net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* multicast groups */
  51 enum nl80211_multicast_groups {
  52         NL80211_MCGRP_CONFIG,
  53         NL80211_MCGRP_SCAN,
  54         NL80211_MCGRP_REGULATORY,
  55         NL80211_MCGRP_MLME,
  56         NL80211_MCGRP_VENDOR,
  57         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  58 };
  59
  60 static const struct genl_multicast_group nl80211_mcgrps[] = {
  61         [NL80211_MCGRP_CONFIG] = { .name = "config", },
  62         [NL80211_MCGRP_SCAN] = { .name = "scan", },
  63         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
  64         [NL80211_MCGRP_MLME] = { .name = "mlme", },
  65         [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
  66 #ifdef CONFIG_NL80211_TESTMODE
  67         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
  68 #endif
  69 };
  70
  71 /* returns ERR_PTR values */
  72 static struct wireless_dev *
  73 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  74 {
  75         struct cfg80211_registered_device *rdev;
  76         struct wireless_dev *result = NULL;
  77         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  78         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  79         u64 wdev_id;
  80         int wiphy_idx = -1;
  81         int ifidx = -1;
  82
  83         ASSERT_RTNL();
  84
  85         if (!have_ifidx && !have_wdev_id)
  86                 return ERR_PTR(-EINVAL);
  87
  88         if (have_ifidx)
  89                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  90         if (have_wdev_id) {
  91                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  92                 wiphy_idx = wdev_id >> 32;
  93         }
  94
  95         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  96                 struct wireless_dev *wdev;
  97
  98                 if (wiphy_net(&rdev->wiphy) != netns)
  99                         continue;
 100
 101                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 102                         continue;
 103
 104                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 105                         if (have_ifidx && wdev->netdev &&
 106                             wdev->netdev->ifindex == ifidx) {
 107                                 result = wdev;
 108                                 break;
 109                         }
 110                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 111                                 result = wdev;
 112                                 break;
 113                         }
 114                 }
 115
 116                 if (result)
 117                         break;
 118         }
 119
 120         if (result)
 121                 return result;
 122         return ERR_PTR(-ENODEV);
 123 }
 124
 125 static struct cfg80211_registered_device *
 126 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 127 {
 128         struct cfg80211_registered_device *rdev = NULL, *tmp;
 129         struct net_device *netdev;
 130
 131         ASSERT_RTNL();
 132
 133         if (!attrs[NL80211_ATTR_WIPHY] &&
 134             !attrs[NL80211_ATTR_IFINDEX] &&
 135             !attrs[NL80211_ATTR_WDEV])
 136                 return ERR_PTR(-EINVAL);
 137
 138         if (attrs[NL80211_ATTR_WIPHY])
 139                 rdev = cfg80211_rdev_by_wiphy_idx(
 140                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 141
 142         if (attrs[NL80211_ATTR_WDEV]) {
 143                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 144                 struct wireless_dev *wdev;
 145                 bool found = false;
 146
 147                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 148                 if (tmp) {
 149                         /* make sure wdev exists */
 150                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 151                                 if (wdev->identifier != (u32)wdev_id)
 152                                         continue;
 153                                 found = true;
 154                                 break;
 155                         }
 156
 157                         if (!found)
 158                                 tmp = NULL;
 159
 160                         if (rdev && tmp != rdev)
 161                                 return ERR_PTR(-EINVAL);
 162                         rdev = tmp;
 163                 }
 164         }
 165
 166         if (attrs[NL80211_ATTR_IFINDEX]) {
 167                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 168                 netdev = __dev_get_by_index(netns, ifindex);
 169                 if (netdev) {
 170                         if (netdev->ieee80211_ptr)
 171                                 tmp = wiphy_to_rdev(
 172                                         netdev->ieee80211_ptr->wiphy);
 173                         else
 174                                 tmp = NULL;
 175
 176                         /* not wireless device -- return error */
 177                         if (!tmp)
 178                                 return ERR_PTR(-EINVAL);
 179
 180                         /* mismatch -- return error */
 181                         if (rdev && tmp != rdev)
 182                                 return ERR_PTR(-EINVAL);
 183
 184                         rdev = tmp;
 185                 }
 186         }
 187
 188         if (!rdev)
 189                 return ERR_PTR(-ENODEV);
 190
 191         if (netns != wiphy_net(&rdev->wiphy))
 192                 return ERR_PTR(-ENODEV);
 193
 194         return rdev;
 195 }
 196
 197 /*
 198  * This function returns a pointer to the driver
 199  * that the genl_info item that is passed refers to.
 200  *
 201  * The result of this can be a PTR_ERR and hence must
 202  * be checked with IS_ERR() for errors.
 203  */
 204 static struct cfg80211_registered_device *
 205 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 206 {
 207         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 208 }
 209
 210 /* policy for the attributes */
 211 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 212         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 213         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 214                                       .len = 20-1 },
 215         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 216
 217         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 218         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 219         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 220         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 222
 223         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 224         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 225         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 226         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 228
 229         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 231         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 232
 233         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 234         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 235
 236         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 237         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 238                                     .len = WLAN_MAX_KEY_LEN },
 239         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 240         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 241         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 242         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 243         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 244
 245         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 246         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 247         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 248                                        .len = IEEE80211_MAX_DATA_LEN },
 249         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 252         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 253         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 255                                                .len = NL80211_MAX_SUPP_RATES },
 256         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 257         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 258         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 259         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 260                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 261         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 262
 263         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 264         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 265
 266         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 267         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 268         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 270                                            .len = NL80211_MAX_SUPP_RATES },
 271         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 272
 273         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 274         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 275
 276         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 277
 278         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 280                               .len = IEEE80211_MAX_DATA_LEN },
 281         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 282         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 283
 284         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 285                                 .len = IEEE80211_MAX_SSID_LEN },
 286         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 287         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 288         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 289         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 290         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 291         [NL80211_ATTR_STA_FLAGS2] = {
 292                 .len = sizeof(struct nl80211_sta_flag_update),
 293         },
 294         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 295         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 296         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 298         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 300         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 301         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 302         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 303                                  .len = WLAN_PMKID_LEN },
 304         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 305         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 306         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 307         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 308                                  .len = IEEE80211_MAX_DATA_LEN },
 309         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 310         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 311         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 312         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 313         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 314         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 315         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 316         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 317         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 318         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 319         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 320         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 321         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 322         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 323         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 324         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 325         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 327         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 328         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 329                                          .len = IEEE80211_MAX_DATA_LEN },
 330         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 333         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 336         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 337         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 339         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 342                                       .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 344         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 346                 .len = NL80211_HT_CAPABILITY_LEN
 347         },
 348         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 349         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 350         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 351         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 352         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 353         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 354         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 355         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 356         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 357         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 358         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 359         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 360         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 361         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 362         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 363         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 364         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 365                 .len = NL80211_VHT_CAPABILITY_LEN,
 366         },
 367         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 368         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 369                                   .len = IEEE80211_MAX_DATA_LEN },
 370         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 371         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 372         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 373         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 374         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
 375         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
 376         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 377         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 378         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 379         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 380         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 381         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 382         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 383         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 384                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 385         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 386         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 387         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 388         [NL80211_ATTR_IFACE_SOCKET_OWNER] = { .type = NLA_FLAG },
 389 };
 390
 391 /* policy for the key attributes */
 392 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 393         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 394         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 395         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 396         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 397         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 398         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 399         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 400         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 401 };
 402
 403 /* policy for the key default flags */
 404 static const struct nla_policy
 405 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 406         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 407         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 408 };
 409
 410 /* policy for WoWLAN attributes */
 411 static const struct nla_policy
 412 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 413         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 414         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 415         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 416         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 417         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 418         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 419         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 420         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 421         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 422 };
 423
 424 static const struct nla_policy
 425 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 426         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 427         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 428         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 429         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 430         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 431         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 432         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 433                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 434         },
 435         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 436                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 437         },
 438         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 439         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 440         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 441 };
 442
 443 /* policy for coalesce rule attributes */
 444 static const struct nla_policy
 445 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 446         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 447         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 448         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 449 };
 450
 451 /* policy for GTK rekey offload attributes */
 452 static const struct nla_policy
 453 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 454         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 455         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 456         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 457 };
 458
 459 static const struct nla_policy
 460 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 461         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 462                                                  .len = IEEE80211_MAX_SSID_LEN },
 463         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 464 };
 465
 466 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 467                                      struct netlink_callback *cb,
 468                                      struct cfg80211_registered_device **rdev,
 469                                      struct wireless_dev **wdev)
 470 {
 471         int err;
 472
 473         rtnl_lock();
 474
 475         if (!cb->args[0]) {
 476                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 477                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 478                                   nl80211_policy);
 479                 if (err)
 480                         goto out_unlock;
 481
 482                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 483                                                    nl80211_fam.attrbuf);
 484                 if (IS_ERR(*wdev)) {
 485                         err = PTR_ERR(*wdev);
 486                         goto out_unlock;
 487                 }
 488                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 489                 /* 0 is the first index - add 1 to parse only once */
 490                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 491                 cb->args[1] = (*wdev)->identifier;
 492         } else {
 493                 /* subtract the 1 again here */
 494                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 495                 struct wireless_dev *tmp;
 496
 497                 if (!wiphy) {
 498                         err = -ENODEV;
 499                         goto out_unlock;
 500                 }
 501                 *rdev = wiphy_to_rdev(wiphy);
 502                 *wdev = NULL;
 503
 504                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 505                         if (tmp->identifier == cb->args[1]) {
 506                                 *wdev = tmp;
 507                                 break;
 508                         }
 509                 }
 510
 511                 if (!*wdev) {
 512                         err = -ENODEV;
 513                         goto out_unlock;
 514                 }
 515         }
 516
 517         return 0;
 518  out_unlock:
 519         rtnl_unlock();
 520         return err;
 521 }
 522
 523 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 524 {
 525         rtnl_unlock();
 526 }
 527
 528 /* IE validation */
 529 static bool is_valid_ie_attr(const struct nlattr *attr)
 530 {
 531         const u8 *pos;
 532         int len;
 533
 534         if (!attr)
 535                 return true;
 536
 537         pos = nla_data(attr);
 538         len = nla_len(attr);
 539
 540         while (len) {
 541                 u8 elemlen;
 542
 543                 if (len < 2)
 544                         return false;
 545                 len -= 2;
 546
 547                 elemlen = pos[1];
 548                 if (elemlen > len)
 549                         return false;
 550
 551                 len -= elemlen;
 552                 pos += 2 + elemlen;
 553         }
 554
 555         return true;
 556 }
 557
 558 /* message building helper */
 559 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 560                                    int flags, u8 cmd)
 561 {
 562         /* since there is no private header just add the generic one */
 563         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 564 }
 565
 566 static int nl80211_msg_put_channel(struct sk_buff *msg,
 567                                    struct ieee80211_channel *chan,
 568                                    bool large)
 569 {
 570         /* Some channels must be completely excluded from the
 571          * list to protect old user-space tools from breaking
 572          */
 573         if (!large && chan->flags &
 574             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 575                 return 0;
 576
 577         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 578                         chan->center_freq))
 579                 goto nla_put_failure;
 580
 581         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 582             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 583                 goto nla_put_failure;
 584         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 585                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 586                         goto nla_put_failure;
 587                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 588                         goto nla_put_failure;
 589         }
 590         if (chan->flags & IEEE80211_CHAN_RADAR) {
 591                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 592                         goto nla_put_failure;
 593                 if (large) {
 594                         u32 time;
 595
 596                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 597
 598                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 599                                         chan->dfs_state))
 600                                 goto nla_put_failure;
 601                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 602                                         time))
 603                                 goto nla_put_failure;
 604                         if (nla_put_u32(msg,
 605                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 606                                         chan->dfs_cac_ms))
 607                                 goto nla_put_failure;
 608                 }
 609         }
 610
 611         if (large) {
 612                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 613                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 614                         goto nla_put_failure;
 615                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 616                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 617                         goto nla_put_failure;
 618                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 619                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 620                         goto nla_put_failure;
 621                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 622                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 623                         goto nla_put_failure;
 624                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 625                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 626                         goto nla_put_failure;
 627                 if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
 628                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
 629                         goto nla_put_failure;
 630                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 631                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 632                         goto nla_put_failure;
 633                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 634                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 635                         goto nla_put_failure;
 636         }
 637
 638         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 639                         DBM_TO_MBM(chan->max_power)))
 640                 goto nla_put_failure;
 641
 642         return 0;
 643
 644  nla_put_failure:
 645         return -ENOBUFS;
 646 }
 647
 648 /* netlink command implementations */
 649
 650 struct key_parse {
 651         struct key_params p;
 652         int idx;
 653         int type;
 654         bool def, defmgmt;
 655         bool def_uni, def_multi;
 656 };
 657
 658 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 659 {
 660         struct nlattr *tb[NL80211_KEY_MAX + 1];
 661         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 662                                    nl80211_key_policy);
 663         if (err)
 664                 return err;
 665
 666         k->def = !!tb[NL80211_KEY_DEFAULT];
 667         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 668
 669         if (k->def) {
 670                 k->def_uni = true;
 671                 k->def_multi = true;
 672         }
 673         if (k->defmgmt)
 674                 k->def_multi = true;
 675
 676         if (tb[NL80211_KEY_IDX])
 677                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 678
 679         if (tb[NL80211_KEY_DATA]) {
 680                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 681                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 682         }
 683
 684         if (tb[NL80211_KEY_SEQ]) {
 685                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 686                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 687         }
 688
 689         if (tb[NL80211_KEY_CIPHER])
 690                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 691
 692         if (tb[NL80211_KEY_TYPE]) {
 693                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 694                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 695                         return -EINVAL;
 696         }
 697
 698         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 699                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 700                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 701                                        tb[NL80211_KEY_DEFAULT_TYPES],
 702                                        nl80211_key_default_policy);
 703                 if (err)
 704                         return err;
 705
 706                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 707                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 708         }
 709
 710         return 0;
 711 }
 712
 713 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 714 {
 715         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 716                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 717                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 718         }
 719
 720         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 721                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 722                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 723         }
 724
 725         if (info->attrs[NL80211_ATTR_KEY_IDX])
 726                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 727
 728         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 729                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 730
 731         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 732         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 733
 734         if (k->def) {
 735                 k->def_uni = true;
 736                 k->def_multi = true;
 737         }
 738         if (k->defmgmt)
 739                 k->def_multi = true;
 740
 741         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 742                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 743                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 744                         return -EINVAL;
 745         }
 746
 747         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 748                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 749                 int err = nla_parse_nested(
 750                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 751                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 752                                 nl80211_key_default_policy);
 753                 if (err)
 754                         return err;
 755
 756                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 757                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 758         }
 759
 760         return 0;
 761 }
 762
 763 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 764 {
 765         int err;
 766
 767         memset(k, 0, sizeof(*k));
 768         k->idx = -1;
 769         k->type = -1;
 770
 771         if (info->attrs[NL80211_ATTR_KEY])
 772                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 773         else
 774                 err = nl80211_parse_key_old(info, k);
 775
 776         if (err)
 777                 return err;
 778
 779         if (k->def && k->defmgmt)
 780                 return -EINVAL;
 781
 782         if (k->defmgmt) {
 783                 if (k->def_uni || !k->def_multi)
 784                         return -EINVAL;
 785         }
 786
 787         if (k->idx != -1) {
 788                 if (k->defmgmt) {
 789                         if (k->idx < 4 || k->idx > 5)
 790                                 return -EINVAL;
 791                 } else if (k->def) {
 792                         if (k->idx < 0 || k->idx > 3)
 793                                 return -EINVAL;
 794                 } else {
 795                         if (k->idx < 0 || k->idx > 5)
 796                                 return -EINVAL;
 797                 }
 798         }
 799
 800         return 0;
 801 }
 802
 803 static struct cfg80211_cached_keys *
 804 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 805                        struct nlattr *keys, bool *no_ht)
 806 {
 807         struct key_parse parse;
 808         struct nlattr *key;
 809         struct cfg80211_cached_keys *result;
 810         int rem, err, def = 0;
 811
 812         result = kzalloc(sizeof(*result), GFP_KERNEL);
 813         if (!result)
 814                 return ERR_PTR(-ENOMEM);
 815
 816         result->def = -1;
 817         result->defmgmt = -1;
 818
 819         nla_for_each_nested(key, keys, rem) {
 820                 memset(&parse, 0, sizeof(parse));
 821                 parse.idx = -1;
 822
 823                 err = nl80211_parse_key_new(key, &parse);
