqm;
8059         int err;
8060
8061         cqm = info->attrs[NL80211_ATTR_CQM];
8062         if (!cqm)
8063                 return -EINVAL;
8064
8065         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
8066                                nl80211_attr_cqm_policy);
8067         if (err)
8068                 return err;
8069
8070         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
8071             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8072                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
8073                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8074
8075                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
8076         }
8077
8078         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
8079             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
8080             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
8081                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
8082                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
8083                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
8084
8085                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
8086         }
8087
8088         return -EINVAL;
8089 }
8090
8091 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
8092 {
8093         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8094         struct net_device *dev = info->user_ptr[1];
8095         struct mesh_config cfg;
8096         struct mesh_setup setup;
8097         int err;
8098
8099         /* start with default */
8100         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8101         memcpy(&setup, &default_mesh_setup, sizeof(setup));
8102
8103         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8104                 /* and parse parameters if given */
8105                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
8106                 if (err)
8107                         return err;
8108         }
8109
8110         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
8111             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
8112                 return -EINVAL;
8113
8114         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
8115         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
8116
8117         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8118             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
8119                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8120                         return -EINVAL;
8121
8122         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
8123                 setup.beacon_interval =
8124                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8125                 if (setup.beacon_interval < 10 ||
8126                     setup.beacon_interval > 10000)
8127                         return -EINVAL;
8128         }
8129
8130         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
8131                 setup.dtim_period =
8132                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
8133                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
8134                         return -EINVAL;
8135         }
8136
8137         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
8138                 /* parse additional setup parameters if given */
8139                 err = nl80211_parse_mesh_setup(info, &setup);
8140                 if (err)
8141                         return err;
8142         }
8143
8144         if (setup.user_mpm)
8145                 cfg.auto_open_plinks = false;
8146
8147         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8148                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8149                 if (err)
8150                         return err;
8151         } else {
8152                 /* cfg80211_join_mesh() will sort it out */
8153                 setup.chandef.chan = NULL;
8154         }
8155
8156         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8157                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8158                 int n_rates =
8159                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8160                 struct ieee80211_supported_band *sband;
8161
8162                 if (!setup.chandef.chan)
8163                         return -EINVAL;
8164
8165                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
8166
8167                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8168                                              &setup.basic_rates);
8169                 if (err)
8170                         return err;
8171         }
8172
8173         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8174 }
8175
8176 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
8177 {
8178         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8179         struct net_device *dev = info->user_ptr[1];
8180
8181         return cfg80211_leave_mesh(rdev, dev);
8182 }
8183
8184 #ifdef CONFIG_PM
8185 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8186                                         struct cfg80211_registered_device *rdev)
8187 {
8188         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8189         struct nlattr *nl_pats, *nl_pat;
8190         int i, pat_len;
8191
8192         if (!wowlan->n_patterns)
8193                 return 0;
8194
8195         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8196         if (!nl_pats)
8197                 return -ENOBUFS;
8198
8199         for (i = 0; i < wowlan->n_patterns; i++) {
8200                 nl_pat = nla_nest_start(msg, i + 1);
8201                 if (!nl_pat)
8202                         return -ENOBUFS;
8203                 pat_len = wowlan->patterns[i].pattern_len;
8204                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8205                             wowlan->patterns[i].mask) ||
8206                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8207                             wowlan->patterns[i].pattern) ||
8208                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8209                                 wowlan->patterns[i].pkt_offset))
8210                         return -ENOBUFS;
8211                 nla_nest_end(msg, nl_pat);
8212         }
8213         nla_nest_end(msg, nl_pats);
8214
8215         return 0;
8216 }
8217
8218 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8219                                    struct cfg80211_wowlan_tcp *tcp)
8220 {
8221         struct nlattr *nl_tcp;
8222
8223         if (!tcp)
8224                 return 0;
8225
8226         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8227         if (!nl_tcp)
8228                 return -ENOBUFS;
8229
8230         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8231             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8232             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8233             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8234             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8235             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8236                     tcp->payload_len, tcp->payload) ||
8237             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8238                         tcp->data_interval) ||
8239             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8240                     tcp->wake_len, tcp->wake_data) ||
8241             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8242                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8243                 return -ENOBUFS;
8244
8245         if (tcp->payload_seq.len &&
8246             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8247                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8248                 return -ENOBUFS;
8249
8250         if (tcp->payload_tok.len &&
8251             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8252                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8253                     &tcp->payload_tok))
8254                 return -ENOBUFS;
8255
8256         nla_nest_end(msg, nl_tcp);
8257
8258         return 0;
8259 }
8260
8261 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8262 {
8263         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8264         struct sk_buff *msg;
8265         void *hdr;
8266         u32 size = NLMSG_DEFAULT_SIZE;
8267
8268         if (!rdev->wiphy.wowlan)
8269                 return -EOPNOTSUPP;
8270
8271         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8272                 /* adjust size to have room for all the data */
8273                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8274                         rdev->wiphy.wowlan_config->tcp->payload_len +
8275                         rdev->wiphy.wowlan_config->tcp->wake_len +
8276                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8277         }
8278
8279         msg = nlmsg_new(size, GFP_KERNEL);
8280         if (!msg)
8281                 return -ENOMEM;
8282
8283         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8284                              NL80211_CMD_GET_WOWLAN);
8285         if (!hdr)
8286                 goto nla_put_failure;
8287
8288         if (rdev->wiphy.wowlan_config) {
8289                 struct nlattr *nl_wowlan;
8290
8291                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8292                 if (!nl_wowlan)
8293                         goto nla_put_failure;
8294
8295                 if ((rdev->wiphy.wowlan_config->any &&
8296                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8297                     (rdev->wiphy.wowlan_config->disconnect &&
8298                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8299                     (rdev->wiphy.wowlan_config->magic_pkt &&
8300                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8301                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8302                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8303                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8304                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8305                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8306                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8307                     (rdev->wiphy.wowlan_config->rfkill_release &&
8308                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8309                         goto nla_put_failure;
8310
8311                 if (nl80211_send_wowlan_patterns(msg, rdev))
8312                         goto nla_put_failure;
8313
8314                 if (nl80211_send_wowlan_tcp(msg,
8315                                             rdev->wiphy.wowlan_config->tcp))
8316                         goto nla_put_failure;
8317
8318                 nla_nest_end(msg, nl_wowlan);
8319         }
8320
8321         genlmsg_end(msg, hdr);
8322         return genlmsg_reply(msg, info);
8323
8324 nla_put_failure:
8325         nlmsg_free(msg);
8326         return -ENOBUFS;
8327 }
8328
8329 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8330                                     struct nlattr *attr,
8331                                     struct cfg80211_wowlan *trig)
8332 {
8333         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8334         struct cfg80211_wowlan_tcp *cfg;
8335         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8336         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8337         u32 size;
8338         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8339         int err, port;
8340
8341         if (!rdev->wiphy.wowlan->tcp)
8342                 return -EINVAL;
8343
8344         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8345                         nla_data(attr), nla_len(attr),
8346                         nl80211_wowlan_tcp_policy);
8347         if (err)
8348                 return err;
8349
8350         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8351             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8352             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8353             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8354             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8355             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8356             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8357             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8358                 return -EINVAL;
8359
8360         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8361         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8362                 return -EINVAL;
8363
8364         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8365                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8366             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8367                 return -EINVAL;
8368
8369         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8370         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8371                 return -EINVAL;
8372
8373         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8374         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8375                 return -EINVAL;
8376
8377         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8378                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8379
8380                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8381                 tokens_size = tokln - sizeof(*tok);
8382
8383                 if (!tok->len || tokens_size % tok->len)
8384                         return -EINVAL;
8385                 if (!rdev->wiphy.wowlan->tcp->tok)
8386                         return -EINVAL;
8387                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8388                         return -EINVAL;
8389                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8390                         return -EINVAL;
8391                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8392                         return -EINVAL;
8393                 if (tok->offset + tok->len > data_size)
8394                         return -EINVAL;
8395         }
8396
8397         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8398                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8399                 if (!rdev->wiphy.wowlan->tcp->seq)
8400                         return -EINVAL;
8401                 if (seq->len == 0 || seq->len > 4)
8402                         return -EINVAL;
8403                 if (seq->len + seq->offset > data_size)
8404                         return -EINVAL;
8405         }
8406
8407         size = sizeof(*cfg);
8408         size += data_size;
8409         size += wake_size + wake_mask_size;
8410         size += tokens_size;
8411
8412         cfg = kzalloc(size, GFP_KERNEL);
8413         if (!cfg)
8414                 return -ENOMEM;
8415         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8416         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8417         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8418                ETH_ALEN);
8419         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8420                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8421         else
8422                 port = 0;
8423 #ifdef CONFIG_INET
8424         /* allocate a socket and port for it and use it */
8425         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8426                             IPPROTO_TCP, &cfg->sock, 1);
8427         if (err) {
8428                 kfree(cfg);
8429                 return err;
8430         }
8431         if (inet_csk_get_port(cfg->sock->sk, port)) {
8432                 sock_release(cfg->sock);
8433                 kfree(cfg);
8434                 return -EADDRINUSE;
8435         }
8436         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8437 #else
8438         if (!port) {
8439                 kfree(cfg);
8440                 return -EINVAL;
8441         }
8442         cfg->src_port = port;
8443 #endif
8444
8445         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
8446         cfg->payload_len = data_size;
8447         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
8448         memcpy((void *)cfg->payload,
8449                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
8450                data_size);
8451         if (seq)
8452                 cfg->payload_seq = *seq;
8453         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
8454         cfg->wake_len = wake_size;
8455         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
8456         memcpy((void *)cfg->wake_data,
8457                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
8458                wake_size);
8459         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
8460                          data_size + wake_size;
8461         memcpy((void *)cfg->wake_mask,
8462                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
8463                wake_mask_size);
8464         if (tok) {
8465                 cfg->tokens_size = tokens_size;
8466                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
8467         }
8468
8469         trig->tcp = cfg;
8470
8471         return 0;
8472 }
8473
8474 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
8475 {
8476         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8477         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
8478         struct cfg80211_wowlan new_triggers = {};
8479         struct cfg80211_wowlan *ntrig;
8480         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8481         int err, i;
8482         bool prev_enabled = rdev->wiphy.wowlan_config;
8483
8484         if (!wowlan)
8485                 return -EOPNOTSUPP;
8486
8487         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
8488                 cfg80211_rdev_free_wowlan(rdev);
8489                 rdev->wiphy.wowlan_config = NULL;
8490                 goto set_wakeup;
8491         }
8492
8493         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
8494                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8495                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8496                         nl80211_wowlan_policy);
8497         if (err)
8498                 return err;
8499