 824                 if (err)
 825                         goto error;
 826                 err = -EINVAL;
 827                 if (!parse.p.key)
 828                         goto error;
 829                 if (parse.idx < 0 || parse.idx > 4)
 830                         goto error;
 831                 if (parse.def) {
 832                         if (def)
 833                                 goto error;
 834                         def = 1;
 835                         result->def = parse.idx;
 836                         if (!parse.def_uni || !parse.def_multi)
 837                                 goto error;
 838                 } else if (parse.defmgmt)
 839                         goto error;
 840                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 841                                                      parse.idx, false, NULL);
 842                 if (err)
 843                         goto error;
 844                 result->params[parse.idx].cipher = parse.p.cipher;
 845                 result->params[parse.idx].key_len = parse.p.key_len;
 846                 result->params[parse.idx].key = result->data[parse.idx];
 847                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 848
 849                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 850                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 851                         if (no_ht)
 852                                 *no_ht = true;
 853                 }
 854         }
 855
 856         return result;
 857  error:
 858         kfree(result);
 859         return ERR_PTR(err);
 860 }
 861
 862 static int nl80211_key_allowed(struct wireless_dev *wdev)
 863 {
 864         ASSERT_WDEV_LOCK(wdev);
 865
 866         switch (wdev->iftype) {
 867         case NL80211_IFTYPE_AP:
 868         case NL80211_IFTYPE_AP_VLAN:
 869         case NL80211_IFTYPE_P2P_GO:
 870         case NL80211_IFTYPE_MESH_POINT:
 871                 break;
 872         case NL80211_IFTYPE_ADHOC:
 873         case NL80211_IFTYPE_STATION:
 874         case NL80211_IFTYPE_P2P_CLIENT:
 875                 if (!wdev->current_bss)
 876                         return -ENOLINK;
 877                 break;
 878         default:
 879                 return -EINVAL;
 880         }
 881
 882         return 0;
 883 }
 884
 885 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 886                                                         struct nlattr *tb)
 887 {
 888         struct ieee80211_channel *chan;
 889
 890         if (tb == NULL)
 891                 return NULL;
 892         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 893         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 894                 return NULL;
 895         return chan;
 896 }
 897
 898 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 899 {
 900         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 901         int i;
 902
 903         if (!nl_modes)
 904                 goto nla_put_failure;
 905
 906         i = 0;
 907         while (ifmodes) {
 908                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 909                         goto nla_put_failure;
 910                 ifmodes >>= 1;
 911                 i++;
 912         }
 913
 914         nla_nest_end(msg, nl_modes);
 915         return 0;
 916
 917 nla_put_failure:
 918         return -ENOBUFS;
 919 }
 920
 921 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 922                                           struct sk_buff *msg,
 923                                           bool large)
 924 {
 925         struct nlattr *nl_combis;
 926         int i, j;
 927
 928         nl_combis = nla_nest_start(msg,
 929                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 930         if (!nl_combis)
 931                 goto nla_put_failure;
 932
 933         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 934                 const struct ieee80211_iface_combination *c;
 935                 struct nlattr *nl_combi, *nl_limits;
 936
 937                 c = &wiphy->iface_combinations[i];
 938
 939                 nl_combi = nla_nest_start(msg, i + 1);
 940                 if (!nl_combi)
 941                         goto nla_put_failure;
 942
 943                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 944                 if (!nl_limits)
 945                         goto nla_put_failure;
 946
 947                 for (j = 0; j < c->n_limits; j++) {
 948                         struct nlattr *nl_limit;
 949
 950                         nl_limit = nla_nest_start(msg, j + 1);
 951                         if (!nl_limit)
 952                                 goto nla_put_failure;
 953                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 954                                         c->limits[j].max))
 955                                 goto nla_put_failure;
 956                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 957                                                 c->limits[j].types))
 958                                 goto nla_put_failure;
 959                         nla_nest_end(msg, nl_limit);
 960                 }
 961
 962                 nla_nest_end(msg, nl_limits);
 963
 964                 if (c->beacon_int_infra_match &&
 965                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 966                         goto nla_put_failure;
 967                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 968                                 c->num_different_channels) ||
 969                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 970                                 c->max_interfaces))
 971                         goto nla_put_failure;
 972                 if (large &&
 973                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 974                                 c->radar_detect_widths) ||
 975                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
 976                                 c->radar_detect_regions)))
 977                         goto nla_put_failure;
 978
 979                 nla_nest_end(msg, nl_combi);
 980         }
 981
 982         nla_nest_end(msg, nl_combis);
 983
 984         return 0;
 985 nla_put_failure:
 986         return -ENOBUFS;
 987 }
 988
 989 #ifdef CONFIG_PM
 990 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 991                                         struct sk_buff *msg)
 992 {
 993         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 994         struct nlattr *nl_tcp;
 995
 996         if (!tcp)
 997                 return 0;
 998
 999         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1000         if (!nl_tcp)
1001                 return -ENOBUFS;
1002
1003         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1004                         tcp->data_payload_max))
1005                 return -ENOBUFS;
1006
1007         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1008                         tcp->data_payload_max))
1009                 return -ENOBUFS;
1010
1011         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1012                 return -ENOBUFS;
1013
1014         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1015                                 sizeof(*tcp->tok), tcp->tok))
1016                 return -ENOBUFS;
1017
1018         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1019                         tcp->data_interval_max))
1020                 return -ENOBUFS;
1021
1022         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1023                         tcp->wake_payload_max))
1024                 return -ENOBUFS;
1025
1026         nla_nest_end(msg, nl_tcp);
1027         return 0;
1028 }
1029
1030 static int nl80211_send_wowlan(struct sk_buff *msg,
1031                                struct cfg80211_registered_device *rdev,
1032                                bool large)
1033 {
1034         struct nlattr *nl_wowlan;
1035
1036         if (!rdev->wiphy.wowlan)
1037                 return 0;
1038
1039         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1040         if (!nl_wowlan)
1041                 return -ENOBUFS;
1042
1043         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1044              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1045             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1046              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1047             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1048              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1049             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1050              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1051             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1052              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1053             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1054              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1055             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1056              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1057             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1058              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1059                 return -ENOBUFS;
1060
1061         if (rdev->wiphy.wowlan->n_patterns) {
1062                 struct nl80211_pattern_support pat = {
1063                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1064                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1065                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1066                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1067                 };
1068
1069                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1070                             sizeof(pat), &pat))
1071                         return -ENOBUFS;
1072         }
1073
1074         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1075                 return -ENOBUFS;
1076
1077         nla_nest_end(msg, nl_wowlan);
1078
1079         return 0;
1080 }
1081 #endif
1082
1083 static int nl80211_send_coalesce(struct sk_buff *msg,
1084                                  struct cfg80211_registered_device *rdev)
1085 {
1086         struct nl80211_coalesce_rule_support rule;
1087
1088         if (!rdev->wiphy.coalesce)
1089                 return 0;
1090
1091         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1092         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1093         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1094         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1095         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1096         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1097
1098         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1099                 return -ENOBUFS;
1100
1101         return 0;
1102 }
1103
1104 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1105                                       struct ieee80211_supported_band *sband)
1106 {
1107         struct nlattr *nl_rates, *nl_rate;
1108         struct ieee80211_rate *rate;
1109         int i;
1110
1111         /* add HT info */
1112         if (sband->ht_cap.ht_supported &&
1113             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1114                      sizeof(sband->ht_cap.mcs),
1115                      &sband->ht_cap.mcs) ||
1116              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1117                          sband->ht_cap.cap) ||
1118              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1119                         sband->ht_cap.ampdu_factor) ||
1120              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1121                         sband->ht_cap.ampdu_density)))
1122                 return -ENOBUFS;
1123
1124         /* add VHT info */
1125         if (sband->vht_cap.vht_supported &&
1126             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1127                      sizeof(sband->vht_cap.vht_mcs),
1128                      &sband->vht_cap.vht_mcs) ||
1129              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1130                          sband->vht_cap.cap)))
1131                 return -ENOBUFS;
1132
1133         /* add bitrates */
1134         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1135         if (!nl_rates)
1136                 return -ENOBUFS;
1137
1138         for (i = 0; i < sband->n_bitrates; i++) {
1139                 nl_rate = nla_nest_start(msg, i);
1140                 if (!nl_rate)
1141                         return -ENOBUFS;
1142
1143                 rate = &sband->bitrates[i];
1144                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1145                                 rate->bitrate))
1146                         return -ENOBUFS;
1147                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1148                     nla_put_flag(msg,
1149                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1150                         return -ENOBUFS;
1151
1152                 nla_nest_end(msg, nl_rate);
1153         }
1154
1155         nla_nest_end(msg, nl_rates);
1156
1157         return 0;
1158 }
1159
1160 static int
1161 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1162                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1163 {
1164         u16 stypes;
1165         struct nlattr *nl_ftypes, *nl_ifs;
1166         enum nl80211_iftype ift;
1167         int i;
1168
1169         if (!mgmt_stypes)
1170                 return 0;
1171
1172         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1173         if (!nl_ifs)
1174                 return -ENOBUFS;
1175
1176         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1177                 nl_ftypes = nla_nest_start(msg, ift);
1178                 if (!nl_ftypes)
1179                         return -ENOBUFS;
1180                 i = 0;
1181                 stypes = mgmt_stypes[ift].tx;
1182                 while (stypes) {
1183                         if ((stypes & 1) &&
1184                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1185                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1186                                 return -ENOBUFS;
1187                         stypes >>= 1;
1188                         i++;
1189                 }
1190                 nla_nest_end(msg, nl_ftypes);
1191         }
1192
1193         nla_nest_end(msg, nl_ifs);
1194
1195         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1196         if (!nl_ifs)
1197                 return -ENOBUFS;
1198
1199         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1200                 nl_ftypes = nla_nest_start(msg, ift);
1201                 if (!nl_ftypes)
1202                         return -ENOBUFS;
1203                 i = 0;
1204                 stypes = mgmt_stypes[ift].rx;
1205                 while (stypes) {
1206                         if ((stypes & 1) &&
1207                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1208                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1209                                 return -ENOBUFS;
1210                         stypes >>= 1;
1211                         i++;
1212                 }
1213                 nla_nest_end(msg, nl_ftypes);
1214         }
1215         nla_nest_end(msg, nl_ifs);
1216
1217         return 0;
1218 }
1219
1220 struct nl80211_dump_wiphy_state {
1221         s64 filter_wiphy;
1222         long start;
1223         long split_start, band_start, chan_start;
1224         bool split;
1225 };
1226
1227 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1228                               struct sk_buff *msg, u32 portid, u32 seq,
1229                               int flags, struct nl80211_dump_wiphy_state *state)
1230 {
1231         void *hdr;
1232         struct nlattr *nl_bands, *nl_band;
1233         struct nlattr *nl_freqs, *nl_freq;
1234         struct nlattr *nl_cmds;
1235         enum ieee80211_band band;
1236         struct ieee80211_channel *chan;
1237         int i;
1238         const struct ieee80211_txrx_stypes *mgmt_stypes =
1239                                 rdev->wiphy.mgmt_stypes;
1240         u32 features;
1241
1242         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1243         if (!hdr)
1244                 return -ENOBUFS;
1245
1246         if (WARN_ON(!state))
1247                 return -EINVAL;
1248
1249         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1250             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1251                            wiphy_name(&rdev->wiphy)) ||
1252             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1253                         cfg80211_rdev_list_generation))
1254                 goto nla_put_failure;
1255
1256         switch (state->split_start) {
1257         case 0:
1258                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1259                                rdev->wiphy.retry_short) ||
1260                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1261                                rdev->wiphy.retry_long) ||
1262                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1263                                 rdev->wiphy.frag_threshold) ||
1264                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1265                                 rdev->wiphy.rts_threshold) ||
1266                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1267                                rdev->wiphy.coverage_class) ||
1268                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1269                                rdev->wiphy.max_scan_ssids) ||
1270                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1271                                rdev->wiphy.max_sched_scan_ssids) ||
1272                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1273                                 rdev->wiphy.max_scan_ie_len) ||
1274                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1275                                 rdev->wiphy.max_sched_scan_ie_len) ||
1276                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1277                                rdev->wiphy.max_match_sets))
1278                         goto nla_put_failure;
1279
1280                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1281                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1282                         goto nla_put_failure;
1283                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1284                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1285                         goto nla_put_failure;
1286                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1287                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1288                         goto nla_put_failure;
1289                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1290                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1291                         goto nla_put_failure;
1292                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1293                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1294                         goto nla_put_failure;
1295                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1296                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1297                         goto nla_put_failure;
1298                 state->split_start++;
1299                 if (state->split)
1300                         break;
1301         case 1:
1302                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1303                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1304                             rdev->wiphy.cipher_suites))
1305                         goto nla_put_failure;
1306
1307                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1308                                rdev->wiphy.max_num_pmkids))
1309                         goto nla_put_failure;
1310
1311                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1312                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1313                         goto nla_put_failure;
1314
1315                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1316                                 rdev->wiphy.available_antennas_tx) ||
1317                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1318                                 rdev->wiphy.available_antennas_rx))
1319                         goto nla_put_failure;
1320
1321                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1322                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1323                                 rdev->wiphy.probe_resp_offload))
1324                         goto nla_put_failure;
1325
1326                 if ((rdev->wiphy.available_antennas_tx ||
1327                      rdev->wiphy.available_antennas_rx) &&
1328                     rdev->ops->get_antenna) {
1329                         u32 tx_ant = 0, rx_ant = 0;
1330                         int res;
1331                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1332                         if (!res) {
1333                                 if (nla_put_u32(msg,
1334                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1335                                                 tx_ant) ||
1336                                     nla_put_u32(msg,
1337                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1338                                                 rx_ant))
1339                                         goto nla_put_failure;
1340                         }
1341                 }
1342
1343                 state->split_start++;
1344                 if (state->split)
1345                         break;
1346         case 2:
1347                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1348                                         rdev->wiphy.interface_modes))
1349                                 goto nla_put_failure;
1350                 state->split_start++;
1351                 if (state->split)
1352                         break;
1353         case 3:
1354                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1355                 if (!nl_bands)
1356                         goto nla_put_failure;
1357
1358                 for (band = state->band_start;
1359                      band < IEEE80211_NUM_BANDS; band++) {
1360                         struct ieee80211_supported_band *sband;
1361
1362                         sband = rdev->wiphy.bands[band];
1363
1364                         if (!sband)
1365                                 continue;
1366
1367                         nl_band = nla_nest_start(msg, band);
1368                         if (!nl_band)
1369                                 goto nla_put_failure;
1370
1371                         switch (state->chan_start) {
1372                         case 0:
1373                                 if (nl80211_send_band_rateinfo(msg, sband))
1374                                         goto nla_put_failure;
1375                                 state->chan_start++;
1376                                 if (state->split)
1377                                         break;
1378                         default:
1379                                 /* add frequencies */
1380                                 nl_freqs = nla_nest_start(
1381                                         msg, NL80211_BAND_ATTR_FREQS);
1382                                 if (!nl_freqs)
1383                                         goto nla_put_failure;
1384
1385                                 for (i = state->chan_start - 1;
1386                                      i < sband->n_channels;
1387                                      i++) {
1388                                         nl_freq = nla_nest_start(msg, i);
1389                                         if (!nl_freq)
1390                                                 goto nla_put_failure;
1391
1392                                         chan = &sband->channels[i];
1393
1394                                         if (nl80211_msg_put_channel(
1395                                                         msg, chan,
1396                                                         state->split))
1397                                                 goto nla_put_failure;
1398
1399                                         nla_nest_end(msg, nl_freq);
1400                                         if (state->split)
1401                                                 break;
1402                                 }
1403                                 if (i < sband->n_channels)
1404                                         state->chan_start = i + 2;
1405                                 else
1406                                         state->chan_start = 0;
1407                                 nla_nest_end(msg, nl_freqs);
1408                         }
1409
1410                         nla_nest_end(msg, nl_band);
1411
1412                         if (state->split) {
1413                                 /* start again here */
1414                                 if (state->chan_start)
1415                                         band--;
1416                                 break;
1417                         }
1418                 }
1419                 nla_nest_end(msg, nl_bands);
1420
1421                 if (band < IEEE80211_NUM_BANDS)
1422                         state->band_start = band + 1;
1423                 else
1424                         state->band_start = 0;
1425
1426                 /* if bands & channels are done, continue outside */
1427                 if (state->band_start == 0 && state->chan_start == 0)
1428                         state->split_start++;
1429                 if (state->split)
1430                         break;
1431         case 4:
1432                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1433                 if (!nl_cmds)
1434                         goto nla_put_failure;
1435
1436                 i = 0;
1437 #define CMD(op, n)                                                      \
1438                  do {                                                   \
1439                         if (rdev->ops->op) {                            \
1440                                 i++;                                    \
1441                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1442                                         goto nla_put_failure;           \
1443                         }                                               \
1444                 } while (0)
1445
1446                 CMD(add_virtual_intf, NEW_INTERFACE);
1447                 CMD(change_virtual_intf, SET_INTERFACE);
1448                 CMD(add_key, NEW_KEY);
1449                 CMD(start_ap, START_AP);
1450                 CMD(add_station, NEW_STATION);
1451                 CMD(add_mpath, NEW_MPATH);
1452                 CMD(update_mesh_config, SET_MESH_CONFIG);
1453                 CMD(change_bss, SET_BSS);
1454                 CMD(auth, AUTHENTICATE);
1455                 CMD(assoc, ASSOCIATE);
1456                 CMD(deauth, DEAUTHENTICATE);
1457                 CMD(disassoc, DISASSOCIATE);
1458                 CMD(join_ibss, JOIN_IBSS);
1459                 CMD(join_mesh, JOIN_MESH);
1460                 CMD(set_pmksa, SET_PMKSA);
1461                 CMD(del_pmksa, DEL_PMKSA);
1462                 CMD(flush_pmksa, FLUSH_PMKSA);
1463                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1464                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1465                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1466                 CMD(mgmt_tx, FRAME);
1467                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1468                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1469                         i++;
1470                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1471                                 goto nla_put_failure;
1472                 }
1473                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1474                     rdev->ops->join_mesh) {
1475                         i++;
1476                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1477                                 goto nla_put_failure;
1478                 }
1479                 CMD(set_wds_peer, SET_WDS_PEER);
1480                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1481                         CMD(tdls_mgmt, TDLS_MGMT);
1482                         CMD(tdls_oper, TDLS_OPER);
1483                 }
1484                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1485                         CMD(sched_scan_start, START_SCHED_SCAN);
1486                 CMD(probe_client, PROBE_CLIENT);
1487                 CMD(set_noack_map, SET_NOACK_MAP);
1488                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1489                         i++;
1490                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1491                                 goto nla_put_failure;
1492                 }
1493                 CMD(start_p2p_device, START_P2P_DEVICE);
1494                 CMD(set_mcast_rate, SET_MCAST_RATE);
1495                 if (state->split) {
1496                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1497                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1498                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1499                                 CMD(channel_switch, CHANNEL_SWITCH);
1500                 }
1501                 CMD(set_qos_map, SET_QOS_MAP);
1502
1503 #ifdef CONFIG_NL80211_TESTMODE
1504                 CMD(testmode_cmd, TESTMODE);
1505 #endif
1506
1507 #undef CMD
1508
1509                 if (rdev->ops->connect || rdev->ops->auth) {
1510                         i++;
1511                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1512                                 goto nla_put_failure;
1513                 }
1514
1515                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1516                         i++;
1517                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1518                                 goto nla_put_failure;
1519                 }
1520
1521                 nla_nest_end(msg, nl_cmds);
1522                 state->split_start++;
1523                 if (state->split)
1524                         break;
1525         case 5:
1526                 if (rdev->ops->remain_on_channel &&
1527                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1528                     nla_put_u32(msg,
1529                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1530                                 rdev->wiphy.max_remain_on_channel_duration))
1531                         goto nla_put_failure;
1532
1533                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1534                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1535                         goto nla_put_failure;
1536
1537                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1538                         goto nla_put_failure;
1539                 state->split_start++;
1540                 if (state->split)
1541                         break;
1542         case 6:
1543 #ifdef CONFIG_PM
1544                 if (nl80211_send_wowlan(msg, rdev, state->split))
1545                         goto nla_put_failure;
1546                 state->split_start++;
1547                 if (state->split)
1548                         break;
1549 #else
1550                 state->split_start++;
1551 #endif
1552         case 7:
1553                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1554                                         rdev->wiphy.software_iftypes))
1555                         goto nla_put_failure;
1556
1557                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1558                                                    state->split))
1559                         goto nla_put_failure;
1560
1561                 state->split_start++;
1562                 if (state->split)
1563                         break;
1564         case 8:
1565                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1566                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1567                                 rdev->wiphy.ap_sme_capa))
1568                         goto nla_put_failure;
1569
1570                 features = rdev->wiphy.features;
1571                 /*
1572                  * We can only add the per-channel limit information if the
1573                  * dump is split, otherwise it makes it too big. Therefore
1574                  * only advertise it in that case.