8500         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
8501                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
8502                         return -EINVAL;
8503                 new_triggers.any = true;
8504         }
8505
8506         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
8507                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
8508                         return -EINVAL;
8509                 new_triggers.disconnect = true;
8510         }
8511
8512         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
8513                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
8514                         return -EINVAL;
8515                 new_triggers.magic_pkt = true;
8516         }
8517
8518         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
8519                 return -EINVAL;
8520
8521         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
8522                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
8523                         return -EINVAL;
8524                 new_triggers.gtk_rekey_failure = true;
8525         }
8526
8527         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
8528                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
8529                         return -EINVAL;
8530                 new_triggers.eap_identity_req = true;
8531         }
8532
8533         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
8534                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
8535                         return -EINVAL;
8536                 new_triggers.four_way_handshake = true;
8537         }
8538
8539         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
8540                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
8541                         return -EINVAL;
8542                 new_triggers.rfkill_release = true;
8543         }
8544
8545         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
8546                 struct nlattr *pat;
8547                 int n_patterns = 0;
8548                 int rem, pat_len, mask_len, pkt_offset;
8549                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8550
8551                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8552                                     rem)
8553                         n_patterns++;
8554                 if (n_patterns > wowlan->n_patterns)
8555                         return -EINVAL;
8556
8557                 new_triggers.patterns = kcalloc(n_patterns,
8558                                                 sizeof(new_triggers.patterns[0]),
8559                                                 GFP_KERNEL);
8560                 if (!new_triggers.patterns)
8561                         return -ENOMEM;
8562
8563                 new_triggers.n_patterns = n_patterns;
8564                 i = 0;
8565
8566                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8567                                     rem) {
8568                         u8 *mask_pat;
8569
8570                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8571                                   nla_len(pat), NULL);
8572                         err = -EINVAL;
8573                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8574                             !pat_tb[NL80211_PKTPAT_PATTERN])
8575                                 goto error;
8576                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8577                         mask_len = DIV_ROUND_UP(pat_len, 8);
8578                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8579                                 goto error;
8580                         if (pat_len > wowlan->pattern_max_len ||
8581                             pat_len < wowlan->pattern_min_len)
8582                                 goto error;
8583
8584                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8585                                 pkt_offset = 0;
8586                         else
8587                                 pkt_offset = nla_get_u32(
8588                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8589                         if (pkt_offset > wowlan->max_pkt_offset)
8590                                 goto error;
8591                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8592
8593                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
8594                         if (!mask_pat) {
8595                                 err = -ENOMEM;
8596                                 goto error;
8597                         }
8598                         new_triggers.patterns[i].mask = mask_pat;
8599                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8600                                mask_len);
8601                         mask_pat += mask_len;
8602                         new_triggers.patterns[i].pattern = mask_pat;
8603                         new_triggers.patterns[i].pattern_len = pat_len;
8604                         memcpy(mask_pat,
8605                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8606                                pat_len);
8607                         i++;
8608                 }
8609         }
8610
8611         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8612                 err = nl80211_parse_wowlan_tcp(
8613                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8614                         &new_triggers);
8615                 if (err)
8616                         goto error;
8617         }
8618
8619         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8620         if (!ntrig) {
8621                 err = -ENOMEM;
8622                 goto error;
8623         }
8624         cfg80211_rdev_free_wowlan(rdev);
8625         rdev->wiphy.wowlan_config = ntrig;
8626
8627  set_wakeup:
8628         if (rdev->ops->set_wakeup &&
8629             prev_enabled != !!rdev->wiphy.wowlan_config)
8630                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8631
8632         return 0;
8633  error:
8634         for (i = 0; i < new_triggers.n_patterns; i++)
8635                 kfree(new_triggers.patterns[i].mask);
8636         kfree(new_triggers.patterns);
8637         if (new_triggers.tcp && new_triggers.tcp->sock)
8638                 sock_release(new_triggers.tcp->sock);
8639         kfree(new_triggers.tcp);
8640         return err;
8641 }
8642 #endif
8643
8644 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
8645                                        struct cfg80211_registered_device *rdev)
8646 {
8647         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
8648         int i, j, pat_len;
8649         struct cfg80211_coalesce_rules *rule;
8650
8651         if (!rdev->coalesce->n_rules)
8652                 return 0;
8653
8654         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
8655         if (!nl_rules)
8656                 return -ENOBUFS;
8657
8658         for (i = 0; i < rdev->coalesce->n_rules; i++) {
8659                 nl_rule = nla_nest_start(msg, i + 1);
8660                 if (!nl_rule)
8661                         return -ENOBUFS;
8662
8663                 rule = &rdev->coalesce->rules[i];
8664                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
8665                                 rule->delay))
8666                         return -ENOBUFS;
8667
8668                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
8669                                 rule->condition))
8670                         return -ENOBUFS;
8671
8672                 nl_pats = nla_nest_start(msg,
8673                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
8674                 if (!nl_pats)
8675                         return -ENOBUFS;
8676
8677                 for (j = 0; j < rule->n_patterns; j++) {
8678                         nl_pat = nla_nest_start(msg, j + 1);
8679                         if (!nl_pat)
8680                                 return -ENOBUFS;
8681                         pat_len = rule->patterns[j].pattern_len;
8682                         if (nla_put(msg, NL80211_PKTPAT_MASK,
8683                                     DIV_ROUND_UP(pat_len, 8),
8684                                     rule->patterns[j].mask) ||
8685                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8686                                     rule->patterns[j].pattern) ||
8687                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8688                                         rule->patterns[j].pkt_offset))
8689                                 return -ENOBUFS;
8690                         nla_nest_end(msg, nl_pat);
8691                 }
8692                 nla_nest_end(msg, nl_pats);
8693                 nla_nest_end(msg, nl_rule);
8694         }
8695         nla_nest_end(msg, nl_rules);
8696
8697         return 0;
8698 }
8699
8700 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
8701 {
8702         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8703         struct sk_buff *msg;
8704         void *hdr;
8705
8706         if (!rdev->wiphy.coalesce)
8707                 return -EOPNOTSUPP;
8708
8709         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8710         if (!msg)
8711                 return -ENOMEM;
8712
8713         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8714                              NL80211_CMD_GET_COALESCE);
8715         if (!hdr)
8716                 goto nla_put_failure;
8717
8718         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
8719                 goto nla_put_failure;
8720
8721         genlmsg_end(msg, hdr);
8722         return genlmsg_reply(msg, info);
8723
8724 nla_put_failure:
8725         nlmsg_free(msg);
8726         return -ENOBUFS;
8727 }
8728
8729 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
8730 {
8731         struct cfg80211_coalesce *coalesce = rdev->coalesce;
8732         int i, j;
8733         struct cfg80211_coalesce_rules *rule;
8734
8735         if (!coalesce)
8736                 return;
8737
8738         for (i = 0; i < coalesce->n_rules; i++) {
8739                 rule = &coalesce->rules[i];
8740                 for (j = 0; j < rule->n_patterns; j++)
8741                         kfree(rule->patterns[j].mask);
8742                 kfree(rule->patterns);
8743         }
8744         kfree(coalesce->rules);
8745         kfree(coalesce);
8746         rdev->coalesce = NULL;
8747 }
8748
8749 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
8750                                        struct nlattr *rule,
8751                                        struct cfg80211_coalesce_rules *new_rule)
8752 {
8753         int err, i;
8754         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8755         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
8756         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
8757         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8758
8759         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
8760                         nla_len(rule), nl80211_coalesce_policy);
8761         if (err)
8762                 return err;
8763
8764         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
8765                 new_rule->delay =
8766                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
8767         if (new_rule->delay > coalesce->max_delay)
8768                 return -EINVAL;
8769
8770         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
8771                 new_rule->condition =
8772                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
8773         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
8774             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
8775                 return -EINVAL;
8776
8777         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
8778                 return -EINVAL;
8779
8780         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8781                             rem)
8782                 n_patterns++;
8783         if (n_patterns > coalesce->n_patterns)
8784                 return -EINVAL;
8785
8786         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
8787                                      GFP_KERNEL);
8788         if (!new_rule->patterns)
8789                 return -ENOMEM;
8790
8791         new_rule->n_patterns = n_patterns;
8792         i = 0;
8793
8794         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8795                             rem) {
8796                 u8 *mask_pat;
8797
8798                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8799                           nla_len(pat), NULL);
8800                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
8801                     !pat_tb[NL80211_PKTPAT_PATTERN])
8802                         return -EINVAL;
8803                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8804                 mask_len = DIV_ROUND_UP(pat_len, 8);
8805                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8806                         return -EINVAL;
8807                 if (pat_len > coalesce->pattern_max_len ||
8808                     pat_len < coalesce->pattern_min_len)
8809                         return -EINVAL;
8810
8811                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
8812                         pkt_offset = 0;
8813                 else
8814                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
8815                 if (pkt_offset > coalesce->max_pkt_offset)
8816                         return -EINVAL;
8817                 new_rule->patterns[i].pkt_offset = pkt_offset;
8818
8819                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
8820                 if (!mask_pat)
8821                         return -ENOMEM;
8822
8823                 new_rule->patterns[i].mask = mask_pat;
8824                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8825                        mask_len);
8826
8827                 mask_pat += mask_len;
8828                 new_rule->patterns[i].pattern = mask_pat;
8829                 new_rule->patterns[i].pattern_len = pat_len;
8830                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8831                        pat_len);
8832                 i++;
8833         }
8834
8835         return 0;
8836 }
8837
8838 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
8839 {
8840         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8841         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8842         struct cfg80211_coalesce new_coalesce = {};
8843         struct cfg80211_coalesce *n_coalesce;
8844         int err, rem_rule, n_rules = 0, i, j;
8845         struct nlattr *rule;
8846         struct cfg80211_coalesce_rules *tmp_rule;
8847
8848         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
8849                 return -EOPNOTSUPP;
8850
8851         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
8852                 cfg80211_rdev_free_coalesce(rdev);
8853                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
8854                 return 0;
8855         }
8856
8857         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8858                             rem_rule)
8859                 n_rules++;
8860         if (n_rules > coalesce->n_rules)
8861                 return -EINVAL;
8862
8863         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
8864                                      GFP_KERNEL);
8865         if (!new_coalesce.rules)
8866                 return -ENOMEM;
8867
8868         new_coalesce.n_rules = n_rules;
8869         i = 0;
8870
8871         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8872                             rem_rule) {
8873                 err = nl80211_parse_coalesce_rule(rdev, rule,
8874                                                   &new_coalesce.rules[i]);
8875                 if (err)
8876                         goto error;
8877
8878                 i++;
8879         }
8880
8881         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
8882         if (err)
8883                 goto error;
8884
8885         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
8886         if (!n_coalesce) {
8887                 err = -ENOMEM;
8888                 goto error;
8889         }
8890         cfg80211_rdev_free_coalesce(rdev);
8891         rdev->coalesce = n_coalesce;
8892
8893         return 0;
8894 error:
8895         for (i = 0; i < new_coalesce.n_rules; i++) {
8896                 tmp_rule = &new_coalesce.rules[i];
8897                 for (j = 0; j < tmp_rule->n_patterns; j++)
8898                         kfree(tmp_rule->patterns[j].mask);
8899                 kfree(tmp_rule->patterns);
8900         }
8901         kfree(new_coalesce.rules);
8902
8903         return err;
8904 }
8905
8906 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8907 {
8908         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8909         struct net_device *dev = info->user_ptr[1];
8910         struct wireless_dev *wdev = dev->ieee80211_ptr;
8911         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8912         struct cfg80211_gtk_rekey_data rekey_data;
8913         int err;
8914
8915         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8916                 return -EINVAL;
8917
8918         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8919                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8920                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8921                         nl80211_rekey_policy);
8922         if (err)
8923                 return err;
8924
8925         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8926                 return -ERANGE;
8927         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8928                 return -ERANGE;
8929         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8930                 return -ERANGE;
8931
8932         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8933                NL80211_KEK_LEN);
8934         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8935                NL80211_KCK_LEN);
8936         memcpy(rekey_data.replay_ctr,
8937                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8938                NL80211_REPLAY_CTR_LEN);
8939
8940         wdev_lock(wdev);
8941         if (!wdev->current_bss) {
8942                 err = -ENOTCONN;
8943                 goto out;
8944         }
8945
8946         if (!rdev->ops->set_rekey_data) {
8947                 err = -EOPNOTSUPP;
8948                 goto out;
8949         }
8950
8951         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8952  out:
8953         wdev_unlock(wdev);
8954         return err;
8955 }
8956
8957 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8958                                              struct genl_info *info)
8959 {
8960         struct net_device *dev = info->user_ptr[1];
8961         struct wireless_dev *wdev = dev->ieee80211_ptr;
8962
8963         if (wdev->iftype != NL80211_IFTYPE_AP &&
8964             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8965                 return -EINVAL;
8966
8967         if (wdev->ap_unexpected_nlportid)
8968                 return -EBUSY;
8969
8970         wdev->ap_unexpected_nlportid = info->snd_portid;
8971         return 0;
8972 }
8973
8974 static int nl80211_probe_client(struct sk_buff *skb,
8975                                 struct genl_info *info)
8976 {
8977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8978         struct net_device *dev = info->user_ptr[1];
8979         struct wireless_dev *wdev = dev->ieee80211_ptr;
8980         struct sk_buff *msg;
8981         void *hdr;
8982         const u8 *addr;
8983         u64 cookie;
8984         int err;
8985
8986         if (wdev->iftype != NL80211_IFTYPE_AP &&
8987             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8988                 return -EOPNOTSUPP;
8989
8990         if (!info->attrs[NL80211_ATTR_MAC])
8991                 return -EINVAL;
8992
8993         if (!rdev->ops->probe_client)
8994                 return -EOPNOTSUPP;
8995
8996         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8997         if (!msg)
8998                 return -ENOMEM;
8999
9000         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9001                              NL80211_CMD_PROBE_CLIENT);
9002         if (!hdr) {
9003                 err = -ENOBUFS;
9004                 goto free_msg;
9005         }
9006
9007         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
9008
9009         err = rdev_probe_client(rdev, dev, addr, &cookie);
9010         if (err)
9011                 goto free_msg;
9012
9013         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9014                 goto nla_put_failure;
9015
9016         genlmsg_end(msg, hdr);
9017
9018         return genlmsg_reply(msg, info);
9019
9020  nla_put_failure:
9021         err = -ENOBUFS;
9022  free_msg:
9023         nlmsg_free(msg);
9024         return err;
9025 }
9026
9027 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
9028 {
9029         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9030         struct cfg80211_beacon_registration *reg, *nreg;
9031         int rv;
9032
9033         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
9034                 return -EOPNOTSUPP;
9035
9036         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
9037         if (!nreg)
9038                 return -ENOMEM;
9039
9040         /* First, check if already registered. */
9041         spin_lock_bh(&rdev->beacon_registrations_lock);
9042         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
9043                 if (reg->nlportid == info->snd_portid) {
9044                         rv = -EALREADY;
9045                         goto out_err;
9046                 }
9047         }
9048         /* Add it to the list */
9049         nreg->nlportid = info->snd_portid;
9050         list_add(&nreg->list, &rdev->beacon_registrations);
9051
9052         spin_unlock_bh(&rdev->beacon_registrations_lock);
9053
9054         return 0;
9055 out_err:
9056         spin_unlock_bh(&rdev->beacon_registrations_lock);
9057         kfree(nreg);
9058         return rv;
9059 }
9060
9061 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
9062 {
9063         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9064         struct wireless_dev *wdev = info->user_ptr[1];
9065         int err;
9066
9067         if (!rdev->ops->start_p2p_device)
9068                 return -EOPNOTSUPP;
9069
9070         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9071                 return -EOPNOTSUPP;
9072
9073         if (wdev->p2p_started)
9074                 return 0;
9075
9076         if (rfkill_blocked(rdev->rfkill))
9077                 return -ERFKILL;
9078
9079         err = rdev_start_p2p_device(rdev, wdev);
9080         if (err)
9081                 return err;
9082
9083         wdev->p2p_started = true;
9084         rdev->opencount++;
9085
9086         return 0;
9087 }
9088
9089 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
9090 {
9091         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9092         struct wireless_dev *wdev = info->user_ptr[1];
9093
9094         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9095                 return -EOPNOTSUPP;
9096
9097         if (!rdev->ops->stop_p2p_device)
9098                 return -EOPNOTSUPP;
9099
9100         cfg80211_stop_p2p_device(rdev, wdev);
9101
9102         return 0;
9103 }
9104
9105 static int nl80211_get_protocol_features(struct sk_buff *skb,
9106                                          struct genl_info *info)
9107 {
9108         void *hdr;
9109         struct sk_buff *msg;
9110
9111         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9112         if (!msg)
9113                 return -ENOMEM;
9114
9115         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9116                              NL80211_CMD_GET_PROTOCOL_FEATURES);
9117         if (!hdr)
9118                 goto nla_put_failure;
9119
9120         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
9121                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
9122                 goto nla_put_failure;
9123
9124         genlmsg_end(msg, hdr);
9125         return genlmsg_reply(msg, info);
9126
9127  nla_put_failure:
9128         kfree_skb(msg);
9129         return -ENOBUFS;
9130 }
9131
9132 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
9133 {
9134         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9135         struct cfg80211_update_ft_ies_params ft_params;
9136         struct net_device *dev = info->user_ptr[1];
9137
9138         if (!rdev->ops->update_ft_ies)
9139                 return -EOPNOTSUPP;
9140
9141         if (!info->attrs[NL80211_ATTR_MDID] ||
9142             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9143                 return -EINVAL;
9144
9145         memset(&ft_params, 0, sizeof(ft_params));
9146         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
9147         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9148         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9149
9150         return rdev_update_ft_ies(rdev, dev, &ft_params);
9151 }
9152
9153 static int nl80211_crit_protocol_start(struct sk_buff *skb,
9154                                        struct genl_info *info)
9155 {
9156         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9157         struct wireless_dev *wdev = info->user_ptr[1];
9158         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
9159         u16 duration;
9160         int ret;
9161
9162         if (!rdev->ops->crit_proto_start)
9163                 return -EOPNOTSUPP;
9164
9165         if (WARN_ON(!rdev->ops->crit_proto_stop))
9166                 return -EINVAL;
9167
9168         if (rdev->crit_proto_nlportid)
9169                 return -EBUSY;
9170
9171         /* determine protocol if provided */
9172         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
9173                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
9174
9175         if (proto >= NUM_NL80211_CRIT_PROTO)
9176                 return -EINVAL;
9177
9178         /* timeout must be provided */
9179         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
9180                 return -EINVAL;
9181
9182         duration =
9183                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
9184
9185         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
9186                 return -ERANGE;
9187
9188         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
9189         if (!ret)
9190                 rdev->crit_proto_nlportid = info->snd_portid;
9191
9192         return ret;
9193 }
9194
9195 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
9196                                       struct genl_info *info)
9197 {
9198         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9199         struct wireless_dev *wdev = info->user_ptr[1];
9200
9201         if (!rdev->ops->crit_proto_stop)
9202                 return -EOPNOTSUPP;
9203
9204         if (rdev->crit_proto_nlportid) {
9205                 rdev->crit_proto_nlportid = 0;
9206                 rdev_crit_proto_stop(rdev, wdev);
9207         }
9208         return 0;
9209 }
9210
9211 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
9212 {
9213         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9214         struct wireless_dev *wdev =
9215                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9216         int i, err;
9217         u32 vid, subcmd;
9218
9219         if (!rdev->wiphy.vendor_commands)
9220                 return -EOPNOTSUPP;
9221
9222         if (IS_ERR(wdev)) {
9223                 err = PTR_ERR(wdev);
9224                 if (err != -EINVAL)
9225                         return err;
9226                 wdev = NULL;
9227         } else if (wdev->wiphy != &rdev->wiphy) {
9228                 return -EINVAL;
9229         }
9230
9231         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9232             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9233                 return -EINVAL;
9234
9235         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9236         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9237         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9238                 const struct wiphy_vendor_command *vcmd;
9239                 void *data = NULL;
9240                 int len = 0;
9241
9242                 vcmd = &rdev->wiphy.vendor_commands[i];
9243
9244                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9245                         continue;
9246
9247                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9248                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9249                         if (!wdev)
9250                                 return -EINVAL;
9251                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9252                             !wdev->netdev)
9253                                 return -EINVAL;
9254
9255                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9256                                 if (wdev->netdev &&
9257                                     !netif_running(wdev->netdev))
9258                                         return -ENETDOWN;
9259                                 if (!wdev->netdev && !wdev->p2p_started)
9260                                         return -ENETDOWN;
9261                         }
9262                 } else {
9263                         wdev = NULL;
9264                 }
9265
9266                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9267                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9268                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9269                 }
9270
9271                 rdev->cur_cmd_info = info;
9272                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9273                                                           data, len);
9274                 rdev->cur_cmd_info = NULL;
9275                 return err;
9276         }
9277
9278         return -EOPNOTSUPP;
9279 }
9280
9281 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
9282                                            enum nl80211_commands cmd,
9283                                            enum nl80211_attrs attr,
9284                                            int approxlen)
9285 {
9286         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9287
9288         if (WARN_ON(!rdev->cur_cmd_info))
9289                 return NULL;
9290
9291         return __cfg80211_alloc_vendor_skb(rdev, approxlen,
9292                                            rdev->cur_cmd_info->snd_portid,
9293                                            rdev->cur_cmd_info->snd_seq,
9294                                            cmd, attr, NULL, GFP_KERNEL);
9295 }
9296 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
9297
9298 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
9299 {
9300         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9301         void *hdr = ((void **)skb->cb)[1];
9302         struct nlattr *data = ((void **)skb->cb)[2];
9303
9304         if (WARN_ON(!rdev->cur_cmd_info)) {
9305                 kfree_skb(skb);
9306                 return -EINVAL;
9307         }
9308
9309         nla_nest_end(skb, data);
9310         genlmsg_end(skb, hdr);
9311         return genlmsg_reply(skb, rdev->cur_cmd_info);
9312 }
9313 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
9314
9315
9316 static int nl80211_set_qos_map(struct sk_buff *skb,
9317                                struct genl_info *info)
9318 {
9319         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9320         struct cfg80211_qos_map *qos_map = NULL;
9321         struct net_device *dev = info->user_ptr[1];
9322         u8 *pos, len, num_des, des_len, des;
9323         int ret;
9324
9325         if (!rdev->ops->set_qos_map)
9326                 return -EOPNOTSUPP;
9327
9328         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
9329                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
9330                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
9331
9332                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
9333                     len > IEEE80211_QOS_MAP_LEN_MAX)
9334                         return -EINVAL;
9335
9336                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
9337                 if (!qos_map)
9338                         return -ENOMEM;
9339
9340                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
9341                 if (num_des) {
9342                         des_len = num_des *
9343                                 sizeof(struct cfg80211_dscp_exception);
9344                         memcpy(qos_map->dscp_exception, pos, des_len);
9345                         qos_map->num_des = num_des;
9346                         for (des = 0; des < num_des; des++) {
9347                                 if (qos_map->dscp_exception[des].up > 7) {
9348                                         kfree(qos_map);
9349                                         return -EINVAL;
9350                                 }
9351                         }
9352                         pos += des_len;
9353                 }
9354                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
9355         }
9356
9357         wdev_lock(dev->ieee80211_ptr);
9358         ret = nl80211_key_allowed(dev->ieee80211_ptr);
9359         if (!ret)
9360                 ret = rdev_set_qos_map(rdev, dev, qos_map);
9361         wdev_unlock(dev->ieee80211_ptr);
9362
9363         kfree(qos_map);
9364         return ret;
9365 }
9366
9367 #define NL80211_FLAG_NEED_WIPHY         0x01
9368 #define NL80211_FLAG_NEED_NETDEV        0x02
9369 #define NL80211_FLAG_NEED_RTNL          0x04
9370 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
9371 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
9372                                          NL80211_FLAG_CHECK_NETDEV_UP)
9373 #define NL80211_FLAG_NEED_WDEV          0x10
9374 /* If a netdev is associated, it must be UP, P2P must be started */
9375 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
9376                                          NL80211_FLAG_CHECK_NETDEV_UP)
9377
9378 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
9379                             struct genl_info *info)
9380 {
9381         struct cfg80211_registered_device *rdev;
9382         struct wireless_dev *wdev;
9383         struct net_device *dev;
9384         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
9385
9386         if (rtnl)
9387                 rtnl_lock();
9388
9389         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
9390                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9391                 if (IS_ERR(rdev)) {
9392                         if (rtnl)
9393                                 rtnl_unlock();
9394                         return PTR_ERR(rdev);
9395                 }
9396                 info->user_ptr[0] = rdev;
9397         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
9398                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9399                 ASSERT_RTNL();
9400
9401                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
9402                                                   info->attrs);
9403                 if (IS_ERR(wdev)) {
9404                         if (rtnl)
9405                                 rtnl_unlock();
9406                         return PTR_ERR(wdev);
9407                 }
9408
9409                 dev = wdev->netdev;
9410                 rdev = wiphy_to_rdev(wdev->wiphy);
9411
9412                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
9413                         if (!dev) {
9414                                 if (rtnl)
9415                                         rtnl_unlock();
9416                                 return -EINVAL;
9417                         }
9418
9419                         info->user_ptr[1] = dev;
9420                 } else {
9421                         info->user_ptr[1] = wdev;
9422                 }
9423
9424                 if (dev) {
9425                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
9426                             !netif_running(dev)) {
9427                                 if (rtnl)
9428                                         rtnl_unlock();
9429                                 return -ENETDOWN;
9430                         }
9431
9432                         dev_hold(dev);
9433                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
9434                         if (!wdev->p2p_started) {
9435                                 if (rtnl)
9436                                         rtnl_unlock();
9437                                 return -ENETDOWN;
9438                         }
9439                 }
9440
9441                 info->user_ptr[0] = rdev;
9442         }
9443
9444         return 0;
9445 }
9446
9447 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