1575                  */
1576                 if (state->split)
1577                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1578                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1579                         goto nla_put_failure;
1580
1581                 if (rdev->wiphy.ht_capa_mod_mask &&
1582                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1583                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1584                             rdev->wiphy.ht_capa_mod_mask))
1585                         goto nla_put_failure;
1586
1587                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1588                     rdev->wiphy.max_acl_mac_addrs &&
1589                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1590                                 rdev->wiphy.max_acl_mac_addrs))
1591                         goto nla_put_failure;
1592
1593                 /*
1594                  * Any information below this point is only available to
1595                  * applications that can deal with it being split. This
1596                  * helps ensure that newly added capabilities don't break
1597                  * older tools by overrunning their buffers.
1598                  *
1599                  * We still increment split_start so that in the split
1600                  * case we'll continue with more data in the next round,
1601                  * but break unconditionally so unsplit data stops here.
1602                  */
1603                 state->split_start++;
1604                 break;
1605         case 9:
1606                 if (rdev->wiphy.extended_capabilities &&
1607                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1608                              rdev->wiphy.extended_capabilities_len,
1609                              rdev->wiphy.extended_capabilities) ||
1610                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1611                              rdev->wiphy.extended_capabilities_len,
1612                              rdev->wiphy.extended_capabilities_mask)))
1613                         goto nla_put_failure;
1614
1615                 if (rdev->wiphy.vht_capa_mod_mask &&
1616                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1617                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1618                             rdev->wiphy.vht_capa_mod_mask))
1619                         goto nla_put_failure;
1620
1621                 state->split_start++;
1622                 break;
1623         case 10:
1624                 if (nl80211_send_coalesce(msg, rdev))
1625                         goto nla_put_failure;
1626
1627                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1628                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1629                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1630                         goto nla_put_failure;
1631
1632                 if (rdev->wiphy.max_ap_assoc_sta &&
1633                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1634                                 rdev->wiphy.max_ap_assoc_sta))
1635                         goto nla_put_failure;
1636
1637                 state->split_start++;
1638                 break;
1639         case 11:
1640                 if (rdev->wiphy.n_vendor_commands) {
1641                         const struct nl80211_vendor_cmd_info *info;
1642                         struct nlattr *nested;
1643
1644                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1645                         if (!nested)
1646                                 goto nla_put_failure;
1647
1648                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1649                                 info = &rdev->wiphy.vendor_commands[i].info;
1650                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1651                                         goto nla_put_failure;
1652                         }
1653                         nla_nest_end(msg, nested);
1654                 }
1655
1656                 if (rdev->wiphy.n_vendor_events) {
1657                         const struct nl80211_vendor_cmd_info *info;
1658                         struct nlattr *nested;
1659
1660                         nested = nla_nest_start(msg,
1661                                                 NL80211_ATTR_VENDOR_EVENTS);
1662                         if (!nested)
1663                                 goto nla_put_failure;
1664
1665                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1666                                 info = &rdev->wiphy.vendor_events[i];
1667                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1668                                         goto nla_put_failure;
1669                         }
1670                         nla_nest_end(msg, nested);
1671                 }
1672
1673                 /* done */
1674                 state->split_start = 0;
1675                 break;
1676         }
1677         return genlmsg_end(msg, hdr);
1678
1679  nla_put_failure:
1680         genlmsg_cancel(msg, hdr);
1681         return -EMSGSIZE;
1682 }
1683
1684 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1685                                     struct netlink_callback *cb,
1686                                     struct nl80211_dump_wiphy_state *state)
1687 {
1688         struct nlattr **tb = nl80211_fam.attrbuf;
1689         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1690                               tb, nl80211_fam.maxattr, nl80211_policy);
1691         /* ignore parse errors for backward compatibility */
1692         if (ret)
1693                 return 0;
1694
1695         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1696         if (tb[NL80211_ATTR_WIPHY])
1697                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1698         if (tb[NL80211_ATTR_WDEV])
1699                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1700         if (tb[NL80211_ATTR_IFINDEX]) {
1701                 struct net_device *netdev;
1702                 struct cfg80211_registered_device *rdev;
1703                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1704
1705                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1706                 if (!netdev)
1707                         return -ENODEV;
1708                 if (netdev->ieee80211_ptr) {
1709                         rdev = wiphy_to_rdev(
1710                                 netdev->ieee80211_ptr->wiphy);
1711                         state->filter_wiphy = rdev->wiphy_idx;
1712                 }
1713         }
1714
1715         return 0;
1716 }
1717
1718 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1719 {
1720         int idx = 0, ret;
1721         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1722         struct cfg80211_registered_device *rdev;
1723
1724         rtnl_lock();
1725         if (!state) {
1726                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1727                 if (!state) {
1728                         rtnl_unlock();
1729                         return -ENOMEM;
1730                 }
1731                 state->filter_wiphy = -1;
1732                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1733                 if (ret) {
1734                         kfree(state);
1735                         rtnl_unlock();
1736                         return ret;
1737                 }
1738                 cb->args[0] = (long)state;
1739         }
1740
1741         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1742                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1743                         continue;
1744                 if (++idx <= state->start)
1745                         continue;
1746                 if (state->filter_wiphy != -1 &&
1747                     state->filter_wiphy != rdev->wiphy_idx)
1748                         continue;
1749                 /* attempt to fit multiple wiphy data chunks into the skb */
1750                 do {
1751                         ret = nl80211_send_wiphy(rdev, skb,
1752                                                  NETLINK_CB(cb->skb).portid,
1753                                                  cb->nlh->nlmsg_seq,
1754                                                  NLM_F_MULTI, state);
1755                         if (ret < 0) {
1756                                 /*
1757                                  * If sending the wiphy data didn't fit (ENOBUFS
1758                                  * or EMSGSIZE returned), this SKB is still
1759                                  * empty (so it's not too big because another
1760                                  * wiphy dataset is already in the skb) and
1761                                  * we've not tried to adjust the dump allocation
1762                                  * yet ... then adjust the alloc size to be
1763                                  * bigger, and return 1 but with the empty skb.
1764                                  * This results in an empty message being RX'ed
1765                                  * in userspace, but that is ignored.
1766                                  *
1767                                  * We can then retry with the larger buffer.
1768                                  */
1769                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1770                                     !skb->len && !state->split &&
1771                                     cb->min_dump_alloc < 4096) {
1772                                         cb->min_dump_alloc = 4096;
1773                                         state->split_start = 0;
1774                                         rtnl_unlock();
1775                                         return 1;
1776                                 }
1777                                 idx--;
1778                                 break;
1779                         }
1780                 } while (state->split_start > 0);
1781                 break;
1782         }
1783         rtnl_unlock();
1784
1785         state->start = idx;
1786
1787         return skb->len;
1788 }
1789
1790 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1791 {
1792         kfree((void *)cb->args[0]);
1793         return 0;
1794 }
1795
1796 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1797 {
1798         struct sk_buff *msg;
1799         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1800         struct nl80211_dump_wiphy_state state = {};
1801
1802         msg = nlmsg_new(4096, GFP_KERNEL);
1803         if (!msg)
1804                 return -ENOMEM;
1805
1806         if (nl80211_send_wiphy(rdev, msg, info->snd_portid, info->snd_seq, 0,
1807                                &state) < 0) {
1808                 nlmsg_free(msg);
1809                 return -ENOBUFS;
1810         }
1811
1812         return genlmsg_reply(msg, info);
1813 }
1814
1815 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1816         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1817         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1818         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1819         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1820         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1821 };
1822
1823 static int parse_txq_params(struct nlattr *tb[],
1824                             struct ieee80211_txq_params *txq_params)
1825 {
1826         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1827             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1828             !tb[NL80211_TXQ_ATTR_AIFS])
1829                 return -EINVAL;
1830
1831         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1832         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1833         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1834         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1835         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1836
1837         if (txq_params->ac >= NL80211_NUM_ACS)
1838                 return -EINVAL;
1839
1840         return 0;
1841 }
1842
1843 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1844 {
1845         /*
1846          * You can only set the channel explicitly for WDS interfaces,
1847          * all others have their channel managed via their respective
1848          * "establish a connection" command (connect, join, ...)
1849          *
1850          * For AP/GO and mesh mode, the channel can be set with the
1851          * channel userspace API, but is only stored and passed to the
1852          * low-level driver when the AP starts or the mesh is joined.
1853          * This is for backward compatibility, userspace can also give
1854          * the channel in the start-ap or join-mesh commands instead.
1855          *
1856          * Monitors are special as they are normally slaved to
1857          * whatever else is going on, so they have their own special
1858          * operation to set the monitor channel if possible.
1859          */
1860         return !wdev ||
1861                 wdev->iftype == NL80211_IFTYPE_AP ||
1862                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1863                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1864                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1865 }
1866
1867 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1868                                  struct genl_info *info,
1869                                  struct cfg80211_chan_def *chandef)
1870 {
1871         u32 control_freq;
1872
1873         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1874                 return -EINVAL;
1875
1876         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1877
1878         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1879         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1880         chandef->center_freq1 = control_freq;
1881         chandef->center_freq2 = 0;
1882
1883         /* Primary channel not allowed */
1884         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1885                 return -EINVAL;
1886
1887         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1888                 enum nl80211_channel_type chantype;
1889
1890                 chantype = nla_get_u32(
1891                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1892
1893                 switch (chantype) {
1894                 case NL80211_CHAN_NO_HT:
1895                 case NL80211_CHAN_HT20:
1896                 case NL80211_CHAN_HT40PLUS:
1897                 case NL80211_CHAN_HT40MINUS:
1898                         cfg80211_chandef_create(chandef, chandef->chan,
1899                                                 chantype);
1900                         break;
1901                 default:
1902                         return -EINVAL;
1903                 }
1904         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1905                 chandef->width =
1906                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1907                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1908                         chandef->center_freq1 =
1909                                 nla_get_u32(
1910                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1911                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1912                         chandef->center_freq2 =
1913                                 nla_get_u32(
1914                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1915         }
1916
1917         if (!cfg80211_chandef_valid(chandef))
1918                 return -EINVAL;
1919
1920         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1921                                      IEEE80211_CHAN_DISABLED))
1922                 return -EINVAL;
1923
1924         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1925              chandef->width == NL80211_CHAN_WIDTH_10) &&
1926             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1927                 return -EINVAL;
1928
1929         return 0;
1930 }
1931
1932 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1933                                  struct net_device *dev,
1934                                  struct genl_info *info)
1935 {
1936         struct cfg80211_chan_def chandef;
1937         int result;
1938         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1939         struct wireless_dev *wdev = NULL;
1940
1941         if (dev)
1942                 wdev = dev->ieee80211_ptr;
1943         if (!nl80211_can_set_dev_channel(wdev))
1944                 return -EOPNOTSUPP;
1945         if (wdev)
1946                 iftype = wdev->iftype;
1947
1948         result = nl80211_parse_chandef(rdev, info, &chandef);
1949         if (result)
1950                 return result;
1951
1952         switch (iftype) {
1953         case NL80211_IFTYPE_AP:
1954         case NL80211_IFTYPE_P2P_GO:
1955                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
1956                         result = -EINVAL;
1957                         break;
1958                 }
1959                 if (wdev->beacon_interval) {
1960                         if (!dev || !rdev->ops->set_ap_chanwidth ||
1961                             !(rdev->wiphy.features &
1962                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
1963                                 result = -EBUSY;
1964                                 break;
1965                         }
1966
1967                         /* Only allow dynamic channel width changes */
1968                         if (chandef.chan != wdev->preset_chandef.chan) {
1969                                 result = -EBUSY;
1970                                 break;
1971                         }
1972                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
1973                         if (result)
1974                                 break;
1975                 }
1976                 wdev->preset_chandef = chandef;
1977                 result = 0;
1978                 break;
1979         case NL80211_IFTYPE_MESH_POINT:
1980                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1981                 break;
1982         case NL80211_IFTYPE_MONITOR:
1983                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1984                 break;
1985         default:
1986                 result = -EINVAL;
1987         }
1988
1989         return result;
1990 }
1991
1992 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1993 {
1994         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1995         struct net_device *netdev = info->user_ptr[1];
1996
1997         return __nl80211_set_channel(rdev, netdev, info);
1998 }
1999
2000 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2001 {
2002         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2003         struct net_device *dev = info->user_ptr[1];
2004         struct wireless_dev *wdev = dev->ieee80211_ptr;
2005         const u8 *bssid;
2006
2007         if (!info->attrs[NL80211_ATTR_MAC])
2008                 return -EINVAL;
2009
2010         if (netif_running(dev))
2011                 return -EBUSY;
2012
2013         if (!rdev->ops->set_wds_peer)
2014                 return -EOPNOTSUPP;
2015
2016         if (wdev->iftype != NL80211_IFTYPE_WDS)
2017                 return -EOPNOTSUPP;
2018
2019         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2020         return rdev_set_wds_peer(rdev, dev, bssid);
2021 }
2022
2023
2024 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2025 {
2026         struct cfg80211_registered_device *rdev;
2027         struct net_device *netdev = NULL;
2028         struct wireless_dev *wdev;
2029         int result = 0, rem_txq_params = 0;
2030         struct nlattr *nl_txq_params;
2031         u32 changed;
2032         u8 retry_short = 0, retry_long = 0;
2033         u32 frag_threshold = 0, rts_threshold = 0;
2034         u8 coverage_class = 0;
2035
2036         ASSERT_RTNL();
2037
2038         /*
2039          * Try to find the wiphy and netdev. Normally this
2040          * function shouldn't need the netdev, but this is
2041          * done for backward compatibility -- previously
2042          * setting the channel was done per wiphy, but now
2043          * it is per netdev. Previous userland like hostapd
2044          * also passed a netdev to set_wiphy, so that it is
2045          * possible to let that go to the right netdev!
2046          */
2047
2048         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2049                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2050
2051                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2052                 if (netdev && netdev->ieee80211_ptr)
2053                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2054                 else
2055                         netdev = NULL;
2056         }
2057
2058         if (!netdev) {
2059                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2060                                                   info->attrs);
2061                 if (IS_ERR(rdev))
2062                         return PTR_ERR(rdev);
2063                 wdev = NULL;
2064                 netdev = NULL;
2065                 result = 0;
2066         } else
2067                 wdev = netdev->ieee80211_ptr;
2068
2069         /*
2070          * end workaround code, by now the rdev is available
2071          * and locked, and wdev may or may not be NULL.
2072          */
2073
2074         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2075                 result = cfg80211_dev_rename(
2076                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2077
2078         if (result)
2079                 return result;
2080
2081         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2082                 struct ieee80211_txq_params txq_params;
2083                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2084
2085                 if (!rdev->ops->set_txq_params)
2086                         return -EOPNOTSUPP;
2087
2088                 if (!netdev)
2089                         return -EINVAL;
2090
2091                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2092                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2093                         return -EINVAL;
2094
2095                 if (!netif_running(netdev))
2096                         return -ENETDOWN;
2097
2098                 nla_for_each_nested(nl_txq_params,
2099                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2100                                     rem_txq_params) {
2101                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2102                                            nla_data(nl_txq_params),
2103                                            nla_len(nl_txq_params),
2104                                            txq_params_policy);
2105                         if (result)
2106                                 return result;
2107                         result = parse_txq_params(tb, &txq_params);
2108                         if (result)
2109                                 return result;
2110
2111                         result = rdev_set_txq_params(rdev, netdev,
2112                                                      &txq_params);
2113                         if (result)
2114                                 return result;
2115                 }
2116         }
2117
2118         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2119                 result = __nl80211_set_channel(
2120                         rdev,
2121                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2122                         info);
2123                 if (result)
2124                         return result;
2125         }
2126
2127         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2128                 struct wireless_dev *txp_wdev = wdev;
2129                 enum nl80211_tx_power_setting type;
2130                 int idx, mbm = 0;
2131
2132                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2133                         txp_wdev = NULL;
2134
2135                 if (!rdev->ops->set_tx_power)
2136                         return -EOPNOTSUPP;
2137
2138                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2139                 type = nla_get_u32(info->attrs[idx]);
2140
2141                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2142                     (type != NL80211_TX_POWER_AUTOMATIC))
2143                         return -EINVAL;
2144
2145                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2146                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2147                         mbm = nla_get_u32(info->attrs[idx]);
2148                 }
2149
2150                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2151                 if (result)
2152                         return result;
2153         }
2154
2155         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2156             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2157                 u32 tx_ant, rx_ant;
2158                 if ((!rdev->wiphy.available_antennas_tx &&
2159                      !rdev->wiphy.available_antennas_rx) ||
2160                     !rdev->ops->set_antenna)
2161                         return -EOPNOTSUPP;
2162
2163                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2164                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2165
2166                 /* reject antenna configurations which don't match the
2167                  * available antenna masks, except for the "all" mask */
2168                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2169                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2170                         return -EINVAL;
2171
2172                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2173                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2174
2175                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2176                 if (result)
2177                         return result;
2178         }
2179
2180         changed = 0;
2181
2182         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2183                 retry_short = nla_get_u8(
2184                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2185                 if (retry_short == 0)
2186                         return -EINVAL;
2187
2188                 changed |= WIPHY_PARAM_RETRY_SHORT;
2189         }
2190
2191         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2192                 retry_long = nla_get_u8(
2193                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2194                 if (retry_long == 0)
2195                         return -EINVAL;
2196
2197                 changed |= WIPHY_PARAM_RETRY_LONG;
2198         }
2199
2200         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2201                 frag_threshold = nla_get_u32(
2202                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2203                 if (frag_threshold < 256)
2204                         return -EINVAL;
2205
2206                 if (frag_threshold != (u32) -1) {
2207                         /*
2208                          * Fragments (apart from the last one) are required to
2209                          * have even length. Make the fragmentation code
2210                          * simpler by stripping LSB should someone try to use
2211                          * odd threshold value.