9448                               struct genl_info *info)
9449 {
9450         if (info->user_ptr[1]) {
9451                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9452                         struct wireless_dev *wdev = info->user_ptr[1];
9453
9454                         if (wdev->netdev)
9455                                 dev_put(wdev->netdev);
9456                 } else {
9457                         dev_put(info->user_ptr[1]);
9458                 }
9459         }
9460         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
9461                 rtnl_unlock();
9462 }
9463
9464 static const struct genl_ops nl80211_ops[] = {
9465         {
9466                 .cmd = NL80211_CMD_GET_WIPHY,
9467                 .doit = nl80211_get_wiphy,
9468                 .dumpit = nl80211_dump_wiphy,
9469                 .done = nl80211_dump_wiphy_done,
9470                 .policy = nl80211_policy,
9471                 /* can be retrieved by unprivileged users */
9472                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9473                                   NL80211_FLAG_NEED_RTNL,
9474         },
9475         {
9476                 .cmd = NL80211_CMD_SET_WIPHY,
9477                 .doit = nl80211_set_wiphy,
9478                 .policy = nl80211_policy,
9479                 .flags = GENL_ADMIN_PERM,
9480                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9481         },
9482         {
9483                 .cmd = NL80211_CMD_GET_INTERFACE,
9484                 .doit = nl80211_get_interface,
9485                 .dumpit = nl80211_dump_interface,
9486                 .policy = nl80211_policy,
9487                 /* can be retrieved by unprivileged users */
9488                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9489                                   NL80211_FLAG_NEED_RTNL,
9490         },
9491         {
9492                 .cmd = NL80211_CMD_SET_INTERFACE,
9493                 .doit = nl80211_set_interface,
9494                 .policy = nl80211_policy,
9495                 .flags = GENL_ADMIN_PERM,
9496                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9497                                   NL80211_FLAG_NEED_RTNL,
9498         },
9499         {
9500                 .cmd = NL80211_CMD_NEW_INTERFACE,
9501                 .doit = nl80211_new_interface,
9502                 .policy = nl80211_policy,
9503                 .flags = GENL_ADMIN_PERM,
9504                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9505                                   NL80211_FLAG_NEED_RTNL,
9506         },
9507         {
9508                 .cmd = NL80211_CMD_DEL_INTERFACE,
9509                 .doit = nl80211_del_interface,
9510                 .policy = nl80211_policy,
9511                 .flags = GENL_ADMIN_PERM,
9512                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9513                                   NL80211_FLAG_NEED_RTNL,
9514         },
9515         {
9516                 .cmd = NL80211_CMD_GET_KEY,
9517                 .doit = nl80211_get_key,
9518                 .policy = nl80211_policy,
9519                 .flags = GENL_ADMIN_PERM,
9520                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9521                                   NL80211_FLAG_NEED_RTNL,
9522         },
9523         {
9524                 .cmd = NL80211_CMD_SET_KEY,
9525                 .doit = nl80211_set_key,
9526                 .policy = nl80211_policy,
9527                 .flags = GENL_ADMIN_PERM,
9528                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9529                                   NL80211_FLAG_NEED_RTNL,
9530         },
9531         {
9532                 .cmd = NL80211_CMD_NEW_KEY,
9533                 .doit = nl80211_new_key,
9534                 .policy = nl80211_policy,
9535                 .flags = GENL_ADMIN_PERM,
9536                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9537                                   NL80211_FLAG_NEED_RTNL,
9538         },
9539         {
9540                 .cmd = NL80211_CMD_DEL_KEY,
9541                 .doit = nl80211_del_key,
9542                 .policy = nl80211_policy,
9543                 .flags = GENL_ADMIN_PERM,
9544                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9545                                   NL80211_FLAG_NEED_RTNL,
9546         },
9547         {
9548                 .cmd = NL80211_CMD_SET_BEACON,
9549                 .policy = nl80211_policy,
9550                 .flags = GENL_ADMIN_PERM,
9551                 .doit = nl80211_set_beacon,
9552                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9553                                   NL80211_FLAG_NEED_RTNL,
9554         },
9555         {
9556                 .cmd = NL80211_CMD_START_AP,
9557                 .policy = nl80211_policy,
9558                 .flags = GENL_ADMIN_PERM,
9559                 .doit = nl80211_start_ap,
9560                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9561                                   NL80211_FLAG_NEED_RTNL,
9562         },
9563         {
9564                 .cmd = NL80211_CMD_STOP_AP,
9565                 .policy = nl80211_policy,
9566                 .flags = GENL_ADMIN_PERM,
9567                 .doit = nl80211_stop_ap,
9568                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9569                                   NL80211_FLAG_NEED_RTNL,
9570         },
9571         {
9572                 .cmd = NL80211_CMD_GET_STATION,
9573                 .doit = nl80211_get_station,
9574                 .dumpit = nl80211_dump_station,
9575                 .policy = nl80211_policy,
9576                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9577                                   NL80211_FLAG_NEED_RTNL,
9578         },
9579         {
9580                 .cmd = NL80211_CMD_SET_STATION,
9581                 .doit = nl80211_set_station,
9582                 .policy = nl80211_policy,
9583                 .flags = GENL_ADMIN_PERM,
9584                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9585                                   NL80211_FLAG_NEED_RTNL,
9586         },
9587         {
9588                 .cmd = NL80211_CMD_NEW_STATION,
9589                 .doit = nl80211_new_station,
9590                 .policy = nl80211_policy,
9591                 .flags = GENL_ADMIN_PERM,
9592                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9593                                   NL80211_FLAG_NEED_RTNL,
9594         },
9595         {
9596                 .cmd = NL80211_CMD_DEL_STATION,
9597                 .doit = nl80211_del_station,
9598                 .policy = nl80211_policy,
9599                 .flags = GENL_ADMIN_PERM,
9600                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9601                                   NL80211_FLAG_NEED_RTNL,
9602         },
9603         {
9604                 .cmd = NL80211_CMD_GET_MPATH,
9605                 .doit = nl80211_get_mpath,
9606                 .dumpit = nl80211_dump_mpath,
9607                 .policy = nl80211_policy,
9608                 .flags = GENL_ADMIN_PERM,
9609                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9610                                   NL80211_FLAG_NEED_RTNL,
9611         },
9612         {
9613                 .cmd = NL80211_CMD_SET_MPATH,
9614                 .doit = nl80211_set_mpath,
9615                 .policy = nl80211_policy,
9616                 .flags = GENL_ADMIN_PERM,
9617                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9618                                   NL80211_FLAG_NEED_RTNL,
9619         },
9620         {
9621                 .cmd = NL80211_CMD_NEW_MPATH,
9622                 .doit = nl80211_new_mpath,
9623                 .policy = nl80211_policy,
9624                 .flags = GENL_ADMIN_PERM,
9625                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9626                                   NL80211_FLAG_NEED_RTNL,
9627         },
9628         {
9629                 .cmd = NL80211_CMD_DEL_MPATH,
9630                 .doit = nl80211_del_mpath,
9631                 .policy = nl80211_policy,
9632                 .flags = GENL_ADMIN_PERM,
9633                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9634                                   NL80211_FLAG_NEED_RTNL,
9635         },
9636         {
9637                 .cmd = NL80211_CMD_SET_BSS,
9638                 .doit = nl80211_set_bss,
9639                 .policy = nl80211_policy,
9640                 .flags = GENL_ADMIN_PERM,
9641                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9642                                   NL80211_FLAG_NEED_RTNL,
9643         },
9644         {
9645                 .cmd = NL80211_CMD_GET_REG,
9646                 .doit = nl80211_get_reg,
9647                 .policy = nl80211_policy,
9648                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9649                 /* can be retrieved by unprivileged users */
9650         },
9651         {
9652                 .cmd = NL80211_CMD_SET_REG,
9653                 .doit = nl80211_set_reg,
9654                 .policy = nl80211_policy,
9655                 .flags = GENL_ADMIN_PERM,
9656                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9657         },
9658         {
9659                 .cmd = NL80211_CMD_REQ_SET_REG,
9660                 .doit = nl80211_req_set_reg,
9661                 .policy = nl80211_policy,
9662                 .flags = GENL_ADMIN_PERM,
9663         },
9664         {
9665                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
9666                 .doit = nl80211_get_mesh_config,
9667                 .policy = nl80211_policy,
9668                 /* can be retrieved by unprivileged users */
9669                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9670                                   NL80211_FLAG_NEED_RTNL,
9671         },
9672         {
9673                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
9674                 .doit = nl80211_update_mesh_config,
9675                 .policy = nl80211_policy,
9676                 .flags = GENL_ADMIN_PERM,
9677                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9678                                   NL80211_FLAG_NEED_RTNL,
9679         },
9680         {
9681                 .cmd = NL80211_CMD_TRIGGER_SCAN,
9682                 .doit = nl80211_trigger_scan,
9683                 .policy = nl80211_policy,
9684                 .flags = GENL_ADMIN_PERM,
9685                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9686                                   NL80211_FLAG_NEED_RTNL,
9687         },
9688         {
9689                 .cmd = NL80211_CMD_GET_SCAN,
9690                 .policy = nl80211_policy,
9691                 .dumpit = nl80211_dump_scan,
9692         },
9693         {
9694                 .cmd = NL80211_CMD_START_SCHED_SCAN,
9695                 .doit = nl80211_start_sched_scan,
9696                 .policy = nl80211_policy,
9697                 .flags = GENL_ADMIN_PERM,
9698                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9699                                   NL80211_FLAG_NEED_RTNL,
9700         },
9701         {
9702                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
9703                 .doit = nl80211_stop_sched_scan,
9704                 .policy = nl80211_policy,
9705                 .flags = GENL_ADMIN_PERM,
9706                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9707                                   NL80211_FLAG_NEED_RTNL,
9708         },
9709         {
9710                 .cmd = NL80211_CMD_AUTHENTICATE,
9711                 .doit = nl80211_authenticate,
9712                 .policy = nl80211_policy,
9713                 .flags = GENL_ADMIN_PERM,
9714                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9715                                   NL80211_FLAG_NEED_RTNL,
9716         },
9717         {
9718                 .cmd = NL80211_CMD_ASSOCIATE,
9719                 .doit = nl80211_associate,
9720                 .policy = nl80211_policy,
9721                 .flags = GENL_ADMIN_PERM,
9722                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9723                                   NL80211_FLAG_NEED_RTNL,
9724         },
9725         {
9726                 .cmd = NL80211_CMD_DEAUTHENTICATE,
9727                 .doit = nl80211_deauthenticate,
9728                 .policy = nl80211_policy,
9729                 .flags = GENL_ADMIN_PERM,
9730                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9731                                   NL80211_FLAG_NEED_RTNL,
9732         },
9733         {
9734                 .cmd = NL80211_CMD_DISASSOCIATE,
9735                 .doit = nl80211_disassociate,
9736                 .policy = nl80211_policy,
9737                 .flags = GENL_ADMIN_PERM,
9738                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9739                                   NL80211_FLAG_NEED_RTNL,
9740         },
9741         {
9742                 .cmd = NL80211_CMD_JOIN_IBSS,
9743                 .doit = nl80211_join_ibss,
9744                 .policy = nl80211_policy,
9745                 .flags = GENL_ADMIN_PERM,
9746                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9747                                   NL80211_FLAG_NEED_RTNL,
9748         },
9749         {
9750                 .cmd = NL80211_CMD_LEAVE_IBSS,
9751                 .doit = nl80211_leave_ibss,
9752                 .policy = nl80211_policy,
9753                 .flags = GENL_ADMIN_PERM,
9754                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9755                                   NL80211_FLAG_NEED_RTNL,
9756         },
9757 #ifdef CONFIG_NL80211_TESTMODE
9758         {
9759                 .cmd = NL80211_CMD_TESTMODE,
9760                 .doit = nl80211_testmode_do,
9761                 .dumpit = nl80211_testmode_dump,
9762                 .policy = nl80211_policy,
9763                 .flags = GENL_ADMIN_PERM,
9764                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9765                                   NL80211_FLAG_NEED_RTNL,
9766         },
9767 #endif
9768         {
9769                 .cmd = NL80211_CMD_CONNECT,
9770                 .doit = nl80211_connect,
9771                 .policy = nl80211_policy,
9772                 .flags = GENL_ADMIN_PERM,
9773                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9774                                   NL80211_FLAG_NEED_RTNL,
9775         },
9776         {
9777                 .cmd = NL80211_CMD_DISCONNECT,
9778                 .doit = nl80211_disconnect,
9779                 .policy = nl80211_policy,
9780                 .flags = GENL_ADMIN_PERM,
9781                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9782                                   NL80211_FLAG_NEED_RTNL,
9783         },
9784         {
9785                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
9786                 .doit = nl80211_wiphy_netns,
9787                 .policy = nl80211_policy,
9788                 .flags = GENL_ADMIN_PERM,
9789                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9790                                   NL80211_FLAG_NEED_RTNL,
9791         },
9792         {
9793                 .cmd = NL80211_CMD_GET_SURVEY,
9794                 .policy = nl80211_policy,
9795                 .dumpit = nl80211_dump_survey,
9796         },
9797         {
9798                 .cmd = NL80211_CMD_SET_PMKSA,
9799                 .doit = nl80211_setdel_pmksa,
9800                 .policy = nl80211_policy,
9801                 .flags = GENL_ADMIN_PERM,
9802                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9803                                   NL80211_FLAG_NEED_RTNL,
9804         },
9805         {
9806                 .cmd = NL80211_CMD_DEL_PMKSA,
9807                 .doit = nl80211_setdel_pmksa,
9808                 .policy = nl80211_policy,
9809                 .flags = GENL_ADMIN_PERM,
9810                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9811                                   NL80211_FLAG_NEED_RTNL,
9812         },
9813         {
9814                 .cmd = NL80211_CMD_FLUSH_PMKSA,
9815                 .doit = nl80211_flush_pmksa,
9816                 .policy = nl80211_policy,
9817                 .flags = GENL_ADMIN_PERM,
9818                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9819                                   NL80211_FLAG_NEED_RTNL,
9820         },
9821         {
9822                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
9823                 .doit = nl80211_remain_on_channel,
9824                 .policy = nl80211_policy,
9825                 .flags = GENL_ADMIN_PERM,
9826                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9827                                   NL80211_FLAG_NEED_RTNL,
9828         },
9829         {
9830                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9831                 .doit = nl80211_cancel_remain_on_channel,
9832                 .policy = nl80211_policy,
9833                 .flags = GENL_ADMIN_PERM,
9834                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9835                                   NL80211_FLAG_NEED_RTNL,
9836         },
9837         {
9838                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
9839                 .doit = nl80211_set_tx_bitrate_mask,
9840                 .policy = nl80211_policy,
9841                 .flags = GENL_ADMIN_PERM,
9842                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9843                                   NL80211_FLAG_NEED_RTNL,
9844         },
9845         {
9846                 .cmd = NL80211_CMD_REGISTER_FRAME,
9847                 .doit = nl80211_register_mgmt,
9848                 .policy = nl80211_policy,
9849                 .flags = GENL_ADMIN_PERM,
9850                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9851                                   NL80211_FLAG_NEED_RTNL,
9852         },
9853         {
9854                 .cmd = NL80211_CMD_FRAME,
9855                 .doit = nl80211_tx_mgmt,
9856                 .policy = nl80211_policy,
9857                 .flags = GENL_ADMIN_PERM,
9858                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9859                                   NL80211_FLAG_NEED_RTNL,
9860         },
9861         {
9862                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
9863                 .doit = nl80211_tx_mgmt_cancel_wait,
9864                 .policy = nl80211_policy,
9865                 .flags = GENL_ADMIN_PERM,
9866                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9867                                   NL80211_FLAG_NEED_RTNL,
9868         },
9869         {
9870                 .cmd = NL80211_CMD_SET_POWER_SAVE,
9871                 .doit = nl80211_set_power_save,
9872                 .policy = nl80211_policy,
9873                 .flags = GENL_ADMIN_PERM,
9874                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9875                                   NL80211_FLAG_NEED_RTNL,
9876         },
9877         {
9878                 .cmd = NL80211_CMD_GET_POWER_SAVE,
9879                 .doit = nl80211_get_power_save,
9880                 .policy = nl80211_policy,
9881                 /* can be retrieved by unprivileged users */
9882                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9883                                   NL80211_FLAG_NEED_RTNL,
9884         },
9885         {
9886                 .cmd = NL80211_CMD_SET_CQM,
9887                 .doit = nl80211_set_cqm,
9888                 .policy = nl80211_policy,
9889                 .flags = GENL_ADMIN_PERM,
9890                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9891                                   NL80211_FLAG_NEED_RTNL,
9892         },
9893         {
9894                 .cmd = NL80211_CMD_SET_CHANNEL,
9895                 .doit = nl80211_set_channel,
9896                 .policy = nl80211_policy,
9897                 .flags = GENL_ADMIN_PERM,
9898                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9899                                   NL80211_FLAG_NEED_RTNL,
9900         },
9901         {
9902                 .cmd = NL80211_CMD_SET_WDS_PEER,
9903                 .doit = nl80211_set_wds_peer,
9904                 .policy = nl80211_policy,
9905                 .flags = GENL_ADMIN_PERM,
9906                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9907                                   NL80211_FLAG_NEED_RTNL,
9908         },
9909         {
9910                 .cmd = NL80211_CMD_JOIN_MESH,
9911                 .doit = nl80211_join_mesh,
9912                 .policy = nl80211_policy,
9913                 .flags = GENL_ADMIN_PERM,
9914                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9915                                   NL80211_FLAG_NEED_RTNL,
9916         },
9917         {
9918                 .cmd = NL80211_CMD_LEAVE_MESH,
9919                 .doit = nl80211_leave_mesh,
9920                 .policy = nl80211_policy,
9921                 .flags = GENL_ADMIN_PERM,
9922                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9923                                   NL80211_FLAG_NEED_RTNL,
9924         },
9925 #ifdef CONFIG_PM
9926         {
9927                 .cmd = NL80211_CMD_GET_WOWLAN,
9928                 .doit = nl80211_get_wowlan,
9929                 .policy = nl80211_policy,
9930                 /* can be retrieved by unprivileged users */
9931                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9932                                   NL80211_FLAG_NEED_RTNL,
9933         },
9934         {
9935                 .cmd = NL80211_CMD_SET_WOWLAN,
9936                 .doit = nl80211_set_wowlan,
9937                 .policy = nl80211_policy,
9938                 .flags = GENL_ADMIN_PERM,
9939                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9940                                   NL80211_FLAG_NEED_RTNL,
9941         },
9942 #endif
9943         {
9944                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
9945                 .doit = nl80211_set_rekey_data,
9946                 .policy = nl80211_policy,
9947                 .flags = GENL_ADMIN_PERM,
9948                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9949                                   NL80211_FLAG_NEED_RTNL,
9950         },
9951         {
9952                 .cmd = NL80211_CMD_TDLS_MGMT,
9953                 .doit = nl80211_tdls_mgmt,
9954                 .policy = nl80211_policy,
9955                 .flags = GENL_ADMIN_PERM,
9956                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9957                                   NL80211_FLAG_NEED_RTNL,
9958         },
9959         {
9960                 .cmd = NL80211_CMD_TDLS_OPER,
9961                 .doit = nl80211_tdls_oper,
9962                 .policy = nl80211_policy,
9963                 .flags = GENL_ADMIN_PERM,
9964                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9965                                   NL80211_FLAG_NEED_RTNL,
9966         },
9967         {
9968                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
9969                 .doit = nl80211_register_unexpected_frame,
9970                 .policy = nl80211_policy,
9971                 .flags = GENL_ADMIN_PERM,
9972                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9973                                   NL80211_FLAG_NEED_RTNL,
9974         },
9975         {
9976                 .cmd = NL80211_CMD_PROBE_CLIENT,
9977                 .doit = nl80211_probe_client,
9978                 .policy = nl80211_policy,
9979                 .flags = GENL_ADMIN_PERM,
9980                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9981                                   NL80211_FLAG_NEED_RTNL,
9982         },
9983         {
9984                 .cmd = NL80211_CMD_REGISTER_BEACONS,
9985                 .doit = nl80211_register_beacons,
9986                 .policy = nl80211_policy,
9987                 .flags = GENL_ADMIN_PERM,
9988                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9989                                   NL80211_FLAG_NEED_RTNL,
9990         },
9991         {
9992                 .cmd = NL80211_CMD_SET_NOACK_MAP,
9993                 .doit = nl80211_set_noack_map,
9994                 .policy = nl80211_policy,
9995                 .flags = GENL_ADMIN_PERM,
9996                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9997                                   NL80211_FLAG_NEED_RTNL,
9998         },
9999         {
10000                 .cmd = NL80211_CMD_START_P2P_DEVICE,
10001                 .doit = nl80211_start_p2p_device,
10002                 .policy = nl80211_policy,
10003                 .flags = GENL_ADMIN_PERM,
10004                 .internal_flags = NL80211_FLAG_NEED_WDEV |
10005                                   NL80211_FLAG_NEED_RTNL,
10006         },
10007         {
10008                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
10009                 .doit = nl80211_stop_p2p_device,
10010                 .policy = nl80211_policy,
10011                 .flags = GENL_ADMIN_PERM,
10012                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10013                                   NL80211_FLAG_NEED_RTNL,
10014         },
10015         {
10016                 .cmd = NL80211_CMD_SET_MCAST_RATE,
10017                 .doit = nl80211_set_mcast_rate,
10018                 .policy = nl80211_policy,
10019                 .flags = GENL_ADMIN_PERM,
10020                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10021                                   NL80211_FLAG_NEED_RTNL,
10022         },
10023         {
10024                 .cmd = NL80211_CMD_SET_MAC_ACL,
10025                 .doit = nl80211_set_mac_acl,
10026                 .policy = nl80211_policy,
10027                 .flags = GENL_ADMIN_PERM,
10028                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
10029                                   NL80211_FLAG_NEED_RTNL,
10030         },
10031         {
10032                 .cmd = NL80211_CMD_RADAR_DETECT,
10033                 .doit = nl80211_start_radar_detection,
10034                 .policy = nl80211_policy,
10035                 .flags = GENL_ADMIN_PERM,
10036                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10037                                   NL80211_FLAG_NEED_RTNL,
10038         },
10039         {
10040                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
10041                 .doit = nl80211_get_protocol_features,
10042                 .policy = nl80211_policy,
10043         },
10044         {
10045                 .cmd = NL80211_CMD_UPDATE_FT_IES,
10046                 .doit = nl80211_update_ft_ies,
10047                 .policy = nl80211_policy,
10048                 .flags = GENL_ADMIN_PERM,
10049                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10050                                   NL80211_FLAG_NEED_RTNL,
10051         },
10052         {
10053                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
10054                 .doit = nl80211_crit_protocol_start,
10055                 .policy = nl80211_policy,
10056                 .flags = GENL_ADMIN_PERM,
10057                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10058                                   NL80211_FLAG_NEED_RTNL,
10059         },
10060         {
10061                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
10062                 .doit = nl80211_crit_protocol_stop,
10063                 .policy = nl80211_policy,
10064                 .flags = GENL_ADMIN_PERM,
10065                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10066                                   NL80211_FLAG_NEED_RTNL,
10067         },
10068         {
10069                 .cmd = NL80211_CMD_GET_COALESCE,
10070                 .doit = nl80211_get_coalesce,
10071                 .policy = nl80211_policy,
10072                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10073                                   NL80211_FLAG_NEED_RTNL,
10074         },
10075         {
10076                 .cmd = NL80211_CMD_SET_COALESCE,
10077                 .doit = nl80211_set_coalesce,
10078                 .policy = nl80211_policy,
10079                 .flags = GENL_ADMIN_PERM,
10080                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10081                                   NL80211_FLAG_NEED_RTNL,
10082         },
10083         {
10084                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
10085                 .doit = nl80211_channel_switch,
10086                 .policy = nl80211_policy,
10087                 .flags = GENL_ADMIN_PERM,
10088                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10089                                   NL80211_FLAG_NEED_RTNL,
10090         },
10091         {
10092                 .cmd = NL80211_CMD_VENDOR,
10093                 .doit = nl80211_vendor_cmd,
10094                 .policy = nl80211_policy,
10095                 .flags = GENL_ADMIN_PERM,
10096                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10097                                   NL80211_FLAG_NEED_RTNL,
10098         },
10099         {
10100                 .cmd = NL80211_CMD_SET_QOS_MAP,
10101                 .doit = nl80211_set_qos_map,
10102                 .policy = nl80211_policy,
10103                 .flags = GENL_ADMIN_PERM,
10104                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10105                                   NL80211_FLAG_NEED_RTNL,
10106         },
10107 };
10108
10109 /* notification functions */
10110
10111 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
10112                           enum nl80211_commands cmd)
10113 {
10114         struct sk_buff *msg;
10115         struct nl80211_dump_wiphy_state state = {};
10116
10117         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
10118                 cmd != NL80211_CMD_DEL_WIPHY);
10119
10120         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10121         if (!msg)
10122                 return;
10123
10124         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
10125                 nlmsg_free(msg);
10126                 return;
10127         }
10128
10129         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10130                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
10131 }
10132
10133 static int nl80211_add_scan_req(struct sk_buff *msg,
10134                                 struct cfg80211_registered_device *rdev)
10135 {
10136         struct cfg80211_scan_request *req = rdev->scan_req;
10137         struct nlattr *nest;
10138         int i;
10139
10140         if (WARN_ON(!req))
10141                 return 0;
10142
10143         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
10144         if (!nest)
10145                 goto nla_put_failure;
10146         for (i = 0; i < req->n_ssids; i++) {
10147                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
10148                         goto nla_put_failure;
10149         }
10150         nla_nest_end(msg, nest);
10151
10152         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10153         if (!nest)
10154                 goto nla_put_failure;
10155         for (i = 0; i < req->n_channels; i++) {
10156                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10157                         goto nla_put_failure;
10158         }
10159         nla_nest_end(msg, nest);
10160
10161         if (req->ie &&
10162             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
10163                 goto nla_put_failure;
10164
10165         if (req->flags &&
10166             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
10167                 goto nla_put_failure;
10168
10169         return 0;
10170  nla_put_failure:
10171         return -ENOBUFS;
10172 }
10173
10174 static int nl80211_send_scan_msg(struct sk_buff *msg,
10175                                  struct cfg80211_registered_device *rdev,
10176                                  struct wireless_dev *wdev,
10177                                  u32 portid, u32 seq, int flags,
10178                                  u32 cmd)
10179 {
10180         void *hdr;
10181
10182         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10183         if (!hdr)
10184                 return -1;
10185
10186         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10187             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10188                                          wdev->netdev->ifindex)) ||
10189             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10190                 goto nla_put_failure;
10191
10192         /* ignore errors and send incomplete event anyway */
10193         nl80211_add_scan_req(msg, rdev);
10194
10195         return genlmsg_end(msg, hdr);
10196
10197  nla_put_failure:
10198         genlmsg_cancel(msg, hdr);
10199         return -EMSGSIZE;
10200 }
10201
10202 static int
10203 nl80211_send_sched_scan_msg(struct sk_buff *msg,
10204                             struct cfg80211_registered_device *rdev,
10205                             struct net_device *netdev,
10206                             u32 portid, u32 seq, int flags, u32 cmd)
10207 {
10208         void *hdr;
10209
10210         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10211         if (!hdr)
10212                 return -1;
10213
10214         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10215             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10216                 goto nla_put_failure;
10217
10218         return genlmsg_end(msg, hdr);
10219
10220  nla_put_failure:
10221         genlmsg_cancel(msg, hdr);
10222         return -EMSGSIZE;
10223 }
10224
10225 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
10226                              struct wireless_dev *wdev)
10227 {
10228         struct sk_buff *msg;
10229
10230         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10231         if (!msg)
10232                 return;
10233
10234         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10235                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
10236                 nlmsg_free(msg);
10237                 return;
10238         }
10239
10240         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10241                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10242 }
10243
10244 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
10245                                        struct wireless_dev *wdev, bool aborted)
10246 {
10247         struct sk_buff *msg;
10248
10249         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10250         if (!msg)
10251                 return NULL;
10252
10253         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10254                                   aborted ? NL80211_CMD_SCAN_ABORTED :
10255                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
10256                 nlmsg_free(msg);
10257                 return NULL;
10258         }
10259
10260         return msg;
10261 }
10262
10263 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
10264                               struct sk_buff *msg)
10265 {
10266         if (!msg)
10267                 return;
10268
10269         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10270                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10271 }
10272
10273 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
10274                                      struct net_device *netdev)
10275 {
10276         struct sk_buff *msg;
10277
10278         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10279         if (!msg)
10280                 return;
10281
10282         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
10283                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
10284                 nlmsg_free(msg);
10285                 return;
10286         }
10287
10288         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10289                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10290 }
10291
10292 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
10293                              struct net_device *netdev, u32 cmd)
10294 {
10295         struct sk_buff *msg;
10296
10297         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10298         if (!msg)
10299                 return;
10300
10301         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
10302                 nlmsg_free(msg);
10303                 return;
10304         }
10305
10306         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10307                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10308 }
10309
10310 /*
10311  * This can happen on global regulatory changes or device specific settings
10312  * based on custom world regulatory domains.