2212                          */
2213                         frag_threshold &= ~0x1;
2214                 }
2215                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2216         }
2217
2218         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2219                 rts_threshold = nla_get_u32(
2220                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2221                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2222         }
2223
2224         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2225                 coverage_class = nla_get_u8(
2226                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2227                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2228         }
2229
2230         if (changed) {
2231                 u8 old_retry_short, old_retry_long;
2232                 u32 old_frag_threshold, old_rts_threshold;
2233                 u8 old_coverage_class;
2234
2235                 if (!rdev->ops->set_wiphy_params)
2236                         return -EOPNOTSUPP;
2237
2238                 old_retry_short = rdev->wiphy.retry_short;
2239                 old_retry_long = rdev->wiphy.retry_long;
2240                 old_frag_threshold = rdev->wiphy.frag_threshold;
2241                 old_rts_threshold = rdev->wiphy.rts_threshold;
2242                 old_coverage_class = rdev->wiphy.coverage_class;
2243
2244                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2245                         rdev->wiphy.retry_short = retry_short;
2246                 if (changed & WIPHY_PARAM_RETRY_LONG)
2247                         rdev->wiphy.retry_long = retry_long;
2248                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2249                         rdev->wiphy.frag_threshold = frag_threshold;
2250                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2251                         rdev->wiphy.rts_threshold = rts_threshold;
2252                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2253                         rdev->wiphy.coverage_class = coverage_class;
2254
2255                 result = rdev_set_wiphy_params(rdev, changed);
2256                 if (result) {
2257                         rdev->wiphy.retry_short = old_retry_short;
2258                         rdev->wiphy.retry_long = old_retry_long;
2259                         rdev->wiphy.frag_threshold = old_frag_threshold;
2260                         rdev->wiphy.rts_threshold = old_rts_threshold;
2261                         rdev->wiphy.coverage_class = old_coverage_class;
2262                 }
2263         }
2264         return 0;
2265 }
2266
2267 static inline u64 wdev_id(struct wireless_dev *wdev)
2268 {
2269         return (u64)wdev->identifier |
2270                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2271 }
2272
2273 static int nl80211_send_chandef(struct sk_buff *msg,
2274                                 const struct cfg80211_chan_def *chandef)
2275 {
2276         WARN_ON(!cfg80211_chandef_valid(chandef));
2277
2278         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2279                         chandef->chan->center_freq))
2280                 return -ENOBUFS;
2281         switch (chandef->width) {
2282         case NL80211_CHAN_WIDTH_20_NOHT:
2283         case NL80211_CHAN_WIDTH_20:
2284         case NL80211_CHAN_WIDTH_40:
2285                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2286                                 cfg80211_get_chandef_type(chandef)))
2287                         return -ENOBUFS;
2288                 break;
2289         default:
2290                 break;
2291         }
2292         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2293                 return -ENOBUFS;
2294         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2295                 return -ENOBUFS;
2296         if (chandef->center_freq2 &&
2297             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2298                 return -ENOBUFS;
2299         return 0;
2300 }
2301
2302 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2303                               struct cfg80211_registered_device *rdev,
2304                               struct wireless_dev *wdev)
2305 {
2306         struct net_device *dev = wdev->netdev;
2307         void *hdr;
2308
2309         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2310         if (!hdr)
2311                 return -1;
2312
2313         if (dev &&
2314             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2315              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2316                 goto nla_put_failure;
2317
2318         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2319             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2320             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2321             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2322             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2323                         rdev->devlist_generation ^
2324                         (cfg80211_rdev_list_generation << 2)))
2325                 goto nla_put_failure;
2326
2327         if (rdev->ops->get_channel) {
2328                 int ret;
2329                 struct cfg80211_chan_def chandef;
2330
2331                 ret = rdev_get_channel(rdev, wdev, &chandef);
2332                 if (ret == 0) {
2333                         if (nl80211_send_chandef(msg, &chandef))
2334                                 goto nla_put_failure;
2335                 }
2336         }
2337
2338         if (wdev->ssid_len) {
2339                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2340                         goto nla_put_failure;
2341         }
2342
2343         return genlmsg_end(msg, hdr);
2344
2345  nla_put_failure:
2346         genlmsg_cancel(msg, hdr);
2347         return -EMSGSIZE;
2348 }
2349
2350 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2351 {
2352         int wp_idx = 0;
2353         int if_idx = 0;
2354         int wp_start = cb->args[0];
2355         int if_start = cb->args[1];
2356         struct cfg80211_registered_device *rdev;
2357         struct wireless_dev *wdev;
2358
2359         rtnl_lock();
2360         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2361                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2362                         continue;
2363                 if (wp_idx < wp_start) {
2364                         wp_idx++;
2365                         continue;
2366                 }
2367                 if_idx = 0;
2368
2369                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2370                         if (if_idx < if_start) {
2371                                 if_idx++;
2372                                 continue;
2373                         }
2374                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2375                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2376                                                rdev, wdev) < 0) {
2377                                 goto out;
2378                         }
2379                         if_idx++;
2380                 }
2381
2382                 wp_idx++;
2383         }
2384  out:
2385         rtnl_unlock();
2386
2387         cb->args[0] = wp_idx;
2388         cb->args[1] = if_idx;
2389
2390         return skb->len;
2391 }
2392
2393 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2394 {
2395         struct sk_buff *msg;
2396         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2397         struct wireless_dev *wdev = info->user_ptr[1];
2398
2399         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2400         if (!msg)
2401                 return -ENOMEM;
2402
2403         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2404                                rdev, wdev) < 0) {
2405                 nlmsg_free(msg);
2406                 return -ENOBUFS;
2407         }
2408
2409         return genlmsg_reply(msg, info);
2410 }
2411
2412 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2413         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2414         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2415         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2416         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2417         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2418         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2419 };
2420
2421 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2422 {
2423         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2424         int flag;
2425
2426         *mntrflags = 0;
2427
2428         if (!nla)
2429                 return -EINVAL;
2430
2431         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2432                              nla, mntr_flags_policy))
2433                 return -EINVAL;
2434
2435         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2436                 if (flags[flag])
2437                         *mntrflags |= (1<<flag);
2438
2439         return 0;
2440 }
2441
2442 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2443                                struct net_device *netdev, u8 use_4addr,
2444                                enum nl80211_iftype iftype)
2445 {
2446         if (!use_4addr) {
2447                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2448                         return -EBUSY;
2449                 return 0;
2450         }
2451
2452         switch (iftype) {
2453         case NL80211_IFTYPE_AP_VLAN:
2454                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2455                         return 0;
2456                 break;
2457         case NL80211_IFTYPE_STATION:
2458                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2459                         return 0;
2460                 break;
2461         default:
2462                 break;
2463         }
2464
2465         return -EOPNOTSUPP;
2466 }
2467
2468 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2469 {
2470         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2471         struct vif_params params;
2472         int err;
2473         enum nl80211_iftype otype, ntype;
2474         struct net_device *dev = info->user_ptr[1];
2475         u32 _flags, *flags = NULL;
2476         bool change = false;
2477
2478         memset(&params, 0, sizeof(params));
2479
2480         otype = ntype = dev->ieee80211_ptr->iftype;
2481
2482         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2483                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2484                 if (otype != ntype)
2485                         change = true;
2486                 if (ntype > NL80211_IFTYPE_MAX)
2487                         return -EINVAL;
2488         }
2489
2490         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2491                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2492
2493                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2494                         return -EINVAL;
2495                 if (netif_running(dev))
2496                         return -EBUSY;
2497
2498                 wdev_lock(wdev);
2499                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2500                              IEEE80211_MAX_MESH_ID_LEN);
2501                 wdev->mesh_id_up_len =
2502                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2503                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2504                        wdev->mesh_id_up_len);
2505                 wdev_unlock(wdev);
2506         }
2507
2508         if (info->attrs[NL80211_ATTR_4ADDR]) {
2509                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2510                 change = true;
2511                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2512                 if (err)
2513                         return err;
2514         } else {
2515                 params.use_4addr = -1;
2516         }
2517
2518         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2519                 if (ntype != NL80211_IFTYPE_MONITOR)
2520                         return -EINVAL;
2521                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2522                                           &_flags);
2523                 if (err)
2524                         return err;
2525
2526                 flags = &_flags;
2527                 change = true;
2528         }
2529
2530         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2531             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2532                 return -EOPNOTSUPP;
2533
2534         if (change)
2535                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2536         else
2537                 err = 0;
2538
2539         if (!err && params.use_4addr != -1)
2540                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2541
2542         return err;
2543 }
2544
2545 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2546 {
2547         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2548         struct vif_params params;
2549         struct wireless_dev *wdev;
2550         struct sk_buff *msg;
2551         int err;
2552         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2553         u32 flags;
2554
2555         /* to avoid failing a new interface creation due to pending removal */
2556         cfg80211_destroy_ifaces(rdev);
2557
2558         memset(&params, 0, sizeof(params));
2559
2560         if (!info->attrs[NL80211_ATTR_IFNAME])
2561                 return -EINVAL;
2562
2563         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2564                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2565                 if (type > NL80211_IFTYPE_MAX)
2566                         return -EINVAL;
2567         }
2568
2569         if (!rdev->ops->add_virtual_intf ||
2570             !(rdev->wiphy.interface_modes & (1 << type)))
2571                 return -EOPNOTSUPP;
2572
2573         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2574                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2575                            ETH_ALEN);
2576                 if (!is_valid_ether_addr(params.macaddr))
2577                         return -EADDRNOTAVAIL;
2578         }
2579
2580         if (info->attrs[NL80211_ATTR_4ADDR]) {
2581                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2582                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2583                 if (err)
2584                         return err;
2585         }
2586
2587         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2588         if (!msg)
2589                 return -ENOMEM;
2590
2591         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2592                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2593                                   &flags);
2594
2595         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2596             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2597                 return -EOPNOTSUPP;
2598
2599         wdev = rdev_add_virtual_intf(rdev,
2600                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2601                                 type, err ? NULL : &flags, &params);
2602         if (IS_ERR(wdev)) {
2603                 nlmsg_free(msg);
2604                 return PTR_ERR(wdev);
2605         }
2606
2607         if (info->attrs[NL80211_ATTR_IFACE_SOCKET_OWNER])
2608                 wdev->owner_nlportid = info->snd_portid;
2609
2610         switch (type) {
2611         case NL80211_IFTYPE_MESH_POINT:
2612                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2613                         break;
2614                 wdev_lock(wdev);
2615                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2616                              IEEE80211_MAX_MESH_ID_LEN);
2617                 wdev->mesh_id_up_len =
2618                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2619                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2620                        wdev->mesh_id_up_len);
2621                 wdev_unlock(wdev);
2622                 break;
2623         case NL80211_IFTYPE_P2P_DEVICE:
2624                 /*
2625                  * P2P Device doesn't have a netdev, so doesn't go
2626                  * through the netdev notifier and must be added here
2627                  */
2628                 mutex_init(&wdev->mtx);
2629                 INIT_LIST_HEAD(&wdev->event_list);
2630                 spin_lock_init(&wdev->event_lock);
2631                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2632                 spin_lock_init(&wdev->mgmt_registrations_lock);
2633
2634                 wdev->identifier = ++rdev->wdev_id;
2635                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2636                 rdev->devlist_generation++;
2637                 break;
2638         default:
2639                 break;
2640         }
2641
2642         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2643                                rdev, wdev) < 0) {
2644                 nlmsg_free(msg);
2645                 return -ENOBUFS;
2646         }
2647
2648         return genlmsg_reply(msg, info);
2649 }
2650
2651 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2652 {
2653         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2654         struct wireless_dev *wdev = info->user_ptr[1];
2655
2656         if (!rdev->ops->del_virtual_intf)
2657                 return -EOPNOTSUPP;
2658
2659         /*
2660          * If we remove a wireless device without a netdev then clear
2661          * user_ptr[1] so that nl80211_post_doit won't dereference it
2662          * to check if it needs to do dev_put(). Otherwise it crashes
2663          * since the wdev has been freed, unlike with a netdev where
2664          * we need the dev_put() for the netdev to really be freed.
2665          */
2666         if (!wdev->netdev)
2667                 info->user_ptr[1] = NULL;
2668
2669         return rdev_del_virtual_intf(rdev, wdev);
2670 }
2671
2672 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2673 {
2674         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2675         struct net_device *dev = info->user_ptr[1];
2676         u16 noack_map;
2677
2678         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2679                 return -EINVAL;
2680
2681         if (!rdev->ops->set_noack_map)
2682                 return -EOPNOTSUPP;
2683
2684         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2685
2686         return rdev_set_noack_map(rdev, dev, noack_map);
2687 }
2688
2689 struct get_key_cookie {
2690         struct sk_buff *msg;
2691         int error;
2692         int idx;
2693 };
2694
2695 static void get_key_callback(void *c, struct key_params *params)
2696 {
2697         struct nlattr *key;
2698         struct get_key_cookie *cookie = c;
2699
2700         if ((params->key &&
2701              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2702                      params->key_len, params->key)) ||
2703             (params->seq &&
2704              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2705                      params->seq_len, params->seq)) ||
2706             (params->cipher &&
2707              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2708                          params->cipher)))
2709                 goto nla_put_failure;
2710
2711         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2712         if (!key)
2713                 goto nla_put_failure;
2714
2715         if ((params->key &&
2716              nla_put(cookie->msg, NL80211_KEY_DATA,
2717                      params->key_len, params->key)) ||
2718             (params->seq &&
2719              nla_put(cookie->msg, NL80211_KEY_SEQ,
2720                      params->seq_len, params->seq)) ||
2721             (params->cipher &&
2722              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2723                          params->cipher)))
2724                 goto nla_put_failure;
2725
2726         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2727                 goto nla_put_failure;
2728
2729         nla_nest_end(cookie->msg, key);
2730
2731         return;
2732  nla_put_failure:
2733         cookie->error = 1;
2734 }
2735
2736 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2737 {
2738         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2739         int err;
2740         struct net_device *dev = info->user_ptr[1];
2741         u8 key_idx = 0;
2742         const u8 *mac_addr = NULL;
2743         bool pairwise;
2744         struct get_key_cookie cookie = {
2745                 .error = 0,
2746         };
2747         void *hdr;
2748         struct sk_buff *msg;
2749
2750         if (info->attrs[NL80211_ATTR_KEY_IDX])
2751                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2752
2753         if (key_idx > 5)
2754                 return -EINVAL;
2755
2756         if (info->attrs[NL80211_ATTR_MAC])
2757                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2758
2759         pairwise = !!mac_addr;
2760         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2761                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2762                 if (kt >= NUM_NL80211_KEYTYPES)
2763                         return -EINVAL;
2764                 if (kt != NL80211_KEYTYPE_GROUP &&
2765                     kt != NL80211_KEYTYPE_PAIRWISE)
2766                         return -EINVAL;
2767                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2768         }
2769
2770         if (!rdev->ops->get_key)
2771                 return -EOPNOTSUPP;
2772
2773         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2774         if (!msg)
2775                 return -ENOMEM;
2776
2777         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2778                              NL80211_CMD_NEW_KEY);
2779         if (!hdr)
2780                 goto nla_put_failure;
2781
2782         cookie.msg = msg;
2783         cookie.idx = key_idx;
2784
2785         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2786             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2787                 goto nla_put_failure;
2788         if (mac_addr &&
2789             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2790                 goto nla_put_failure;
2791
2792         if (pairwise && mac_addr &&
2793             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2794                 return -ENOENT;
2795
2796         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2797                            get_key_callback);
2798
2799         if (err)
2800                 goto free_msg;
2801
2802         if (cookie.error)
2803                 goto nla_put_failure;
2804
2805         genlmsg_end(msg, hdr);
2806         return genlmsg_reply(msg, info);
2807
2808  nla_put_failure:
2809         err = -ENOBUFS;
2810  free_msg:
2811         nlmsg_free(msg);
2812         return err;
2813 }
2814
2815 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2816 {
2817         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2818         struct key_parse key;
2819         int err;
2820         struct net_device *dev = info->user_ptr[1];
2821
2822         err = nl80211_parse_key(info, &key);
2823         if (err)
2824                 return err;
2825
2826         if (key.idx < 0)
2827                 return -EINVAL;
2828
2829         /* only support setting default key */
2830         if (!key.def && !key.defmgmt)
2831                 return -EINVAL;
2832
2833         wdev_lock(dev->ieee80211_ptr);
2834
2835         if (key.def) {
2836                 if (!rdev->ops->set_default_key) {
2837                         err = -EOPNOTSUPP;
2838                         goto out;
2839                 }
2840
2841                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2842                 if (err)
2843                         goto out;
2844
2845                 err = rdev_set_default_key(rdev, dev, key.idx,
2846                                                  key.def_uni, key.def_multi);
2847
2848                 if (err)
2849                         goto out;
2850
2851 #ifdef CONFIG_CFG80211_WEXT
2852                 dev->ieee80211_ptr->wext.default_key = key.idx;
2853 #endif
2854         } else {
2855                 if (key.def_uni || !key.def_multi) {
2856                         err = -EINVAL;
2857                         goto out;
2858                 }
2859
2860                 if (!rdev->ops->set_default_mgmt_key) {
2861                         err = -EOPNOTSUPP;
2862                         goto out;
2863                 }
2864
2865                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2866                 if (err)
2867                         goto out;
2868
2869                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2870                 if (err)
2871                         goto out;
2872
2873 #ifdef CONFIG_CFG80211_WEXT
2874                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2875 #endif
2876         }
2877
2878  out:
2879         wdev_unlock(dev->ieee80211_ptr);
2880
2881         return err;
2882 }
2883
2884 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2885 {
2886         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2887         int err;
2888         struct net_device *dev = info->user_ptr[1];
2889         struct key_parse key;
2890         const u8 *mac_addr = NULL;
2891
2892         err = nl80211_parse_key(info, &key);
2893         if (err)
2894                 return err;
2895
2896         if (!key.p.key)
2897                 return -EINVAL;
2898
2899         if (info->attrs[NL80211_ATTR_MAC])
2900                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2901
2902         if (key.type == -1) {
2903                 if (mac_addr)
2904                         key.type = NL80211_KEYTYPE_PAIRWISE;
2905                 else
2906                         key.type = NL80211_KEYTYPE_GROUP;
2907         }
2908
2909         /* for now */
2910         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2911             key.type != NL80211_KEYTYPE_GROUP)
2912                 return -EINVAL;
2913
2914         if (!rdev->ops->add_key)
2915                 return -EOPNOTSUPP;
2916
2917         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2918                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2919                                            mac_addr))
2920                 return -EINVAL;
2921
2922         wdev_lock(dev->ieee80211_ptr);
2923         err = nl80211_key_allowed(dev->ieee80211_ptr);
2924         if (!err)
2925                 err = rdev_add_key(rdev, dev, key.idx,
2926                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2927                                     mac_addr, &key.p);
2928         wdev_unlock(dev->ieee80211_ptr);
2929
2930         return err;
2931 }
2932
2933 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2934 {
2935         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2936         int err;
2937         struct net_device *dev = info->user_ptr[1];
2938         u8 *mac_addr = NULL;
2939         struct key_parse key;
2940
2941         err = nl80211_parse_key(info, &key);
2942         if (err)
2943                 return err;
2944
2945         if (info->attrs[NL80211_ATTR_MAC])
2946                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2947
2948         if (key.type == -1) {
2949                 if (mac_addr)
2950                         key.type = NL80211_KEYTYPE_PAIRWISE;
2951                 else
2952                         key.type = NL80211_KEYTYPE_GROUP;
2953         }
2954
2955         /* for now */
2956         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2957             key.type != NL80211_KEYTYPE_GROUP)
2958                 return -EINVAL;
2959
2960         if (!rdev->ops->del_key)
2961                 return -EOPNOTSUPP;
2962
2963         wdev_lock(dev->ieee80211_ptr);
2964         err = nl80211_key_allowed(dev->ieee80211_ptr);
2965
2966         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2967             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2968                 err = -ENOENT;
2969
2970         if (!err)
2971                 err = rdev_del_key(rdev, dev, key.idx,
2972                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2973                                    mac_addr);
2974
2975 #ifdef CONFIG_CFG80211_WEXT
2976         if (!err) {
2977                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2978                         dev->ieee80211_ptr->wext.default_key = -1;
2979                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2980                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2981         }
2982 #endif
2983         wdev_unlock(dev->ieee80211_ptr);
2984
2985         return err;
2986 }
2987
2988 /* This function returns an error or the number of nested attributes */
2989 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2990 {
2991         struct nlattr *attr;
2992         int n_entries = 0, tmp;
2993
2994         nla_for_each_nested(attr, nl_attr, tmp) {
2995                 if (nla_len(attr) != ETH_ALEN)
2996                         return -EINVAL;
2997
2998                 n_entries++;
2999         }
3000
3001         return n_entries;
3002 }
3003
3004 /*
3005  * This function parses ACL information and allocates memory for ACL data.