10313  */
10314 void nl80211_send_reg_change_event(struct regulatory_request *request)
10315 {
10316         struct sk_buff *msg;
10317         void *hdr;
10318
10319         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10320         if (!msg)
10321                 return;
10322
10323         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
10324         if (!hdr) {
10325                 nlmsg_free(msg);
10326                 return;
10327         }
10328
10329         /* Userspace can always count this one always being set */
10330         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
10331                 goto nla_put_failure;
10332
10333         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
10334                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10335                                NL80211_REGDOM_TYPE_WORLD))
10336                         goto nla_put_failure;
10337         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
10338                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10339                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
10340                         goto nla_put_failure;
10341         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
10342                    request->intersect) {
10343                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10344                                NL80211_REGDOM_TYPE_INTERSECTION))
10345                         goto nla_put_failure;
10346         } else {
10347                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10348                                NL80211_REGDOM_TYPE_COUNTRY) ||
10349                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
10350                                    request->alpha2))
10351                         goto nla_put_failure;
10352         }
10353
10354         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
10355             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
10356                 goto nla_put_failure;
10357
10358         genlmsg_end(msg, hdr);
10359
10360         rcu_read_lock();
10361         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10362                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10363         rcu_read_unlock();
10364
10365         return;
10366
10367 nla_put_failure:
10368         genlmsg_cancel(msg, hdr);
10369         nlmsg_free(msg);
10370 }
10371
10372 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
10373                                     struct net_device *netdev,
10374                                     const u8 *buf, size_t len,
10375                                     enum nl80211_commands cmd, gfp_t gfp)
10376 {
10377         struct sk_buff *msg;
10378         void *hdr;
10379
10380         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10381         if (!msg)
10382                 return;
10383
10384         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10385         if (!hdr) {
10386                 nlmsg_free(msg);
10387                 return;
10388         }
10389
10390         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10391             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10392             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
10393                 goto nla_put_failure;
10394
10395         genlmsg_end(msg, hdr);
10396
10397         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10398                                 NL80211_MCGRP_MLME, gfp);
10399         return;
10400
10401  nla_put_failure:
10402         genlmsg_cancel(msg, hdr);
10403         nlmsg_free(msg);
10404 }
10405
10406 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
10407                           struct net_device *netdev, const u8 *buf,
10408                           size_t len, gfp_t gfp)
10409 {
10410         nl80211_send_mlme_event(rdev, netdev, buf, len,
10411                                 NL80211_CMD_AUTHENTICATE, gfp);
10412 }
10413
10414 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
10415                            struct net_device *netdev, const u8 *buf,
10416                            size_t len, gfp_t gfp)
10417 {
10418         nl80211_send_mlme_event(rdev, netdev, buf, len,
10419                                 NL80211_CMD_ASSOCIATE, gfp);
10420 }
10421
10422 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
10423                          struct net_device *netdev, const u8 *buf,
10424                          size_t len, gfp_t gfp)
10425 {
10426         nl80211_send_mlme_event(rdev, netdev, buf, len,
10427                                 NL80211_CMD_DEAUTHENTICATE, gfp);
10428 }
10429
10430 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
10431                            struct net_device *netdev, const u8 *buf,
10432                            size_t len, gfp_t gfp)
10433 {
10434         nl80211_send_mlme_event(rdev, netdev, buf, len,
10435                                 NL80211_CMD_DISASSOCIATE, gfp);
10436 }
10437
10438 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
10439                                   size_t len)
10440 {
10441         struct wireless_dev *wdev = dev->ieee80211_ptr;
10442         struct wiphy *wiphy = wdev->wiphy;
10443         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10444         const struct ieee80211_mgmt *mgmt = (void *)buf;
10445         u32 cmd;
10446
10447         if (WARN_ON(len < 2))
10448                 return;
10449
10450         if (ieee80211_is_deauth(mgmt->frame_control))
10451                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
10452         else
10453                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
10454
10455         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
10456         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
10457 }
10458 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
10459
10460 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
10461                                       struct net_device *netdev, int cmd,
10462                                       const u8 *addr, gfp_t gfp)
10463 {
10464         struct sk_buff *msg;
10465         void *hdr;
10466
10467         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10468         if (!msg)
10469                 return;
10470
10471         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10472         if (!hdr) {
10473                 nlmsg_free(msg);
10474                 return;
10475         }
10476
10477         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10478             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10479             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
10480             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10481                 goto nla_put_failure;
10482
10483         genlmsg_end(msg, hdr);
10484
10485         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10486                                 NL80211_MCGRP_MLME, gfp);
10487         return;
10488
10489  nla_put_failure:
10490         genlmsg_cancel(msg, hdr);
10491         nlmsg_free(msg);
10492 }
10493
10494 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
10495                                struct net_device *netdev, const u8 *addr,
10496                                gfp_t gfp)
10497 {
10498         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
10499                                   addr, gfp);
10500 }
10501
10502 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
10503                                 struct net_device *netdev, const u8 *addr,
10504                                 gfp_t gfp)
10505 {
10506         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
10507                                   addr, gfp);
10508 }
10509
10510 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
10511                                  struct net_device *netdev, const u8 *bssid,
10512                                  const u8 *req_ie, size_t req_ie_len,
10513                                  const u8 *resp_ie, size_t resp_ie_len,
10514                                  u16 status, gfp_t gfp)
10515 {
10516         struct sk_buff *msg;
10517         void *hdr;
10518
10519         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10520         if (!msg)
10521                 return;
10522
10523         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
10524         if (!hdr) {
10525                 nlmsg_free(msg);
10526                 return;
10527         }
10528
10529         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10530             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10531             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
10532             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
10533             (req_ie &&
10534              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10535             (resp_ie &&
10536              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10537                 goto nla_put_failure;
10538
10539         genlmsg_end(msg, hdr);
10540
10541         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10542                                 NL80211_MCGRP_MLME, gfp);
10543         return;
10544
10545  nla_put_failure:
10546         genlmsg_cancel(msg, hdr);
10547         nlmsg_free(msg);
10548
10549 }
10550
10551 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
10552                          struct net_device *netdev, const u8 *bssid,
10553                          const u8 *req_ie, size_t req_ie_len,
10554                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
10555 {
10556         struct sk_buff *msg;
10557         void *hdr;
10558
10559         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10560         if (!msg)
10561                 return;
10562
10563         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
10564         if (!hdr) {
10565                 nlmsg_free(msg);
10566                 return;
10567         }
10568
10569         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10570             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10571             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
10572             (req_ie &&
10573              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10574             (resp_ie &&
10575              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10576                 goto nla_put_failure;
10577
10578         genlmsg_end(msg, hdr);
10579
10580         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10581                                 NL80211_MCGRP_MLME, gfp);
10582         return;
10583
10584  nla_put_failure:
10585         genlmsg_cancel(msg, hdr);
10586         nlmsg_free(msg);
10587
10588 }
10589
10590 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
10591                                struct net_device *netdev, u16 reason,
10592                                const u8 *ie, size_t ie_len, bool from_ap)
10593 {
10594         struct sk_buff *msg;
10595         void *hdr;
10596
10597         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10598         if (!msg)
10599                 return;
10600
10601         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
10602         if (!hdr) {
10603                 nlmsg_free(msg);
10604                 return;
10605         }
10606
10607         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10608             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10609             (from_ap && reason &&
10610              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
10611             (from_ap &&
10612              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
10613             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
10614                 goto nla_put_failure;
10615
10616         genlmsg_end(msg, hdr);
10617
10618         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10619                                 NL80211_MCGRP_MLME, GFP_KERNEL);
10620         return;
10621
10622  nla_put_failure:
10623         genlmsg_cancel(msg, hdr);
10624         nlmsg_free(msg);
10625
10626 }
10627
10628 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
10629                              struct net_device *netdev, const u8 *bssid,
10630                              gfp_t gfp)
10631 {
10632         struct sk_buff *msg;
10633         void *hdr;
10634
10635         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10636         if (!msg)
10637                 return;
10638
10639         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
10640         if (!hdr) {
10641                 nlmsg_free(msg);
10642                 return;
10643         }
10644
10645         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10646             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10647             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10648                 goto nla_put_failure;
10649
10650         genlmsg_end(msg, hdr);
10651
10652         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10653                                 NL80211_MCGRP_MLME, gfp);
10654         return;
10655
10656  nla_put_failure:
10657         genlmsg_cancel(msg, hdr);
10658         nlmsg_free(msg);
10659 }
10660
10661 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
10662                                         const u8* ie, u8 ie_len, gfp_t gfp)
10663 {
10664         struct wireless_dev *wdev = dev->ieee80211_ptr;
10665         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
10666         struct sk_buff *msg;
10667         void *hdr;
10668
10669         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10670                 return;
10671
10672         trace_cfg80211_notify_new_peer_candidate(dev, addr);
10673
10674         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10675         if (!msg)
10676                 return;
10677
10678         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
10679         if (!hdr) {
10680                 nlmsg_free(msg);
10681                 return;
10682         }
10683
10684         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10685             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10686             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10687             (ie_len && ie &&
10688              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
10689                 goto nla_put_failure;
10690
10691         genlmsg_end(msg, hdr);
10692
10693         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10694                                 NL80211_MCGRP_MLME, gfp);
10695         return;
10696
10697  nla_put_failure:
10698         genlmsg_cancel(msg, hdr);
10699         nlmsg_free(msg);
10700 }
10701 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
10702
10703 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
10704                                  struct net_device *netdev, const u8 *addr,
10705                                  enum nl80211_key_type key_type, int key_id,
10706                                  const u8 *tsc, gfp_t gfp)
10707 {
10708         struct sk_buff *msg;
10709         void *hdr;
10710
10711         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10712         if (!msg)
10713                 return;
10714
10715         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
10716         if (!hdr) {
10717                 nlmsg_free(msg);
10718                 return;
10719         }
10720
10721         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10722             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10723             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
10724             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
10725             (key_id != -1 &&
10726              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
10727             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
10728                 goto nla_put_failure;
10729
10730         genlmsg_end(msg, hdr);
10731
10732         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10733                                 NL80211_MCGRP_MLME, gfp);
10734         return;
10735
10736  nla_put_failure:
10737         genlmsg_cancel(msg, hdr);
10738         nlmsg_free(msg);
10739 }
10740
10741 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
10742                                     struct ieee80211_channel *channel_before,
10743                                     struct ieee80211_channel *channel_after)
10744 {
10745         struct sk_buff *msg;
10746         void *hdr;
10747         struct nlattr *nl_freq;
10748
10749         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
10750         if (!msg)
10751                 return;
10752
10753         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
10754         if (!hdr) {
10755                 nlmsg_free(msg);
10756                 return;
10757         }
10758
10759         /*
10760          * Since we are applying the beacon hint to a wiphy we know its
10761          * wiphy_idx is valid
10762          */
10763         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
10764                 goto nla_put_failure;
10765
10766         /* Before */
10767         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
10768         if (!nl_freq)
10769                 goto nla_put_failure;
10770         if (nl80211_msg_put_channel(msg, channel_before, false))
10771                 goto nla_put_failure;
10772         nla_nest_end(msg, nl_freq);
10773
10774         /* After */
10775         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
10776         if (!nl_freq)
10777                 goto nla_put_failure;
10778         if (nl80211_msg_put_channel(msg, channel_after, false))
10779                 goto nla_put_failure;
10780         nla_nest_end(msg, nl_freq);
10781
10782         genlmsg_end(msg, hdr);
10783
10784         rcu_read_lock();
10785         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10786                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10787         rcu_read_unlock();
10788
10789         return;
10790
10791 nla_put_failure:
10792         genlmsg_cancel(msg, hdr);
10793         nlmsg_free(msg);
10794 }
10795
10796 static void nl80211_send_remain_on_chan_event(
10797         int cmd, struct cfg80211_registered_device *rdev,
10798         struct wireless_dev *wdev, u64 cookie,
10799         struct ieee80211_channel *chan,
10800         unsigned int duration, gfp_t gfp)
10801 {
10802         struct sk_buff *msg;
10803         void *hdr;
10804
10805         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10806         if (!msg)
10807                 return;
10808
10809         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10810         if (!hdr) {
10811                 nlmsg_free(msg);
10812                 return;
10813         }
10814
10815         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10816             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10817                                          wdev->netdev->ifindex)) ||
10818             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10819             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
10820             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10821                         NL80211_CHAN_NO_HT) ||
10822             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
10823                 goto nla_put_failure;
10824
10825         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
10826             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
10827                 goto nla_put_failure;
10828
10829         genlmsg_end(msg, hdr);
10830
10831         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10832                                 NL80211_MCGRP_MLME, gfp);
10833         return;
10834
10835  nla_put_failure:
10836         genlmsg_cancel(msg, hdr);
10837         nlmsg_free(msg);
10838 }
10839
10840 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
10841                                struct ieee80211_channel *chan,
10842                                unsigned int duration, gfp_t gfp)
10843 {
10844         struct wiphy *wiphy = wdev->wiphy;
10845         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10846
10847         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
10848         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
10849                                           rdev, wdev, cookie, chan,
10850                                           duration, gfp);
10851 }
10852 EXPORT_SYMBOL(cfg80211_ready_on_channel);
10853
10854 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
10855                                         struct ieee80211_channel *chan,
10856                                         gfp_t gfp)
10857 {
10858         struct wiphy *wiphy = wdev->wiphy;
10859         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10860
10861         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
10862         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10863                                           rdev, wdev, cookie, chan, 0, gfp);
10864 }
10865 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
10866
10867 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
10868                       struct station_info *sinfo, gfp_t gfp)
10869 {
10870         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10871         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10872         struct sk_buff *msg;
10873
10874         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
10875
10876         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10877         if (!msg)
10878                 return;
10879
10880         if (nl80211_send_station(msg, 0, 0, 0,
10881                                  rdev, dev, mac_addr, sinfo) < 0) {
10882                 nlmsg_free(msg);
10883                 return;
10884         }
10885
10886         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10887                                 NL80211_MCGRP_MLME, gfp);
10888 }
10889 EXPORT_SYMBOL(cfg80211_new_sta);
10890
10891 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
10892 {
10893         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10894         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10895         struct sk_buff *msg;
10896         void *hdr;
10897
10898         trace_cfg80211_del_sta(dev, mac_addr);
10899
10900         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10901         if (!msg)
10902                 return;
10903
10904         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
10905         if (!hdr) {
10906                 nlmsg_free(msg);
10907                 return;
10908         }
10909
10910         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10911             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
10912                 goto nla_put_failure;
10913
10914         genlmsg_end(msg, hdr);
10915
10916         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10917                                 NL80211_MCGRP_MLME, gfp);
10918         return;
10919
10920  nla_put_failure:
10921         genlmsg_cancel(msg, hdr);
10922         nlmsg_free(msg);
10923 }
10924 EXPORT_SYMBOL(cfg80211_del_sta);
10925
10926 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
10927                           enum nl80211_connect_failed_reason reason,
10928                           gfp_t gfp)
10929 {
10930         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10931         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10932         struct sk_buff *msg;
10933         void *hdr;
10934
10935         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10936         if (!msg)
10937                 return;
10938
10939         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
10940         if (!hdr) {
10941                 nlmsg_free(msg);
10942                 return;
10943         }
10944
10945         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10946             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
10947             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
10948                 goto nla_put_failure;
10949
10950         genlmsg_end(msg, hdr);
10951
10952         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10953                                 NL80211_MCGRP_MLME, gfp);
10954         return;
10955
10956  nla_put_failure:
10957         genlmsg_cancel(msg, hdr);
10958         nlmsg_free(msg);
10959 }
10960 EXPORT_SYMBOL(cfg80211_conn_failed);
10961
10962 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
10963                                        const u8 *addr, gfp_t gfp)
10964 {
10965         struct wireless_dev *wdev = dev->ieee80211_ptr;
10966         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
10967         struct sk_buff *msg;
10968         void *hdr;
10969         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
10970
10971         if (!nlportid)
10972                 return false;
10973
10974         msg = nlmsg_new(100, gfp);
10975         if (!msg)
10976                 return true;
10977
10978         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10979         if (!hdr) {
10980                 nlmsg_free(msg);
10981                 return true;
10982         }
10983
10984         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10985             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10986             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10987                 goto nla_put_failure;
10988
10989         genlmsg_end(msg, hdr);
10990         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10991         return true;
10992
10993  nla_put_failure:
10994         genlmsg_cancel(msg, hdr);
10995         nlmsg_free(msg);
10996         return true;
10997 }
10998
10999 bool cfg80211_rx_spurious_frame(struct net_device *dev,
11000                                 const u8 *addr, gfp_t gfp)
11001 {
11002         struct wireless_dev *wdev = dev->ieee80211_ptr;
11003         bool ret;
11004
11005         trace_cfg80211_rx_spurious_frame(dev, addr);
11006
11007         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11008                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
11009                 trace_cfg80211_return_bool(false);
11010                 return false;
11011         }
11012         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
11013                                          addr, gfp);
11014         trace_cfg80211_return_bool(ret);
11015         return ret;
11016 }
11017 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
11018
11019 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
11020                                         const u8 *addr, gfp_t gfp)
11021 {
11022         struct wireless_dev *wdev = dev->ieee80211_ptr;
11023         bool ret;
11024
11025         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
11026
11027         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11028                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11029                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
11030                 trace_cfg80211_return_bool(false);
11031                 return false;
11032         }
11033         ret = __nl80211_unexpected_frame(dev,
11034                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
11035                                          addr, gfp);
11036         trace_cfg80211_return_bool(ret);
11037         return ret;
11038 }
11039 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
11040
11041 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
11042                       struct wireless_dev *wdev, u32 nlportid,
11043                       int freq, int sig_dbm,
11044                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
11045 {
11046         struct net_device *netdev = wdev->netdev;
11047         struct sk_buff *msg;
11048         void *hdr;
11049
11050         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11051         if (!msg)
11052                 return -ENOMEM;
11053
11054         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11055         if (!hdr) {
11056                 nlmsg_free(msg);
11057                 return -ENOMEM;
11058         }
11059
11060         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11061             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11062                                         netdev->ifindex)) ||
11063             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11064             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
11065             (sig_dbm &&
11066              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11067             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11068             (flags &&
11069              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
11070                 goto nla_put_failure;
11071
11072         genlmsg_end(msg, hdr);
11073
11074         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11075
11076  nla_put_failure:
11077         genlmsg_cancel(msg, hdr);
11078         nlmsg_free(msg);
11079         return -ENOBUFS;
11080 }
11081
11082 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
11083                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
11084 {
11085         struct wiphy *wiphy = wdev->wiphy;
11086         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11087         struct net_device *netdev = wdev->netdev;
11088         struct sk_buff *msg;
11089         void *hdr;
11090
11091         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
11092
11093         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11094         if (!msg)
11095                 return;
11096
11097         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
11098         if (!hdr) {
11099                 nlmsg_free(msg);
11100                 return;
11101         }
11102
11103         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11104             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11105                                    netdev->ifindex)) ||
11106             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11107             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11108             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11109             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
11110                 goto nla_put_failure;
11111
11112         genlmsg_end(msg, hdr);
11113
11114         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11115                                 NL80211_MCGRP_MLME, gfp);
11116         return;
11117
11118  nla_put_failure:
11119         genlmsg_cancel(msg, hdr);
11120         nlmsg_free(msg);
11121 }
11122 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
11123
11124 void cfg80211_cqm_rssi_notify(struct net_device *dev,
11125                               enum nl80211_cqm_rssi_threshold_event rssi_event,
11126                               gfp_t gfp)
11127 {
11128         struct wireless_dev *wdev = dev->ieee80211_ptr;
11129         struct wiphy *wiphy = wdev->wiphy;
11130         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11131         struct sk_buff *msg;
11132         struct nlattr *pinfoattr;
11133         void *hdr;
11134
11135         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
11136
11137         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11138         if (!msg)
11139                 return;
11140
11141         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11142         if (!hdr) {
11143                 nlmsg_free(msg);
11144                 return;
11145         }
11146
11147         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11148             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
11149                 goto nla_put_failure;
11150
11151         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11152         if (!pinfoattr)
11153                 goto nla_put_failure;
11154
11155         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
11156                         rssi_event))
11157                 goto nla_put_failure;
11158
11159         nla_nest_end(msg, pinfoattr);
11160
11161         genlmsg_end(msg, hdr);
11162
11163         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11164                                 NL80211_MCGRP_MLME, gfp);
11165         return;
11166
11167  nla_put_failure:
11168         genlmsg_cancel(msg, hdr);
11169         nlmsg_free(msg);
11170 }
11171 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
11172
11173 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
11174                                      struct net_device *netdev, const u8 *bssid,
11175                                      const u8 *replay_ctr, gfp_t gfp)
11176 {
11177         struct sk_buff *msg;
11178         struct nlattr *rekey_attr;
11179         void *hdr;
11180
11181         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11182         if (!msg)
11183                 return;
11184
11185         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
11186         if (!hdr) {
11187                 nlmsg_free(msg);
11188                 return;
11189         }
11190
11191         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11192             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11193             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11194                 goto nla_put_failure;
11195
11196         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
11197         if (!rekey_attr)
11198                 goto nla_put_failure;
11199
11200         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
11201                     NL80211_REPLAY_CTR_LEN, replay_ctr))
11202                 goto nla_put_failure;
11203
11204         nla_nest_end(msg, rekey_attr);
11205
11206         genlmsg_end(msg, hdr);
11207
11208         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11209                                 NL80211_MCGRP_MLME, gfp);
11210         return;
11211
11212  nla_put_failure:
11213         genlmsg_cancel(msg, hdr);
11214         nlmsg_free(msg);
11215 }
11216
11217 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
11218                                const u8 *replay_ctr, gfp_t gfp)
11219 {
11220         struct wireless_dev *wdev = dev->ieee80211_ptr;
11221         struct wiphy *wiphy = wdev->wiphy;
11222         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11223
11224         trace_cfg80211_gtk_rekey_notify(dev, bssid);
11225         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
11226 }
11227 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
11228
11229 static void
11230 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
11231                                struct net_device *netdev, int index,
11232                                const u8 *bssid, bool preauth, gfp_t gfp)
11233 {
11234         struct sk_buff *msg;
11235         struct nlattr *attr;
11236         void *hdr;
11237
11238         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11239         if (!msg)
11240                 return;
11241
11242         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
11243         if (!hdr) {
11244                 nlmsg_free(msg);
11245                 return;
11246         }
11247
11248         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11249             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11250                 goto nla_put_failure;
11251
11252         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
11253         if (!attr)
11254                 goto nla_put_failure;
11255
11256         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
11257             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
11258             (preauth &&
11259              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
11260                 goto nla_put_failure;
11261
11262         nla_nest_end(msg, attr);
11263
11264         genlmsg_end(msg, hdr);
11265
11266         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11267                                 NL80211_MCGRP_MLME, gfp);
11268         return;
11269
11270  nla_put_failure:
11271         genlmsg_cancel(msg, hdr);
11272         nlmsg_free(msg);
11273 }
11274
11275 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
11276                                      const u8 *bssid, bool preauth, gfp_t gfp)
11277 {
11278         struct wireless_dev *wdev = dev->ieee80211_ptr;
11279         struct wiphy *wiphy = wdev->wiphy;
11280         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11281
11282         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
11283         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
11284 }
11285 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
11286
11287 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
11288                                      struct net_device *netdev,
11289                                      struct cfg80211_chan_def *chandef,
11290                                      gfp_t gfp)
11291 {
11292         struct sk_buff *msg;
11293         void *hdr;
11294
11295         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11296         if (!msg)
11297                 return;
11298
11299         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
11300         if (!hdr) {
11301                 nlmsg_free(msg);
11302                 return;
11303         }
11304
11305         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11306                 goto nla_put_failure;
11307
11308         if (nl80211_send_chandef(msg, chandef))
11309                 goto nla_put_failure;
11310
11311         genlmsg_end(msg, hdr);
11312
11313         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11314                                 NL80211_MCGRP_MLME, gfp);
11315         return;
11316
11317  nla_put_failure:
11318         genlmsg_cancel(msg, hdr);
11319         nlmsg_free(msg);
11320 }
11321
11322 void cfg80211_ch_switch_notify(struct net_device *dev,
11323                                struct cfg80211_chan_def *chandef)
11324 {
11325         struct wireless_dev *wdev = dev->ieee80211_ptr;
11326         struct wiphy *wiphy = wdev->wiphy;
11327         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11328
11329         ASSERT_WDEV_LOCK(wdev);
11330
11331         trace_cfg80211_ch_switch_notify(dev, chandef);
11332
11333         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11334                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11335                     wdev->iftype != NL80211_IFTYPE_ADHOC &&
11336                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11337                 return;
11338
11339         wdev->chandef = *chandef;
11340         wdev->preset_chandef = *chandef;
11341         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
11342 }
11343 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
11344
11345 void cfg80211_cqm_txe_notify(struct net_device *dev,
11346                              const u8 *peer, u32 num_packets,
11347                              u32 rate, u32 intvl, gfp_t gfp)
11348 {
11349         struct wireless_dev *wdev = dev->ieee80211_ptr;
11350         struct wiphy *wiphy = wdev->wiphy;
11351         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11352         struct sk_buff *msg;
11353         struct nlattr *pinfoattr;
11354         void *hdr;
11355
11356         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11357         if (!msg)
11358                 return;
11359
11360         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11361         if (!hdr) {
11362                 nlmsg_free(msg);
11363                 return;
11364         }
11365
11366         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11367             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11368             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11369                 goto nla_put_failure;
11370
11371         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11372         if (!pinfoattr)
11373                 goto nla_put_failure;
11374
11375         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
11376                 goto nla_put_failure;
11377
11378         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
11379                 goto nla_put_failure;
11380
11381         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
11382                 goto nla_put_failure;
11383
11384         nla_nest_end(msg, pinfoattr);
11385
11386         genlmsg_end(msg, hdr);
11387