3006  * On successful return, the calling function is responsible to free the
3007  * ACL buffer returned by this function.
3008  */
3009 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3010                                                 struct genl_info *info)
3011 {
3012         enum nl80211_acl_policy acl_policy;
3013         struct nlattr *attr;
3014         struct cfg80211_acl_data *acl;
3015         int i = 0, n_entries, tmp;
3016
3017         if (!wiphy->max_acl_mac_addrs)
3018                 return ERR_PTR(-EOPNOTSUPP);
3019
3020         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3021                 return ERR_PTR(-EINVAL);
3022
3023         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3024         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3025             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3026                 return ERR_PTR(-EINVAL);
3027
3028         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3029                 return ERR_PTR(-EINVAL);
3030
3031         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3032         if (n_entries < 0)
3033                 return ERR_PTR(n_entries);
3034
3035         if (n_entries > wiphy->max_acl_mac_addrs)
3036                 return ERR_PTR(-ENOTSUPP);
3037
3038         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3039                       GFP_KERNEL);
3040         if (!acl)
3041                 return ERR_PTR(-ENOMEM);
3042
3043         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3044                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3045                 i++;
3046         }
3047
3048         acl->n_acl_entries = n_entries;
3049         acl->acl_policy = acl_policy;
3050
3051         return acl;
3052 }
3053
3054 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3055 {
3056         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3057         struct net_device *dev = info->user_ptr[1];
3058         struct cfg80211_acl_data *acl;
3059         int err;
3060
3061         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3062             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3063                 return -EOPNOTSUPP;
3064
3065         if (!dev->ieee80211_ptr->beacon_interval)
3066                 return -EINVAL;
3067
3068         acl = parse_acl_data(&rdev->wiphy, info);
3069         if (IS_ERR(acl))
3070                 return PTR_ERR(acl);
3071
3072         err = rdev_set_mac_acl(rdev, dev, acl);
3073
3074         kfree(acl);
3075
3076         return err;
3077 }
3078
3079 static int nl80211_parse_beacon(struct nlattr *attrs[],
3080                                 struct cfg80211_beacon_data *bcn)
3081 {
3082         bool haveinfo = false;
3083
3084         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3085             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3086             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3087             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3088                 return -EINVAL;
3089
3090         memset(bcn, 0, sizeof(*bcn));
3091
3092         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3093                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3094                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3095                 if (!bcn->head_len)
3096                         return -EINVAL;
3097                 haveinfo = true;
3098         }
3099
3100         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3101                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3102                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3103                 haveinfo = true;
3104         }
3105
3106         if (!haveinfo)
3107                 return -EINVAL;
3108
3109         if (attrs[NL80211_ATTR_IE]) {
3110                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3111                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3112         }
3113
3114         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3115                 bcn->proberesp_ies =
3116                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3117                 bcn->proberesp_ies_len =
3118                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3119         }
3120
3121         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3122                 bcn->assocresp_ies =
3123                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3124                 bcn->assocresp_ies_len =
3125                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3126         }
3127
3128         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3129                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3130                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3131         }
3132
3133         return 0;
3134 }
3135
3136 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3137                                    struct cfg80211_ap_settings *params)
3138 {
3139         struct wireless_dev *wdev;
3140         bool ret = false;
3141
3142         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3143                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3144                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3145                         continue;
3146
3147                 if (!wdev->preset_chandef.chan)
3148                         continue;
3149
3150                 params->chandef = wdev->preset_chandef;
3151                 ret = true;
3152                 break;
3153         }
3154
3155         return ret;
3156 }
3157
3158 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3159                                     enum nl80211_auth_type auth_type,
3160                                     enum nl80211_commands cmd)
3161 {
3162         if (auth_type > NL80211_AUTHTYPE_MAX)
3163                 return false;
3164
3165         switch (cmd) {
3166         case NL80211_CMD_AUTHENTICATE:
3167                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3168                     auth_type == NL80211_AUTHTYPE_SAE)
3169                         return false;
3170                 return true;
3171         case NL80211_CMD_CONNECT:
3172         case NL80211_CMD_START_AP:
3173                 /* SAE not supported yet */
3174                 if (auth_type == NL80211_AUTHTYPE_SAE)
3175                         return false;
3176                 return true;
3177         default:
3178                 return false;
3179         }
3180 }
3181
3182 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3183 {
3184         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3185         struct net_device *dev = info->user_ptr[1];
3186         struct wireless_dev *wdev = dev->ieee80211_ptr;
3187         struct cfg80211_ap_settings params;
3188         int err;
3189
3190         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3191             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3192                 return -EOPNOTSUPP;
3193
3194         if (!rdev->ops->start_ap)
3195                 return -EOPNOTSUPP;
3196
3197         if (wdev->beacon_interval)
3198                 return -EALREADY;
3199
3200         memset(&params, 0, sizeof(params));
3201
3202         /* these are required for START_AP */
3203         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3204             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3205             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3206                 return -EINVAL;
3207
3208         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3209         if (err)
3210                 return err;
3211
3212         params.beacon_interval =
3213                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3214         params.dtim_period =
3215                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3216
3217         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3218         if (err)
3219                 return err;
3220
3221         /*
3222          * In theory, some of these attributes should be required here
3223          * but since they were not used when the command was originally
3224          * added, keep them optional for old user space programs to let
3225          * them continue to work with drivers that do not need the
3226          * additional information -- drivers must check!
3227          */
3228         if (info->attrs[NL80211_ATTR_SSID]) {
3229                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3230                 params.ssid_len =
3231                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3232                 if (params.ssid_len == 0 ||
3233                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3234                         return -EINVAL;
3235         }
3236
3237         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3238                 params.hidden_ssid = nla_get_u32(
3239                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3240                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3241                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3242                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3243                         return -EINVAL;
3244         }
3245
3246         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3247
3248         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3249                 params.auth_type = nla_get_u32(
3250                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3251                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3252                                              NL80211_CMD_START_AP))
3253                         return -EINVAL;
3254         } else
3255                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3256
3257         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3258                                       NL80211_MAX_NR_CIPHER_SUITES);
3259         if (err)
3260                 return err;
3261
3262         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3263                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3264                         return -EOPNOTSUPP;
3265                 params.inactivity_timeout = nla_get_u16(
3266                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3267         }
3268
3269         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3270                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3271                         return -EINVAL;
3272                 params.p2p_ctwindow =
3273                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3274                 if (params.p2p_ctwindow > 127)
3275                         return -EINVAL;
3276                 if (params.p2p_ctwindow != 0 &&
3277                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3278                         return -EINVAL;
3279         }
3280
3281         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3282                 u8 tmp;
3283
3284                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3285                         return -EINVAL;
3286                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3287                 if (tmp > 1)
3288                         return -EINVAL;
3289                 params.p2p_opp_ps = tmp;
3290                 if (params.p2p_opp_ps != 0 &&
3291                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3292                         return -EINVAL;
3293         }
3294
3295         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3296                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3297                 if (err)
3298                         return err;
3299         } else if (wdev->preset_chandef.chan) {
3300                 params.chandef = wdev->preset_chandef;
3301         } else if (!nl80211_get_ap_channel(rdev, &params))
3302                 return -EINVAL;
3303
3304         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
3305                                      wdev->iftype))
3306                 return -EINVAL;
3307
3308         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3309                 params.acl = parse_acl_data(&rdev->wiphy, info);
3310                 if (IS_ERR(params.acl))
3311                         return PTR_ERR(params.acl);
3312         }
3313
3314         wdev_lock(wdev);
3315         err = rdev_start_ap(rdev, dev, &params);
3316         if (!err) {
3317                 wdev->preset_chandef = params.chandef;
3318                 wdev->beacon_interval = params.beacon_interval;
3319                 wdev->chandef = params.chandef;
3320                 wdev->ssid_len = params.ssid_len;
3321                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3322         }
3323         wdev_unlock(wdev);
3324
3325         kfree(params.acl);
3326
3327         return err;
3328 }
3329
3330 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3331 {
3332         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3333         struct net_device *dev = info->user_ptr[1];
3334         struct wireless_dev *wdev = dev->ieee80211_ptr;
3335         struct cfg80211_beacon_data params;
3336         int err;
3337
3338         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3339             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3340                 return -EOPNOTSUPP;
3341
3342         if (!rdev->ops->change_beacon)
3343                 return -EOPNOTSUPP;
3344
3345         if (!wdev->beacon_interval)
3346                 return -EINVAL;
3347
3348         err = nl80211_parse_beacon(info->attrs, &params);
3349         if (err)
3350                 return err;
3351
3352         wdev_lock(wdev);
3353         err = rdev_change_beacon(rdev, dev, &params);
3354         wdev_unlock(wdev);
3355
3356         return err;
3357 }
3358
3359 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3360 {
3361         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3362         struct net_device *dev = info->user_ptr[1];
3363
3364         return cfg80211_stop_ap(rdev, dev, false);
3365 }
3366
3367 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3368         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3369         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3370         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3371         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3372         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3373         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3374 };
3375
3376 static int parse_station_flags(struct genl_info *info,
3377                                enum nl80211_iftype iftype,
3378                                struct station_parameters *params)
3379 {
3380         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3381         struct nlattr *nla;
3382         int flag;
3383
3384         /*
3385          * Try parsing the new attribute first so userspace
3386          * can specify both for older kernels.
3387          */
3388         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3389         if (nla) {
3390                 struct nl80211_sta_flag_update *sta_flags;
3391
3392                 sta_flags = nla_data(nla);
3393                 params->sta_flags_mask = sta_flags->mask;
3394                 params->sta_flags_set = sta_flags->set;
3395                 params->sta_flags_set &= params->sta_flags_mask;
3396                 if ((params->sta_flags_mask |
3397                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3398                         return -EINVAL;
3399                 return 0;
3400         }
3401
3402         /* if present, parse the old attribute */
3403
3404         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3405         if (!nla)
3406                 return 0;
3407
3408         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3409                              nla, sta_flags_policy))
3410                 return -EINVAL;
3411
3412         /*
3413          * Only allow certain flags for interface types so that
3414          * other attributes are silently ignored. Remember that
3415          * this is backward compatibility code with old userspace
3416          * and shouldn't be hit in other cases anyway.
3417          */
3418         switch (iftype) {
3419         case NL80211_IFTYPE_AP:
3420         case NL80211_IFTYPE_AP_VLAN:
3421         case NL80211_IFTYPE_P2P_GO:
3422                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3423                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3424                                          BIT(NL80211_STA_FLAG_WME) |
3425                                          BIT(NL80211_STA_FLAG_MFP);
3426                 break;
3427         case NL80211_IFTYPE_P2P_CLIENT:
3428         case NL80211_IFTYPE_STATION:
3429                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3430                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3431                 break;
3432         case NL80211_IFTYPE_MESH_POINT:
3433                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3434                                          BIT(NL80211_STA_FLAG_MFP) |
3435                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3436         default:
3437                 return -EINVAL;
3438         }
3439
3440         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3441                 if (flags[flag]) {
3442                         params->sta_flags_set |= (1<<flag);
3443
3444                         /* no longer support new API additions in old API */
3445                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3446                                 return -EINVAL;
3447                 }
3448         }
3449
3450         return 0;
3451 }
3452
3453 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3454                                  int attr)
3455 {
3456         struct nlattr *rate;
3457         u32 bitrate;
3458         u16 bitrate_compat;
3459
3460         rate = nla_nest_start(msg, attr);
3461         if (!rate)
3462                 return false;
3463
3464         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3465         bitrate = cfg80211_calculate_bitrate(info);
3466         /* report 16-bit bitrate only if we can */
3467         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3468         if (bitrate > 0 &&
3469             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3470                 return false;
3471         if (bitrate_compat > 0 &&
3472             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3473                 return false;
3474
3475         if (info->flags & RATE_INFO_FLAGS_MCS) {
3476                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3477                         return false;
3478                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3479                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3480                         return false;
3481                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3482                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3483                         return false;
3484         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3485                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3486                         return false;
3487                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3488                         return false;
3489                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3490                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3491                         return false;
3492                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3493                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3494                         return false;
3495                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3496                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3497                         return false;
3498                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3499                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3500                         return false;
3501                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3502                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3503                         return false;
3504         }
3505
3506         nla_nest_end(msg, rate);
3507         return true;
3508 }
3509
3510 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3511                                int id)
3512 {
3513         void *attr;
3514         int i = 0;
3515
3516         if (!mask)
3517                 return true;
3518
3519         attr = nla_nest_start(msg, id);
3520         if (!attr)
3521                 return false;
3522
3523         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3524                 if (!(mask & BIT(i)))
3525                         continue;
3526
3527                 if (nla_put_u8(msg, i, signal[i]))
3528                         return false;
3529         }
3530
3531         nla_nest_end(msg, attr);
3532
3533         return true;
3534 }
3535
3536 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3537                                 int flags,
3538                                 struct cfg80211_registered_device *rdev,
3539                                 struct net_device *dev,
3540                                 const u8 *mac_addr, struct station_info *sinfo)
3541 {
3542         void *hdr;
3543         struct nlattr *sinfoattr, *bss_param;
3544
3545         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3546         if (!hdr)
3547                 return -1;
3548
3549         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3550             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3551             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3552                 goto nla_put_failure;
3553
3554         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3555         if (!sinfoattr)
3556                 goto nla_put_failure;
3557         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3558             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3559                         sinfo->connected_time))
3560                 goto nla_put_failure;
3561         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3562             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3563                         sinfo->inactive_time))
3564                 goto nla_put_failure;
3565         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3566                               STATION_INFO_RX_BYTES64)) &&
3567             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3568                         (u32)sinfo->rx_bytes))
3569                 goto nla_put_failure;
3570         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3571                               STATION_INFO_TX_BYTES64)) &&
3572             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3573                         (u32)sinfo->tx_bytes))
3574                 goto nla_put_failure;
3575         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3576             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3577                         sinfo->rx_bytes))
3578                 goto nla_put_failure;
3579         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3580             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3581                         sinfo->tx_bytes))
3582                 goto nla_put_failure;
3583         if ((sinfo->filled & STATION_INFO_LLID) &&
3584             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3585                 goto nla_put_failure;
3586         if ((sinfo->filled & STATION_INFO_PLID) &&
3587             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3588                 goto nla_put_failure;
3589         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3590             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3591                        sinfo->plink_state))
3592                 goto nla_put_failure;
3593         switch (rdev->wiphy.signal_type) {
3594         case CFG80211_SIGNAL_TYPE_MBM:
3595                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3596                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3597                                sinfo->signal))
3598                         goto nla_put_failure;
3599                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3600                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3601                                sinfo->signal_avg))
3602                         goto nla_put_failure;
3603                 break;
3604         default:
3605                 break;
3606         }
3607         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3608                 if (!nl80211_put_signal(msg, sinfo->chains,
3609                                         sinfo->chain_signal,
3610                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3611                         goto nla_put_failure;
3612         }
3613         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3614                 if (!nl80211_put_signal(msg, sinfo->chains,
3615                                         sinfo->chain_signal_avg,
3616                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3617                         goto nla_put_failure;
3618         }
3619         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3620                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3621                                           NL80211_STA_INFO_TX_BITRATE))
3622                         goto nla_put_failure;
3623         }
3624         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3625                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3626                                           NL80211_STA_INFO_RX_BITRATE))
3627                         goto nla_put_failure;
3628         }
3629         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3630             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3631                         sinfo->rx_packets))
3632                 goto nla_put_failure;
3633         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3634             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3635                         sinfo->tx_packets))
3636                 goto nla_put_failure;
3637         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3638             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3639                         sinfo->tx_retries))
3640                 goto nla_put_failure;
3641         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3642             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3643                         sinfo->tx_failed))
3644                 goto nla_put_failure;
3645         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3646             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3647                         sinfo->beacon_loss_count))
3648                 goto nla_put_failure;
3649         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3650             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3651                         sinfo->local_pm))
3652                 goto nla_put_failure;
3653         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3654             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3655                         sinfo->peer_pm))
3656                 goto nla_put_failure;
3657         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3658             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3659                         sinfo->nonpeer_pm))
3660                 goto nla_put_failure;
3661         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3662                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3663                 if (!bss_param)
3664                         goto nla_put_failure;
3665
3666                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3667                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3668                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3669                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3670                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3671                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3672                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3673                                sinfo->bss_param.dtim_period) ||
3674                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3675                                 sinfo->bss_param.beacon_interval))
3676                         goto nla_put_failure;
3677
3678                 nla_nest_end(msg, bss_param);
3679         }
3680         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3681             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3682                     sizeof(struct nl80211_sta_flag_update),
3683                     &sinfo->sta_flags))
3684                 goto nla_put_failure;
3685         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3686                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3687                             sinfo->t_offset))
3688                 goto nla_put_failure;
3689         nla_nest_end(msg, sinfoattr);
3690
3691         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3692             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3693                     sinfo->assoc_req_ies))
3694                 goto nla_put_failure;
3695
3696         return genlmsg_end(msg, hdr);
3697
3698  nla_put_failure:
3699         genlmsg_cancel(msg, hdr);
3700         return -EMSGSIZE;
3701 }
3702
3703 static int nl80211_dump_station(struct sk_buff *skb,
3704                                 struct netlink_callback *cb)
3705 {
3706         struct station_info sinfo;
3707         struct cfg80211_registered_device *rdev;
3708         struct wireless_dev *wdev;
3709         u8 mac_addr[ETH_ALEN];
3710         int sta_idx = cb->args[2];
3711         int err;
3712
3713         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3714         if (err)
3715                 return err;
3716
3717         if (!wdev->netdev) {
3718                 err = -EINVAL;
3719                 goto out_err;
3720         }
3721
3722         if (!rdev->ops->dump_station) {
3723                 err = -EOPNOTSUPP;
3724                 goto out_err;
3725         }
3726
3727         while (1) {
3728                 memset(&sinfo, 0, sizeof(sinfo));
3729                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3730                                         mac_addr, &sinfo);
3731                 if (err == -ENOENT)
3732                         break;
3733                 if (err)
3734                         goto out_err;
3735
3736                 if (nl80211_send_station(skb,
3737                                 NETLINK_CB(cb->skb).portid,
3738                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3739                                 rdev, wdev->netdev, mac_addr,
3740                                 &sinfo) < 0)
3741                         goto out;
3742
3743                 sta_idx++;
3744         }
3745
3746
3747  out:
3748         cb->args[2] = sta_idx;
3749         err = skb->len;
3750  out_err:
3751         nl80211_finish_wdev_dump(rdev);
3752
3753         return err;
3754 }
3755
3756 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3757 {
3758         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3759         struct net_device *dev = info->user_ptr[1];
3760         struct station_info sinfo;
3761         struct sk_buff *msg;
3762         u8 *mac_addr = NULL;
3763         int err;
3764
3765         memset(&sinfo, 0, sizeof(sinfo));
3766
3767         if (!info->attrs[NL80211_ATTR_MAC])
3768                 return -EINVAL;
3769
3770         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3771
3772         if (!rdev->ops->get_station)
3773                 return -EOPNOTSUPP;
3774
3775         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3776         if (err)
3777                 return err;
3778
3779         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3780         if (!msg)
3781                 return -ENOMEM;
3782
3783         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3784                                  rdev, dev, mac_addr, &sinfo) < 0) {
3785                 nlmsg_free(msg);
3786                 return -ENOBUFS;
3787         }
3788
3789         return genlmsg_reply(msg, info);
3790 }
3791
3792 int cfg80211_check_station_change(struct wiphy *wiphy,
3793                                   struct station_parameters *params,
3794                                   enum cfg80211_station_type statype)
3795 {
3796         if (params->listen_interval != -1)
3797                 return -EINVAL;
3798         if (params->aid)
3799                 return -EINVAL;
3800
3801         /* When you run into this, adjust the code below for the new flag */
3802         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3803
3804         switch (statype) {
3805         case CFG80211_STA_MESH_PEER_KERNEL:
3806         case CFG80211_STA_MESH_PEER_USER:
3807                 /*
3808                  * No ignoring the TDLS flag here -- the userspace mesh
3809                  * code doesn't have the bug of including TDLS in the
3810                  * mask everywhere.
3811                  */
3812                 if (params->sta_flags_mask &
3813                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3814                                   BIT(NL80211_STA_FLAG_MFP) |
3815                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3816                         return -EINVAL;
3817                 break;
3818         case CFG80211_STA_TDLS_PEER_SETUP:
3819         case CFG80211_STA_TDLS_PEER_ACTIVE:
3820                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3821                         return -EINVAL;
3822                 /* ignore since it can't change */
3823                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3824                 break;
3825         default:
3826                 /* disallow mesh-specific things */
3827                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3828                         return -EINVAL;
3829                 if (params->local_pm)
3830                         return -EINVAL;
3831                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3832                         return -EINVAL;
3833         }
3834
3835         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3836             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3837                 /* TDLS can't be set, ... */
3838                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3839                         return -EINVAL;
3840                 /*
3841                  * ... but don't bother the driver with it. This works around
3842                  * a hostapd/wpa_supplicant issue -- it always includes the
3843                  * TLDS_PEER flag in the mask even for AP mode.
3844                  */
3845                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3846         }
3847
3848         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3849                 /* reject other things that can't change */
3850                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3851                         return -EINVAL;
3852                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3853                         return -EINVAL;
3854                 if (params->supported_rates)
3855                         return -EINVAL;
3856                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3857                         return -EINVAL;
3858         }
3859
3860         if (statype != CFG80211_STA_AP_CLIENT) {
3861                 if (params->vlan)
3862                         return -EINVAL;
3863         }
3864
3865         switch (statype) {
3866         case CFG80211_STA_AP_MLME_CLIENT:
3867                 /* Use this only for authorizing/unauthorizing a station */
3868                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3869                         return -EOPNOTSUPP;
3870                 break;
3871         case CFG80211_STA_AP_CLIENT:
3872                 /* accept only the listed bits */
3873                 if (params->sta_flags_mask &
3874                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3875                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3876                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3877                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3878                                   BIT(NL80211_STA_FLAG_WME) |
3879                                   BIT(NL80211_STA_FLAG_MFP)))
3880                         return -EINVAL;
3881
3882                 /* but authenticated/associated only if driver handles it */
3883                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3884                     params->sta_flags_mask &
3885                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3886                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3887                         return -EINVAL;
3888                 break;
3889         case CFG80211_STA_IBSS:
3890         case CFG80211_STA_AP_STA:
3891                 /* reject any changes other than AUTHORIZED */
3892                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3893                         return -EINVAL;
3894                 break;
3895         case CFG80211_STA_TDLS_PEER_SETUP:
3896                 /* reject any changes other than AUTHORIZED or WME */
3897                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3898                                                BIT(NL80211_STA_FLAG_WME)))
3899                         return -EINVAL;
3900                 /* force (at least) rates when authorizing */
3901                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3902                     !params->supported_rates)
3903                         return -EINVAL;
3904                 break;
3905         case CFG80211_STA_TDLS_PEER_ACTIVE:
3906                 /* reject any changes */
3907                 return -EINVAL;
3908         case CFG80211_STA_MESH_PEER_KERNEL:
3909                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3910                         return -EINVAL;
3911                 break;
3912         case CFG80211_STA_MESH_PEER_USER:
3913                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3914                         return -EINVAL;
3915                 break;
3916         }
3917
3918         return 0;
3919 }
3920 EXPORT_SYMBOL(cfg80211_check_station_change);
3921
3922 /*
3923  * Get vlan interface making sure it is running and on the right wiphy.
3924  */
3925 static struct net_device *get_vlan(struct genl_info *info,
3926                                    struct cfg80211_registered_device *rdev)
3927 {
3928         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3929         struct net_device *v;
3930         int ret;
3931
3932         if (!vlanattr)
3933                 return NULL;
3934
3935         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3936         if (!v)
3937                 return ERR_PTR(-ENODEV);
3938
3939         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3940                 ret = -EINVAL;
3941                 goto error;
3942         }
3943
3944         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3945             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3946             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3947                 ret = -EINVAL;
3948                 goto error;
3949         }
3950
3951         if (!netif_running(v)) {
3952                 ret = -ENETDOWN;
3953                 goto error;
3954         }
3955
3956         return v;
3957  error:
3958         dev_put(v);
3959         return ERR_PTR(ret);
3960 }
3961
3962 static const struct nla_policy
3963 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
3964         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3965         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3966 };
3967
3968 static int nl80211_parse_sta_wme(struct genl_info *info,
3969                                  struct station_parameters *params)
3970 {
3971         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3972         struct nlattr *nla;
3973         int err;
3974
3975         /* parse WME attributes if present */
3976         if (!info->attrs[NL80211_ATTR_STA_WME])
3977                 return 0;
3978
3979         nla = info->attrs[NL80211_ATTR_STA_WME];
3980         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3981                                nl80211_sta_wme_policy);
3982         if (err)
3983                 return err;
3984
3985         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3986                 params->uapsd_queues = nla_get_u8(
3987                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3988         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3989                 return -EINVAL;
3990
3991         if (tb[NL80211_STA_WME_MAX_SP])
3992                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3993
3994         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3995                 return -EINVAL;
3996
3997         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3998
3999         return 0;
4000 }
4001
4002 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4003                                       struct station_parameters *params)
4004 {
4005         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4006                 params->supported_channels =
4007                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4008                 params->supported_channels_len =
4009                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4010                 /*
4011                  * Need to include at least one (first channel, number of
4012                  * channels) tuple for each subband, and must have proper
4013                  * tuples for the rest of the data as well.
4014                  */
4015                 if (params->supported_channels_len < 2)
4016                         return -EINVAL;
4017                 if (params->supported_channels_len % 2)
4018                         return -EINVAL;
4019         }
4020
4021         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4022                 params->supported_oper_classes =
4023                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4024                 params->supported_oper_classes_len =
4025                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4026                 /*
4027                  * The value of the Length field of the Supported Operating
4028                  * Classes element is between 2 and 253.
4029                  */
4030                 if (params->supported_oper_classes_len < 2 ||
4031                     params->supported_oper_classes_len > 253)
4032                         return -EINVAL;
4033         }
4034         return 0;
4035 }
4036
4037 static int nl80211_set_station_tdls(struct genl_info *info,
4038                                     struct station_parameters *params)
4039 {
4040         int err;
4041         /* Dummy STA entry gets updated once the peer capabilities are known */
4042         if (info->attrs[NL80211_ATTR_PEER_AID])
4043                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4044         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4045                 params->ht_capa =
4046                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4047         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4048                 params->vht_capa =
4049                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4050
4051         err = nl80211_parse_sta_channel_info(info, params);
4052         if (err)
4053                 return err;
4054
4055         return nl80211_parse_sta_wme(info, params);
4056 }
4057
4058 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4059 {
4060         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4061         struct net_device *dev = info->user_ptr[1];
4062         struct station_parameters params;
4063         u8 *mac_addr;
4064         int err;
4065
4066         memset(&params, 0, sizeof(params));
4067
4068         params.listen_interval = -1;
4069
4070         if (!rdev->ops->change_station)
4071                 return -EOPNOTSUPP;
4072
4073         if (info->attrs[NL80211_ATTR_STA_AID])
4074                 return -EINVAL;
4075
4076         if (!info->attrs[NL80211_ATTR_MAC])
4077                 return -EINVAL;
4078
4079         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4080
4081         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4082                 params.supported_rates =
4083                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4084                 params.supported_rates_len =
4085                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4086         }
4087
4088         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4089                 params.capability =
4090                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4091                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4092         }
4093
4094         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4095                 params.ext_capab =
4096                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4097                 params.ext_capab_len =
4098                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4099         }
4100
4101         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4102                 return -EINVAL;
4103
4104         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4105                 return -EINVAL;
4106
4107         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4108                 params.plink_action =
4109                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4110                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4111                         return -EINVAL;
4112         }
4113
4114         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4115                 params.plink_state =
4116                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4117                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4118                         return -EINVAL;
4119                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4120         }
4121
4122         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4123                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4124                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4125
4126                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4127                     pm > NL80211_MESH_POWER_MAX)
4128                         return -EINVAL;
4129
4130                 params.local_pm = pm;
4131         }
4132
4133         /* Include parameters for TDLS peer (will check later) */
4134         err = nl80211_set_station_tdls(info, &params);
4135         if (err)
4136                 return err;
4137
4138         params.vlan = get_vlan(info, rdev);
4139         if (IS_ERR(params.vlan))
4140                 return PTR_ERR(params.vlan);
4141
4142         switch (dev->ieee80211_ptr->iftype) {
4143         case NL80211_IFTYPE_AP:
4144         case NL80211_IFTYPE_AP_VLAN:
4145         case NL80211_IFTYPE_P2P_GO:
4146         case NL80211_IFTYPE_P2P_CLIENT:
4147         case NL80211_IFTYPE_STATION:
4148         case NL80211_IFTYPE_ADHOC:
4149         case NL80211_IFTYPE_MESH_POINT:
4150                 break;
4151         default:
4152                 err = -EOPNOTSUPP;
4153                 goto out_put_vlan;
4154         }
4155
4156         /* driver will call cfg80211_check_station_change() */
4157         err = rdev_change_station(rdev, dev, mac_addr, &params);
4158
4159  out_put_vlan:
4160         if (params.vlan)
4161                 dev_put(params.vlan);
4162
4163         return err;
4164 }
4165
4166 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4167 {
4168         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4169         int err;
4170         struct net_device *dev = info->user_ptr[1];
4171         struct station_parameters params;
4172         u8 *mac_addr = NULL;
4173
4174         memset(&params, 0, sizeof(params));
4175
4176         if (!rdev->ops->add_station)
4177                 return -EOPNOTSUPP;
4178
4179         if (!info->attrs[NL80211_ATTR_MAC])
4180                 return -EINVAL;
4181
4182         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4183                 return -EINVAL;
4184
4185         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4186                 return -EINVAL;
4187
4188         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4189             !info->attrs[NL80211_ATTR_PEER_AID])
4190                 return -EINVAL;
4191
4192         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4193         params.supported_rates =
4194                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4195         params.supported_rates_len =
4196                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4197         params.listen_interval =
4198                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4199
4200         if (info->attrs[NL80211_ATTR_PEER_AID])
4201                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4202         else
4203                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4204         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4205                 return -EINVAL;
4206
4207         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4208                 params.capability =
4209                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4210                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4211         }
4212
4213         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4214                 params.ext_capab =
4215                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4216                 params.ext_capab_len =
4217                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4218         }
4219
4220         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4221                 params.ht_capa =
4222                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4223
4224         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4225                 params.vht_capa =
4226                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4227
4228         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4229                 params.opmode_notif_used = true;
4230                 params.opmode_notif =
4231                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4232         }
4233
4234         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4235                 params.plink_action =
4236                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4237                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4238                         return -EINVAL;
4239         }
4240
4241         err = nl80211_parse_sta_channel_info(info, &params);
4242         if (err)
4243                 return err;
4244
4245         err = nl80211_parse_sta_wme(info, &params);
4246         if (err)
4247                 return err;
4248
4249         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4250                 return -EINVAL;
4251
4252         /* When you run into this, adjust the code below for the new flag */
4253         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4254
4255         switch (dev->ieee80211_ptr->iftype) {
4256         case NL80211_IFTYPE_AP:
4257         case NL80211_IFTYPE_AP_VLAN:
4258         case NL80211_IFTYPE_P2P_GO:
4259                 /* ignore WME attributes if iface/sta is not capable */
4260                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4261                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4262                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4263
4264                 /* TDLS peers cannot be added */
4265                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4266                     info->attrs[NL80211_ATTR_PEER_AID])
4267                         return -EINVAL;
4268                 /* but don't bother the driver with it */
4269                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4270
4271                 /* allow authenticated/associated only if driver handles it */
4272                 if (!(rdev->wiphy.features &
4273                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4274                     params.sta_flags_mask &
4275                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4276                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4277                         return -EINVAL;
4278
4279                 /* must be last in here for error handling */
4280                 params.vlan = get_vlan(info, rdev);
4281                 if (IS_ERR(params.vlan))
4282                         return PTR_ERR(params.vlan);
4283                 break;
4284         case NL80211_IFTYPE_MESH_POINT:
4285                 /* ignore uAPSD data */
4286                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4287
4288                 /* associated is disallowed */
4289                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4290                         return -EINVAL;
4291                 /* TDLS peers cannot be added */
4292                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4293                     info->attrs[NL80211_ATTR_PEER_AID])
4294                         return -EINVAL;
4295                 break;
4296         case NL80211_IFTYPE_STATION:
4297         case NL80211_IFTYPE_P2P_CLIENT:
4298                 /* ignore uAPSD data */
4299                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4300
4301                 /* these are disallowed */
4302                 if (params.sta_flags_mask &
4303                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4304                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4305                         return -EINVAL;
4306                 /* Only TDLS peers can be added */
4307                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4308                         return -EINVAL;
4309                 /* Can only add if TDLS ... */
4310                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4311                         return -EOPNOTSUPP;
4312                 /* ... with external setup is supported */
4313                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4314                         return -EOPNOTSUPP;
4315                 /*
4316                  * Older wpa_supplicant versions always mark the TDLS peer
4317                  * as authorized, but it shouldn't yet be.