11388         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11389                                 NL80211_MCGRP_MLME, gfp);
11390         return;
11391
11392  nla_put_failure:
11393         genlmsg_cancel(msg, hdr);
11394         nlmsg_free(msg);
11395 }
11396 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
11397
11398 void
11399 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
11400                      const struct cfg80211_chan_def *chandef,
11401                      enum nl80211_radar_event event,
11402                      struct net_device *netdev, gfp_t gfp)
11403 {
11404         struct sk_buff *msg;
11405         void *hdr;
11406
11407         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11408         if (!msg)
11409                 return;
11410
11411         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
11412         if (!hdr) {
11413                 nlmsg_free(msg);
11414                 return;
11415         }
11416
11417         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11418                 goto nla_put_failure;
11419
11420         /* NOP and radar events don't need a netdev parameter */
11421         if (netdev) {
11422                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
11423
11424                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11425                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11426                         goto nla_put_failure;
11427         }
11428
11429         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
11430                 goto nla_put_failure;
11431
11432         if (nl80211_send_chandef(msg, chandef))
11433                 goto nla_put_failure;
11434
11435         genlmsg_end(msg, hdr);
11436
11437         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11438                                 NL80211_MCGRP_MLME, gfp);
11439         return;
11440
11441  nla_put_failure:
11442         genlmsg_cancel(msg, hdr);
11443         nlmsg_free(msg);
11444 }
11445
11446 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
11447                                  const u8 *peer, u32 num_packets, gfp_t gfp)
11448 {
11449         struct wireless_dev *wdev = dev->ieee80211_ptr;
11450         struct wiphy *wiphy = wdev->wiphy;
11451         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11452         struct sk_buff *msg;
11453         struct nlattr *pinfoattr;
11454         void *hdr;
11455
11456         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
11457
11458         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11459         if (!msg)
11460                 return;
11461
11462         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11463         if (!hdr) {
11464                 nlmsg_free(msg);
11465                 return;
11466         }
11467
11468         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11469             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11470             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11471                 goto nla_put_failure;
11472
11473         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11474         if (!pinfoattr)
11475                 goto nla_put_failure;
11476
11477         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
11478                 goto nla_put_failure;
11479
11480         nla_nest_end(msg, pinfoattr);
11481
11482         genlmsg_end(msg, hdr);
11483
11484         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11485                                 NL80211_MCGRP_MLME, gfp);
11486         return;
11487
11488  nla_put_failure:
11489         genlmsg_cancel(msg, hdr);
11490         nlmsg_free(msg);
11491 }
11492 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
11493
11494 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
11495                            u64 cookie, bool acked, gfp_t gfp)
11496 {
11497         struct wireless_dev *wdev = dev->ieee80211_ptr;
11498         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11499         struct sk_buff *msg;
11500         void *hdr;
11501
11502         trace_cfg80211_probe_status(dev, addr, cookie, acked);
11503
11504         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11505
11506         if (!msg)
11507                 return;
11508
11509         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
11510         if (!hdr) {
11511                 nlmsg_free(msg);
11512                 return;
11513         }
11514
11515         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11516             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11517             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11518             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11519             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
11520                 goto nla_put_failure;
11521
11522         genlmsg_end(msg, hdr);
11523
11524         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11525                                 NL80211_MCGRP_MLME, gfp);
11526         return;
11527
11528  nla_put_failure:
11529         genlmsg_cancel(msg, hdr);
11530         nlmsg_free(msg);
11531 }
11532 EXPORT_SYMBOL(cfg80211_probe_status);
11533
11534 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
11535                                  const u8 *frame, size_t len,
11536                                  int freq, int sig_dbm)
11537 {
11538         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11539         struct sk_buff *msg;
11540         void *hdr;
11541         struct cfg80211_beacon_registration *reg;
11542
11543         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
11544
11545         spin_lock_bh(&rdev->beacon_registrations_lock);
11546         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11547                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
11548                 if (!msg) {
11549                         spin_unlock_bh(&rdev->beacon_registrations_lock);
11550                         return;
11551                 }
11552
11553                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11554                 if (!hdr)
11555                         goto nla_put_failure;
11556
11557                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11558                     (freq &&
11559                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
11560                     (sig_dbm &&
11561                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11562                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
11563                         goto nla_put_failure;
11564
11565                 genlmsg_end(msg, hdr);
11566
11567                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
11568         }
11569         spin_unlock_bh(&rdev->beacon_registrations_lock);
11570         return;
11571
11572  nla_put_failure:
11573         spin_unlock_bh(&rdev->beacon_registrations_lock);
11574         if (hdr)
11575                 genlmsg_cancel(msg, hdr);
11576         nlmsg_free(msg);
11577 }
11578 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
11579
11580 #ifdef CONFIG_PM
11581 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
11582                                    struct cfg80211_wowlan_wakeup *wakeup,
11583                                    gfp_t gfp)
11584 {
11585         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11586         struct sk_buff *msg;
11587         void *hdr;
11588         int size = 200;
11589
11590         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
11591
11592         if (wakeup)
11593                 size += wakeup->packet_present_len;
11594
11595         msg = nlmsg_new(size, gfp);
11596         if (!msg)
11597                 return;
11598
11599         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
11600         if (!hdr)
11601                 goto free_msg;
11602
11603         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11604             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11605                 goto free_msg;
11606
11607         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11608                                         wdev->netdev->ifindex))
11609                 goto free_msg;
11610
11611         if (wakeup) {
11612                 struct nlattr *reasons;
11613
11614                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
11615                 if (!reasons)
11616                         goto free_msg;
11617
11618                 if (wakeup->disconnect &&
11619                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
11620                         goto free_msg;
11621                 if (wakeup->magic_pkt &&
11622                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
11623                         goto free_msg;
11624                 if (wakeup->gtk_rekey_failure &&
11625                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
11626                         goto free_msg;
11627                 if (wakeup->eap_identity_req &&
11628                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
11629                         goto free_msg;
11630                 if (wakeup->four_way_handshake &&
11631                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
11632                         goto free_msg;
11633                 if (wakeup->rfkill_release &&
11634                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
11635                         goto free_msg;
11636
11637                 if (wakeup->pattern_idx >= 0 &&
11638                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
11639                                 wakeup->pattern_idx))
11640                         goto free_msg;
11641
11642                 if (wakeup->tcp_match &&
11643                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
11644                         goto free_msg;
11645
11646                 if (wakeup->tcp_connlost &&
11647                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
11648                         goto free_msg;
11649
11650                 if (wakeup->tcp_nomoretokens &&
11651                     nla_put_flag(msg,
11652                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
11653                         goto free_msg;
11654
11655                 if (wakeup->packet) {
11656                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
11657                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
11658
11659                         if (!wakeup->packet_80211) {
11660                                 pkt_attr =
11661                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
11662                                 len_attr =
11663                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
11664                         }
11665
11666                         if (wakeup->packet_len &&
11667                             nla_put_u32(msg, len_attr, wakeup->packet_len))
11668                                 goto free_msg;
11669
11670                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
11671                                     wakeup->packet))
11672                                 goto free_msg;
11673                 }
11674
11675                 nla_nest_end(msg, reasons);
11676         }
11677
11678         genlmsg_end(msg, hdr);
11679
11680         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11681                                 NL80211_MCGRP_MLME, gfp);
11682         return;
11683
11684  free_msg:
11685         nlmsg_free(msg);
11686 }
11687 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
11688 #endif
11689
11690 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
11691                                 enum nl80211_tdls_operation oper,
11692                                 u16 reason_code, gfp_t gfp)
11693 {
11694         struct wireless_dev *wdev = dev->ieee80211_ptr;
11695         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11696         struct sk_buff *msg;
11697         void *hdr;
11698
11699         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
11700                                          reason_code);
11701
11702         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11703         if (!msg)
11704                 return;
11705
11706         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
11707         if (!hdr) {
11708                 nlmsg_free(msg);
11709                 return;
11710         }
11711
11712         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11713             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11714             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
11715             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
11716             (reason_code > 0 &&
11717              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
11718                 goto nla_put_failure;
11719
11720         genlmsg_end(msg, hdr);
11721
11722         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11723                                 NL80211_MCGRP_MLME, gfp);
11724         return;
11725
11726  nla_put_failure:
11727         genlmsg_cancel(msg, hdr);
11728         nlmsg_free(msg);
11729 }
11730 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
11731
11732 static int nl80211_netlink_notify(struct notifier_block * nb,
11733                                   unsigned long state,
11734                                   void *_notify)
11735 {
11736         struct netlink_notify *notify = _notify;
11737         struct cfg80211_registered_device *rdev;
11738         struct wireless_dev *wdev;
11739         struct cfg80211_beacon_registration *reg, *tmp;
11740
11741         if (state != NETLINK_URELEASE)
11742                 return NOTIFY_DONE;
11743
11744         rcu_read_lock();
11745
11746         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
11747                 bool schedule_destroy_work = false;
11748
11749                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
11750                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
11751
11752                         if (wdev->owner_nlportid == notify->portid)
11753                                 schedule_destroy_work = true;
11754                 }
11755
11756                 spin_lock_bh(&rdev->beacon_registrations_lock);
11757                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
11758                                          list) {
11759                         if (reg->nlportid == notify->portid) {
11760                                 list_del(&reg->list);
11761                                 kfree(reg);
11762                                 break;
11763                         }
11764                 }
11765                 spin_unlock_bh(&rdev->beacon_registrations_lock);
11766
11767                 if (schedule_destroy_work) {
11768                         struct cfg80211_iface_destroy *destroy;
11769
11770                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
11771                         if (destroy) {
11772                                 destroy->nlportid = notify->portid;
11773                                 spin_lock(&rdev->destroy_list_lock);
11774                                 list_add(&destroy->list, &rdev->destroy_list);
11775                                 spin_unlock(&rdev->destroy_list_lock);
11776                                 schedule_work(&rdev->destroy_work);
11777                         }
11778                 }
11779         }
11780
11781         rcu_read_unlock();
11782
11783         return NOTIFY_OK;
11784 }
11785
11786 static struct notifier_block nl80211_netlink_notifier = {
11787         .notifier_call = nl80211_netlink_notify,
11788 };
11789
11790 void cfg80211_ft_event(struct net_device *netdev,
11791                        struct cfg80211_ft_event_params *ft_event)
11792 {
11793         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
11794         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11795         struct sk_buff *msg;
11796         void *hdr;
11797
11798         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
11799
11800         if (!ft_event->target_ap)
11801                 return;
11802
11803         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11804         if (!msg)
11805                 return;
11806
11807         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
11808         if (!hdr)
11809                 goto out;
11810
11811         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11812             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11813             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
11814                 goto out;
11815
11816         if (ft_event->ies &&
11817             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
11818                 goto out;
11819         if (ft_event->ric_ies &&
11820             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
11821                     ft_event->ric_ies))
11822                 goto out;
11823
11824         genlmsg_end(msg, hdr);
11825
11826         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11827                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11828         return;
11829  out:
11830         nlmsg_free(msg);
11831 }
11832 EXPORT_SYMBOL(cfg80211_ft_event);
11833
11834 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
11835 {
11836         struct cfg80211_registered_device *rdev;
11837         struct sk_buff *msg;
11838         void *hdr;
11839         u32 nlportid;
11840
11841         rdev = wiphy_to_rdev(wdev->wiphy);
11842         if (!rdev->crit_proto_nlportid)
11843                 return;
11844
11845         nlportid = rdev->crit_proto_nlportid;
11846         rdev->crit_proto_nlportid = 0;
11847
11848         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11849         if (!msg)
11850                 return;
11851
11852         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
11853         if (!hdr)
11854                 goto nla_put_failure;
11855
11856         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11857             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11858                 goto nla_put_failure;
11859
11860         genlmsg_end(msg, hdr);
11861
11862         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11863         return;
11864
11865  nla_put_failure:
11866         if (hdr)
11867                 genlmsg_cancel(msg, hdr);
11868         nlmsg_free(msg);
11869
11870 }
11871 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
11872
11873 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
11874 {
11875         struct wiphy *wiphy = wdev->wiphy;
11876         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11877         struct sk_buff *msg;
11878         void *hdr;
11879
11880         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11881         if (!msg)
11882                 return;
11883
11884         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
11885         if (!hdr)
11886                 goto out;
11887
11888         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11889             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
11890             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11891                 goto out;
11892
11893         genlmsg_end(msg, hdr);
11894
11895         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
11896                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11897         return;
11898  out:
11899         nlmsg_free(msg);
11900 }
11901
11902 /* initialisation/exit functions */
11903
11904 int nl80211_init(void)
11905 {
11906         int err;
11907
11908         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
11909                                                    nl80211_mcgrps);
11910         if (err)
11911                 return err;
11912
11913         err = netlink_register_notifier(&nl80211_netlink_notifier);
11914         if (err)
11915                 goto err_out;
11916
11917         return 0;
11918  err_out:
11919         genl_unregister_family(&nl80211_fam);
11920         return err;
11921 }
11922
11923 void nl80211_exit(void)
11924 {
11925         netlink_unregister_notifier(&nl80211_netlink_notifier);
11926         genl_unregister_family(&nl80211_fam);
11927 }