4318                  */
4319                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4320                 break;
4321         default:
4322                 return -EOPNOTSUPP;
4323         }
4324
4325         /* be aware of params.vlan when changing code here */
4326
4327         err = rdev_add_station(rdev, dev, mac_addr, &params);
4328
4329         if (params.vlan)
4330                 dev_put(params.vlan);
4331         return err;
4332 }
4333
4334 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4335 {
4336         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4337         struct net_device *dev = info->user_ptr[1];
4338         u8 *mac_addr = NULL;
4339
4340         if (info->attrs[NL80211_ATTR_MAC])
4341                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4342
4343         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4344             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4345             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4346             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4347                 return -EINVAL;
4348
4349         if (!rdev->ops->del_station)
4350                 return -EOPNOTSUPP;
4351
4352         return rdev_del_station(rdev, dev, mac_addr);
4353 }
4354
4355 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4356                                 int flags, struct net_device *dev,
4357                                 u8 *dst, u8 *next_hop,
4358                                 struct mpath_info *pinfo)
4359 {
4360         void *hdr;
4361         struct nlattr *pinfoattr;
4362
4363         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4364         if (!hdr)
4365                 return -1;
4366
4367         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4368             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4369             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4370             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4371                 goto nla_put_failure;
4372
4373         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4374         if (!pinfoattr)
4375                 goto nla_put_failure;
4376         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4377             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4378                         pinfo->frame_qlen))
4379                 goto nla_put_failure;
4380         if (((pinfo->filled & MPATH_INFO_SN) &&
4381              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4382             ((pinfo->filled & MPATH_INFO_METRIC) &&
4383              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4384                          pinfo->metric)) ||
4385             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4386              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4387                          pinfo->exptime)) ||
4388             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4389              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4390                         pinfo->flags)) ||
4391             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4392              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4393                          pinfo->discovery_timeout)) ||
4394             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4395              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4396                         pinfo->discovery_retries)))
4397                 goto nla_put_failure;
4398
4399         nla_nest_end(msg, pinfoattr);
4400
4401         return genlmsg_end(msg, hdr);
4402
4403  nla_put_failure:
4404         genlmsg_cancel(msg, hdr);
4405         return -EMSGSIZE;
4406 }
4407
4408 static int nl80211_dump_mpath(struct sk_buff *skb,
4409                               struct netlink_callback *cb)
4410 {
4411         struct mpath_info pinfo;
4412         struct cfg80211_registered_device *rdev;
4413         struct wireless_dev *wdev;
4414         u8 dst[ETH_ALEN];
4415         u8 next_hop[ETH_ALEN];
4416         int path_idx = cb->args[2];
4417         int err;
4418
4419         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4420         if (err)
4421                 return err;
4422
4423         if (!rdev->ops->dump_mpath) {
4424                 err = -EOPNOTSUPP;
4425                 goto out_err;
4426         }
4427
4428         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4429                 err = -EOPNOTSUPP;
4430                 goto out_err;
4431         }
4432
4433         while (1) {
4434                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4435                                       next_hop, &pinfo);
4436                 if (err == -ENOENT)
4437                         break;
4438                 if (err)
4439                         goto out_err;
4440
4441                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4442                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4443                                        wdev->netdev, dst, next_hop,
4444                                        &pinfo) < 0)
4445                         goto out;
4446
4447                 path_idx++;
4448         }
4449
4450
4451  out:
4452         cb->args[2] = path_idx;
4453         err = skb->len;
4454  out_err:
4455         nl80211_finish_wdev_dump(rdev);
4456         return err;
4457 }
4458
4459 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4460 {
4461         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4462         int err;
4463         struct net_device *dev = info->user_ptr[1];
4464         struct mpath_info pinfo;
4465         struct sk_buff *msg;
4466         u8 *dst = NULL;
4467         u8 next_hop[ETH_ALEN];
4468
4469         memset(&pinfo, 0, sizeof(pinfo));
4470
4471         if (!info->attrs[NL80211_ATTR_MAC])
4472                 return -EINVAL;
4473
4474         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4475
4476         if (!rdev->ops->get_mpath)
4477                 return -EOPNOTSUPP;
4478
4479         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4480                 return -EOPNOTSUPP;
4481
4482         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4483         if (err)
4484                 return err;
4485
4486         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4487         if (!msg)
4488                 return -ENOMEM;
4489
4490         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4491                                  dev, dst, next_hop, &pinfo) < 0) {
4492                 nlmsg_free(msg);
4493                 return -ENOBUFS;
4494         }
4495
4496         return genlmsg_reply(msg, info);
4497 }
4498
4499 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4500 {
4501         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4502         struct net_device *dev = info->user_ptr[1];
4503         u8 *dst = NULL;
4504         u8 *next_hop = NULL;
4505
4506         if (!info->attrs[NL80211_ATTR_MAC])
4507                 return -EINVAL;
4508
4509         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4510                 return -EINVAL;
4511
4512         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4513         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4514
4515         if (!rdev->ops->change_mpath)
4516                 return -EOPNOTSUPP;
4517
4518         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4519                 return -EOPNOTSUPP;
4520
4521         return rdev_change_mpath(rdev, dev, dst, next_hop);
4522 }
4523
4524 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4525 {
4526         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4527         struct net_device *dev = info->user_ptr[1];
4528         u8 *dst = NULL;
4529         u8 *next_hop = NULL;
4530
4531         if (!info->attrs[NL80211_ATTR_MAC])
4532                 return -EINVAL;
4533
4534         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4535                 return -EINVAL;
4536
4537         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4538         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4539
4540         if (!rdev->ops->add_mpath)
4541                 return -EOPNOTSUPP;
4542
4543         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4544                 return -EOPNOTSUPP;
4545
4546         return rdev_add_mpath(rdev, dev, dst, next_hop);
4547 }
4548
4549 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4550 {
4551         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4552         struct net_device *dev = info->user_ptr[1];
4553         u8 *dst = NULL;
4554
4555         if (info->attrs[NL80211_ATTR_MAC])
4556                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4557
4558         if (!rdev->ops->del_mpath)
4559                 return -EOPNOTSUPP;
4560
4561         return rdev_del_mpath(rdev, dev, dst);
4562 }
4563
4564 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4565 {
4566         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4567         struct net_device *dev = info->user_ptr[1];
4568         struct wireless_dev *wdev = dev->ieee80211_ptr;
4569         struct bss_parameters params;
4570         int err;
4571
4572         memset(&params, 0, sizeof(params));
4573         /* default to not changing parameters */
4574         params.use_cts_prot = -1;
4575         params.use_short_preamble = -1;
4576         params.use_short_slot_time = -1;
4577         params.ap_isolate = -1;
4578         params.ht_opmode = -1;
4579         params.p2p_ctwindow = -1;
4580         params.p2p_opp_ps = -1;
4581
4582         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4583                 params.use_cts_prot =
4584                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4585         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4586                 params.use_short_preamble =
4587                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4588         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4589                 params.use_short_slot_time =
4590                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4591         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4592                 params.basic_rates =
4593                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4594                 params.basic_rates_len =
4595                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4596         }
4597         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4598                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4599         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4600                 params.ht_opmode =
4601                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4602
4603         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4604                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4605                         return -EINVAL;
4606                 params.p2p_ctwindow =
4607                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4608                 if (params.p2p_ctwindow < 0)
4609                         return -EINVAL;
4610                 if (params.p2p_ctwindow != 0 &&
4611                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4612                         return -EINVAL;
4613         }
4614
4615         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4616                 u8 tmp;
4617
4618                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4619                         return -EINVAL;
4620                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4621                 if (tmp > 1)
4622                         return -EINVAL;
4623                 params.p2p_opp_ps = tmp;
4624                 if (params.p2p_opp_ps &&
4625                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4626                         return -EINVAL;
4627         }
4628
4629         if (!rdev->ops->change_bss)
4630                 return -EOPNOTSUPP;
4631
4632         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4633             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4634                 return -EOPNOTSUPP;
4635
4636         wdev_lock(wdev);
4637         err = rdev_change_bss(rdev, dev, &params);
4638         wdev_unlock(wdev);
4639
4640         return err;
4641 }
4642
4643 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4644         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4645         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4646         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4647         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4648         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4649         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4650         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
4651 };
4652
4653 static int parse_reg_rule(struct nlattr *tb[],
4654         struct ieee80211_reg_rule *reg_rule)
4655 {
4656         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4657         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4658
4659         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4660                 return -EINVAL;
4661         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4662                 return -EINVAL;
4663         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4664                 return -EINVAL;
4665         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4666                 return -EINVAL;
4667         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4668                 return -EINVAL;
4669
4670         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4671
4672         freq_range->start_freq_khz =
4673                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4674         freq_range->end_freq_khz =
4675                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4676         freq_range->max_bandwidth_khz =
4677                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4678
4679         power_rule->max_eirp =
4680                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4681
4682         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4683                 power_rule->max_antenna_gain =
4684                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4685
4686         if (tb[NL80211_ATTR_DFS_CAC_TIME])
4687                 reg_rule->dfs_cac_ms =
4688                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
4689
4690         return 0;
4691 }
4692
4693 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4694 {
4695         char *data = NULL;
4696         enum nl80211_user_reg_hint_type user_reg_hint_type;
4697
4698         /*
4699          * You should only get this when cfg80211 hasn't yet initialized
4700          * completely when built-in to the kernel right between the time
4701          * window between nl80211_init() and regulatory_init(), if that is
4702          * even possible.
4703          */
4704         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4705                 return -EINPROGRESS;
4706
4707         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4708                 user_reg_hint_type =
4709                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4710         else
4711                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4712
4713         switch (user_reg_hint_type) {
4714         case NL80211_USER_REG_HINT_USER:
4715         case NL80211_USER_REG_HINT_CELL_BASE:
4716                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4717                         return -EINVAL;
4718
4719                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4720                 return regulatory_hint_user(data, user_reg_hint_type);
4721         case NL80211_USER_REG_HINT_INDOOR:
4722                 return regulatory_hint_indoor_user();
4723         default:
4724                 return -EINVAL;
4725         }
4726 }
4727
4728 static int nl80211_get_mesh_config(struct sk_buff *skb,
4729                                    struct genl_info *info)
4730 {
4731         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4732         struct net_device *dev = info->user_ptr[1];
4733         struct wireless_dev *wdev = dev->ieee80211_ptr;
4734         struct mesh_config cur_params;
4735         int err = 0;
4736         void *hdr;
4737         struct nlattr *pinfoattr;
4738         struct sk_buff *msg;
4739
4740         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4741                 return -EOPNOTSUPP;
4742
4743         if (!rdev->ops->get_mesh_config)
4744                 return -EOPNOTSUPP;
4745
4746         wdev_lock(wdev);
4747         /* If not connected, get default parameters */
4748         if (!wdev->mesh_id_len)
4749                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4750         else
4751                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4752         wdev_unlock(wdev);
4753
4754         if (err)
4755                 return err;
4756
4757         /* Draw up a netlink message to send back */
4758         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4759         if (!msg)
4760                 return -ENOMEM;
4761         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4762                              NL80211_CMD_GET_MESH_CONFIG);
4763         if (!hdr)
4764                 goto out;
4765         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4766         if (!pinfoattr)
4767                 goto nla_put_failure;
4768         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4769             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4770                         cur_params.dot11MeshRetryTimeout) ||
4771             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4772                         cur_params.dot11MeshConfirmTimeout) ||
4773             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4774                         cur_params.dot11MeshHoldingTimeout) ||
4775             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4776                         cur_params.dot11MeshMaxPeerLinks) ||
4777             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4778                        cur_params.dot11MeshMaxRetries) ||
4779             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4780                        cur_params.dot11MeshTTL) ||
4781             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4782                        cur_params.element_ttl) ||
4783             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4784                        cur_params.auto_open_plinks) ||
4785             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4786                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4787             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4788                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4789             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4790                         cur_params.path_refresh_time) ||
4791             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4792                         cur_params.min_discovery_timeout) ||
4793             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4794                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4795             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4796                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4797             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4798                         cur_params.dot11MeshHWMPperrMinInterval) ||
4799             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4800                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4801             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4802                        cur_params.dot11MeshHWMPRootMode) ||
4803             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4804                         cur_params.dot11MeshHWMPRannInterval) ||
4805             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4806                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4807             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4808                        cur_params.dot11MeshForwarding) ||
4809             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4810                         cur_params.rssi_threshold) ||
4811             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4812                         cur_params.ht_opmode) ||
4813             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4814                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4815             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4816                         cur_params.dot11MeshHWMProotInterval) ||
4817             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4818                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4819             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4820                         cur_params.power_mode) ||
4821             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4822                         cur_params.dot11MeshAwakeWindowDuration) ||
4823             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4824                         cur_params.plink_timeout))
4825                 goto nla_put_failure;
4826         nla_nest_end(msg, pinfoattr);
4827         genlmsg_end(msg, hdr);
4828         return genlmsg_reply(msg, info);
4829
4830  nla_put_failure:
4831         genlmsg_cancel(msg, hdr);
4832  out:
4833         nlmsg_free(msg);
4834         return -ENOBUFS;
4835 }
4836
4837 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4838         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4839         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4840         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4841         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4842         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4843         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4844         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4845         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4846         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4847         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4848         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4849         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4850         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4851         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4852         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4853         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4854         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4855         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4856         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4857         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4858         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4859         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4860         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4861         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4862         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4863         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4864         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4865         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4866 };
4867
4868 static const struct nla_policy
4869         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4870         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4871         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4872         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4873         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4874         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4875         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4876         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4877                                     .len = IEEE80211_MAX_DATA_LEN },
4878         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4879 };
4880
4881 static int nl80211_parse_mesh_config(struct genl_info *info,
4882                                      struct mesh_config *cfg,
4883                                      u32 *mask_out)
4884 {
4885         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4886         u32 mask = 0;
4887
4888 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4889 do {                                                                        \
4890         if (tb[attr]) {                                                     \
4891                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4892                         return -EINVAL;                                     \
4893                 cfg->param = fn(tb[attr]);                                  \
4894                 mask |= (1 << (attr - 1));                                  \
4895         }                                                                   \
4896 } while (0)
4897
4898
4899         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4900                 return -EINVAL;
4901         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4902                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4903                              nl80211_meshconf_params_policy))
4904                 return -EINVAL;
4905
4906         /* This makes sure that there aren't more than 32 mesh config
4907          * parameters (otherwise our bitfield scheme would not work.) */
4908         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4909
4910         /* Fill in the params struct */
4911         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4912                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4913                                   nla_get_u16);
4914         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4915                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4916                                   nla_get_u16);
4917         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4918                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4919                                   nla_get_u16);
4920         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4921                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4922                                   nla_get_u16);
4923         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4924                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4925                                   nla_get_u8);
4926         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4927                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4928         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4929                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4930                                   nla_get_u8);
4931         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4932                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4933                                   nla_get_u8);
4934         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4935                                   1, 255, mask,
4936                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4937                                   nla_get_u32);
4938         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4939                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4940                                   nla_get_u8);
4941         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4942                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4943                                   nla_get_u32);
4944         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4945                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4946                                   nla_get_u16);
4947         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4948                                   1, 65535, mask,
4949                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4950                                   nla_get_u32);
4951         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4952                                   1, 65535, mask,
4953                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4954                                   nla_get_u16);
4955         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4956                                   1, 65535, mask,
4957                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4958                                   nla_get_u16);
4959         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4960                                   dot11MeshHWMPnetDiameterTraversalTime,
4961                                   1, 65535, mask,
4962                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4963                                   nla_get_u16);
4964         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4965                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4966                                   nla_get_u8);
4967         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4968                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4969                                   nla_get_u16);
4970         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4971                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4972                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4973                                   nla_get_u8);
4974         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4975                                   mask, NL80211_MESHCONF_FORWARDING,
4976                                   nla_get_u8);
4977         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
4978                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4979                                   nla_get_s32);
4980         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4981                                   mask, NL80211_MESHCONF_HT_OPMODE,
4982                                   nla_get_u16);
4983         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4984                                   1, 65535, mask,
4985                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4986                                   nla_get_u32);
4987         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4988                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4989                                   nla_get_u16);
4990         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4991                                   dot11MeshHWMPconfirmationInterval,
4992                                   1, 65535, mask,
4993                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4994                                   nla_get_u16);
4995         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4996                                   NL80211_MESH_POWER_ACTIVE,
4997                                   NL80211_MESH_POWER_MAX,
4998                                   mask, NL80211_MESHCONF_POWER_MODE,
4999                                   nla_get_u32);
5000         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5001                                   0, 65535, mask,
5002                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5003         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
5004                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5005                                   nla_get_u32);
5006         if (mask_out)
5007                 *mask_out = mask;
5008
5009         return 0;
5010
5011 #undef FILL_IN_MESH_PARAM_IF_SET
5012 }
5013
5014 static int nl80211_parse_mesh_setup(struct genl_info *info,
5015                                      struct mesh_setup *setup)
5016 {
5017         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5018         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5019
5020         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5021                 return -EINVAL;
5022         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5023                              info->attrs[NL80211_ATTR_MESH_SETUP],
5024                              nl80211_mesh_setup_params_policy))
5025                 return -EINVAL;
5026
5027         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5028                 setup->sync_method =
5029                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5030                  IEEE80211_SYNC_METHOD_VENDOR :
5031                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5032
5033         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5034                 setup->path_sel_proto =
5035                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5036                  IEEE80211_PATH_PROTOCOL_VENDOR :
5037                  IEEE80211_PATH_PROTOCOL_HWMP;
5038
5039         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5040                 setup->path_metric =
5041                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5042                  IEEE80211_PATH_METRIC_VENDOR :
5043                  IEEE80211_PATH_METRIC_AIRTIME;
5044
5045
5046         if (tb[NL80211_MESH_SETUP_IE]) {
5047                 struct nlattr *ieattr =
5048                         tb[NL80211_MESH_SETUP_IE];
5049                 if (!is_valid_ie_attr(ieattr))
5050                         return -EINVAL;
5051                 setup->ie = nla_data(ieattr);
5052                 setup->ie_len = nla_len(ieattr);
5053         }
5054         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5055             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5056                 return -EINVAL;
5057         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5058         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5059         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5060         if (setup->is_secure)
5061                 setup->user_mpm = true;
5062
5063         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5064                 if (!setup->user_mpm)
5065                         return -EINVAL;
5066                 setup->auth_id =
5067                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5068         }
5069
5070         return 0;
5071 }
5072
5073 static int nl80211_update_mesh_config(struct sk_buff *skb,
5074                                       struct genl_info *info)
5075 {
5076         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5077         struct net_device *dev = info->user_ptr[1];
5078         struct wireless_dev *wdev = dev->ieee80211_ptr;
5079         struct mesh_config cfg;
5080         u32 mask;
5081         int err;
5082
5083         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5084                 return -EOPNOTSUPP;
5085
5086         if (!rdev->ops->update_mesh_config)
5087                 return -EOPNOTSUPP;
5088
5089         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5090         if (err)
5091                 return err;
5092
5093         wdev_lock(wdev);
5094         if (!wdev->mesh_id_len)
5095                 err = -ENOLINK;
5096
5097         if (!err)
5098                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5099
5100         wdev_unlock(wdev);
5101
5102         return err;
5103 }
5104
5105 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
5106 {
5107         const struct ieee80211_regdomain *regdom;
5108         struct sk_buff *msg;
5109         void *hdr = NULL;
5110         struct nlattr *nl_reg_rules;
5111         unsigned int i;
5112
5113         if (!cfg80211_regdomain)
5114                 return -EINVAL;
5115
5116         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5117         if (!msg)
5118                 return -ENOBUFS;
5119
5120         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5121                              NL80211_CMD_GET_REG);
5122         if (!hdr)
5123                 goto put_failure;
5124
5125         if (reg_last_request_cell_base() &&
5126             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5127                         NL80211_USER_REG_HINT_CELL_BASE))
5128                 goto nla_put_failure;
5129
5130         rcu_read_lock();
5131         regdom = rcu_dereference(cfg80211_regdomain);
5132
5133         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5134             (regdom->dfs_region &&
5135              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5136                 goto nla_put_failure_rcu;
5137
5138         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5139         if (!nl_reg_rules)
5140                 goto nla_put_failure_rcu;
5141
5142         for (i = 0; i < regdom->n_reg_rules; i++) {
5143                 struct nlattr *nl_reg_rule;
5144                 const struct ieee80211_reg_rule *reg_rule;
5145                 const struct ieee80211_freq_range *freq_range;
5146                 const struct ieee80211_power_rule *power_rule;
5147                 unsigned int max_bandwidth_khz;
5148
5149                 reg_rule = &regdom->reg_rules[i];
5150                 freq_range = &reg_rule->freq_range;
5151                 power_rule = &reg_rule->power_rule;
5152
5153                 nl_reg_rule = nla_nest_start(msg, i);
5154                 if (!nl_reg_rule)
5155                         goto nla_put_failure_rcu;
5156
5157                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5158                 if (!max_bandwidth_khz)
5159                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5160                                                                   reg_rule);
5161
5162                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5163                                 reg_rule->flags) ||
5164                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5165                                 freq_range->start_freq_khz) ||
5166                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5167                                 freq_range->end_freq_khz) ||
5168                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5169                                 max_bandwidth_khz) ||
5170                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5171                                 power_rule->max_antenna_gain) ||
5172                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5173                                 power_rule->max_eirp) ||
5174                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5175                                 reg_rule->dfs_cac_ms))
5176                         goto nla_put_failure_rcu;
5177
5178                 nla_nest_end(msg, nl_reg_rule);
5179         }
5180         rcu_read_unlock();
5181
5182         nla_nest_end(msg, nl_reg_rules);
5183
5184         genlmsg_end(msg, hdr);
5185         return genlmsg_reply(msg, info);
5186
5187 nla_put_failure_rcu:
5188         rcu_read_unlock();
5189 nla_put_failure:
5190         genlmsg_cancel(msg, hdr);
5191 put_failure:
5192         nlmsg_free(msg);
5193         return -EMSGSIZE;
5194 }
5195
5196 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5197 {
5198         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5199         struct nlattr *nl_reg_rule;
5200         char *alpha2 = NULL;
5201         int rem_reg_rules = 0, r = 0;
5202         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5203         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5204         struct ieee80211_regdomain *rd = NULL;
5205
5206         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5207                 return -EINVAL;
5208
5209         if (!info->attrs[NL80211_ATTR_REG_RULES])
5210                 return -EINVAL;
5211
5212         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5213
5214         if (info->attrs[NL80211_ATTR_DFS_REGION])
5215                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5216
5217         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5218                             rem_reg_rules) {
5219                 num_rules++;
5220                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5221                         return -EINVAL;
5222         }
5223
5224         if (!reg_is_valid_request(alpha2))
5225                 return -EINVAL;
5226
5227         size_of_regd = sizeof(struct ieee80211_regdomain) +
5228                        num_rules * sizeof(struct ieee80211_reg_rule);
5229
5230         rd = kzalloc(size_of_regd, GFP_KERNEL);
5231         if (!rd)
5232                 return -ENOMEM;
5233
5234         rd->n_reg_rules = num_rules;
5235         rd->alpha2[0] = alpha2[0];
5236         rd->alpha2[1] = alpha2[1];
5237
5238         /*
5239          * Disable DFS master mode if the DFS region was
5240          * not supported or known on this kernel.
5241          */
5242         if (reg_supported_dfs_region(dfs_region))
5243                 rd->dfs_region = dfs_region;
5244
5245         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5246                             rem_reg_rules) {
5247                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5248                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5249                               reg_rule_policy);
5250                 if (r)
5251                         goto bad_reg;
5252                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5253                 if (r)
5254                         goto bad_reg;
5255
5256                 rule_idx++;
5257
5258                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5259                         r = -EINVAL;
5260                         goto bad_reg;
5261                 }
5262         }
5263
5264         r = set_regdom(rd);
5265         /* set_regdom took ownership */
5266         rd = NULL;
5267
5268  bad_reg:
5269         kfree(rd);
5270         return r;
5271 }
5272
5273 static int validate_scan_freqs(struct nlattr *freqs)
5274 {
5275         struct nlattr *attr1, *attr2;
5276         int n_channels = 0, tmp1, tmp2;
5277
5278         nla_for_each_nested(attr1, freqs, tmp1) {
5279                 n_channels++;
5280                 /*
5281                  * Some hardware has a limited channel list for
5282                  * scanning, and it is pretty much nonsensical
5283                  * to scan for a channel twice, so disallow that
5284                  * and don't require drivers to check that the
5285                  * channel list they get isn't longer than what
5286                  * they can scan, as long as they can scan all
5287                  * the channels they registered at once.
5288                  */
5289                 nla_for_each_nested(attr2, freqs, tmp2)
5290                         if (attr1 != attr2 &&
5291                             nla_get_u32(attr1) == nla_get_u32(attr2))
5292                                 return 0;
5293         }
5294
5295         return n_channels;
5296 }
5297
5298 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5299 {
5300         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5301         struct wireless_dev *wdev = info->user_ptr[1];
5302         struct cfg80211_scan_request *request;
5303         struct nlattr *attr;
5304         struct wiphy *wiphy;
5305         int err, tmp, n_ssids = 0, n_channels, i;
5306         size_t ie_len;
5307
5308         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5309                 return -EINVAL;
5310
5311         wiphy = &rdev->wiphy;
5312
5313         if (!rdev->ops->scan)
5314                 return -EOPNOTSUPP;
5315
5316         if (rdev->scan_req || rdev->scan_msg) {
5317                 err = -EBUSY;
5318                 goto unlock;
5319         }
5320
5321         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5322                 n_channels = validate_scan_freqs(
5323                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5324                 if (!n_channels) {
5325                         err = -EINVAL;
5326                         goto unlock;
5327                 }
5328         } else {
5329                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5330         }
5331
5332         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5333                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5334                         n_ssids++;
5335
5336         if (n_ssids > wiphy->max_scan_ssids) {
5337                 err = -EINVAL;
5338                 goto unlock;
5339         }
5340
5341         if (info->attrs[NL80211_ATTR_IE])
5342                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5343         else
5344                 ie_len = 0;
5345
5346         if (ie_len > wiphy->max_scan_ie_len) {
5347                 err = -EINVAL;
5348                 goto unlock;
5349         }
5350
5351         request = kzalloc(sizeof(*request)
5352                         + sizeof(*request->ssids) * n_ssids
5353                         + sizeof(*request->channels) * n_channels
5354                         + ie_len, GFP_KERNEL);
5355         if (!request) {
5356                 err = -ENOMEM;
5357                 goto unlock;
5358         }
5359
5360         if (n_ssids)
5361                 request->ssids = (void *)&request->channels[n_channels];
5362         request->n_ssids = n_ssids;
5363         if (ie_len) {
5364                 if (request->ssids)
5365                         request->ie = (void *)(request->ssids + n_ssids);
5366                 else
5367                         request->ie = (void *)(request->channels + n_channels);
5368         }
5369
5370         i = 0;
5371         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5372                 /* user specified, bail out if channel not found */
5373                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5374                         struct ieee80211_channel *chan;
5375
5376                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5377
5378                         if (!chan) {
5379                                 err = -EINVAL;
5380                                 goto out_free;
5381                         }
5382
5383                         /* ignore disabled channels */
5384                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5385                                 continue;
5386
5387                         request->channels[i] = chan;
5388                         i++;
5389                 }
5390         } else {
5391                 enum ieee80211_band band;
5392
5393                 /* all channels */
5394                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5395                         int j;
5396                         if (!wiphy->bands[band])
5397                                 continue;
5398                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5399                                 struct ieee80211_channel *chan;
5400
5401                                 chan = &wiphy->bands[band]->channels[j];
5402
5403                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5404                                         continue;
5405
5406                                 request->channels[i] = chan;
5407                                 i++;
5408                         }
5409                 }
5410         }
5411
5412         if (!i) {
5413                 err = -EINVAL;
5414                 goto out_free;
5415         }
5416
5417         request->n_channels = i;
5418
5419         i = 0;
5420         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5421                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5422                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5423                                 err = -EINVAL;
5424                                 goto out_free;
5425                         }
5426                         request->ssids[i].ssid_len = nla_len(attr);
5427                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5428                         i++;
5429                 }
5430         }
5431
5432         if (info->attrs[NL80211_ATTR_IE]) {
5433                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5434                 memcpy((void *)request->ie,
5435                        nla_data(info->attrs[NL80211_ATTR_IE]),
5436                        request->ie_len);
5437         }
5438
5439         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5440                 if (wiphy->bands[i])
5441                         request->rates[i] =
5442                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5443
5444         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5445                 nla_for_each_nested(attr,
5446                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5447                                     tmp) {
5448                         enum ieee80211_band band = nla_type(attr);
5449
5450                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5451                                 err = -EINVAL;
5452                                 goto out_free;
5453                         }
5454
5455                         if (!wiphy->bands[band])
5456                                 continue;
5457
5458                         err = ieee80211_get_ratemask(wiphy->bands[band],
5459                                                      nla_data(attr),
5460                                                      nla_len(attr),
5461                                                      &request->rates[band]);
5462                         if (err)
5463                                 goto out_free;
5464                 }
5465         }
5466
5467         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5468                 request->flags = nla_get_u32(
5469                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5470                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5471                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5472                         err = -EOPNOTSUPP;
5473                         goto out_free;
5474                 }
5475         }
5476
5477         request->no_cck =
5478                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5479
5480         request->wdev = wdev;
5481         request->wiphy = &rdev->wiphy;
5482         request->scan_start = jiffies;
5483
5484         rdev->scan_req = request;
5485         err = rdev_scan(rdev, request);
5486
5487         if (!err) {
5488                 nl80211_send_scan_start(rdev, wdev);
5489                 if (wdev->netdev)
5490                         dev_hold(wdev->netdev);
5491         } else {
5492  out_free:
5493                 rdev->scan_req = NULL;
5494                 kfree(request);
5495         }
5496
5497  unlock:
5498         return err;
5499 }
5500
5501 static int nl80211_start_sched_scan(struct sk_buff *skb,
5502                                     struct genl_info *info)
5503 {
5504         struct cfg80211_sched_scan_request *request;
5505         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5506         struct net_device *dev = info->user_ptr[1];
5507         struct nlattr *attr;
5508         struct wiphy *wiphy;
5509         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5510         u32 interval;
5511         enum ieee80211_band band;
5512         size_t ie_len;
5513         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5514         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
5515
5516         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5517             !rdev->ops->sched_scan_start)
5518                 return -EOPNOTSUPP;
5519
5520         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5521                 return -EINVAL;
5522
5523         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5524                 return -EINVAL;
5525
5526         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5527         if (interval == 0)
5528                 return -EINVAL;
5529
5530         wiphy = &rdev->wiphy;
5531
5532         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5533                 n_channels = validate_scan_freqs(
5534                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5535                 if (!n_channels)
5536                         return -EINVAL;
5537         } else {
5538                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5539         }
5540
5541         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5542                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5543                                     tmp)
5544                         n_ssids++;
5545
5546         if (n_ssids > wiphy->max_sched_scan_ssids)
5547                 return -EINVAL;
5548
5549         /*
5550          * First, count the number of 'real' matchsets. Due to an issue with
5551          * the old implementation, matchsets containing only the RSSI attribute
5552          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
5553          * RSSI for all matchsets, rather than their own matchset for reporting
5554          * all APs with a strong RSSI. This is needed to be compatible with
5555          * older userspace that treated a matchset with only the RSSI as the
5556          * global RSSI for all other matchsets - if there are other matchsets.
5557          */
5558         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5559                 nla_for_each_nested(attr,
5560                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5561                                     tmp) {
5562                         struct nlattr *rssi;
5563
5564                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5565                                         nla_data(attr), nla_len(attr),
5566                                         nl80211_match_policy);
5567                         if (err)
5568                                 return err;
5569                         /* add other standalone attributes here */
5570                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
5571                                 n_match_sets++;
5572                                 continue;
5573                         }
5574                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5575                         if (rssi)
5576                                 default_match_rssi = nla_get_s32(rssi);
5577                 }
5578         }
5579
5580         /* However, if there's no other matchset, add the RSSI one */
5581         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
5582                 n_match_sets = 1;
5583
5584         if (n_match_sets > wiphy->max_match_sets)
5585                 return -EINVAL;
5586
5587         if (info->attrs[NL80211_ATTR_IE])
5588                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5589         else
5590                 ie_len = 0;
5591
5592         if (ie_len > wiphy->max_sched_scan_ie_len)
5593                 return -EINVAL;
5594
5595         if (rdev->sched_scan_req) {
5596                 err = -EINPROGRESS;
5597                 goto out;
5598         }
5599
5600         request = kzalloc(sizeof(*request)
5601                         + sizeof(*request->ssids) * n_ssids
5602                         + sizeof(*request->match_sets) * n_match_sets
5603                         + sizeof(*request->channels) * n_channels
5604                         + ie_len, GFP_KERNEL);
5605         if (!request) {
5606                 err = -ENOMEM;
5607                 goto out;
5608         }
5609
5610         if (n_ssids)
5611                 request->ssids = (void *)&request->channels[n_channels];
5612         request->n_ssids = n_ssids;
5613         if (ie_len) {
5614                 if (request->ssids)
5615                         request->ie = (void *)(request->ssids + n_ssids);
5616                 else
5617                         request->ie = (void *)(request->channels + n_channels);
5618         }
5619
5620         if (n_match_sets) {
5621                 if (request->ie)
5622                         request->match_sets = (void *)(request->ie + ie_len);
5623                 else if (request->ssids)
5624                         request->match_sets =
5625                                 (void *)(request->ssids + n_ssids);
5626                 else
5627                         request->match_sets =
5628                                 (void *)(request->channels + n_channels);
5629         }
5630         request->n_match_sets = n_match_sets;
5631
5632         i = 0;
5633         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5634                 /* user specified, bail out if channel not found */
5635                 nla_for_each_nested(attr,
5636                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5637                                     tmp) {
5638                         struct ieee80211_channel *chan;
5639
5640                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5641
5642                         if (!chan) {
5643                                 err = -EINVAL;
5644                                 goto out_free;
5645                         }
5646
5647                         /* ignore disabled channels */
5648                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5649                                 continue;
5650
5651                         request->channels[i] = chan;
5652                         i++;
5653                 }
5654         } else {
5655                 /* all channels */
5656                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5657                         int j;
5658                         if (!wiphy->bands[band])
5659                                 continue;
5660                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5661                                 struct ieee80211_channel *chan;
5662
5663                                 chan = &wiphy->bands[band]->channels[j];
5664
5665                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5666                                         continue;
5667
5668                                 request->channels[i] = chan;
5669                                 i++;
5670                         }
5671                 }
5672         }
5673
5674         if (!i) {
5675                 err = -EINVAL;
5676                 goto out_free;
5677         }
5678
5679         request->n_channels = i;
5680
5681         i = 0;
5682         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5683                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5684                                     tmp) {
5685                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5686                                 err = -EINVAL;
5687                                 goto out_free;
5688                         }
5689                         request->ssids[i].ssid_len = nla_len(attr);
5690                         memcpy(request->ssids[i].ssid, nla_data(attr),
5691                                nla_len(attr));
5692                         i++;
5693                 }
5694         }
5695
5696         i = 0;
5697         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5698                 nla_for_each_nested(attr,
5699                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5700                                     tmp) {
5701                         struct nlattr *ssid, *rssi;
5702
5703                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5704                                         nla_data(attr), nla_len(attr),
5705                                         nl80211_match_policy);
5706                         if (err)
5707                                 goto out_free;
5708                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5709                         if (ssid) {
5710                                 if (WARN_ON(i >= n_match_sets)) {
5711                                         /* this indicates a programming error,
5712                                          * the loop above should have verified
5713                                          * things properly
5714                                          */
5715                                         err = -EINVAL;
5716                                         goto out_free;
5717                                 }
5718
5719                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5720                                         err = -EINVAL;
5721                                         goto out_free;
5722                                 }
5723                                 memcpy(request->match_sets[i].ssid.ssid,
5724                                        nla_data(ssid), nla_len(ssid));
5725                                 request->match_sets[i].ssid.ssid_len =
5726                                         nla_len(ssid);
5727                                 /* special attribute - old implemenation w/a */
5728                                 request->match_sets[i].rssi_thold =
5729                                         default_match_rssi;
5730                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5731                                 if (rssi)
5732                                         request->match_sets[i].rssi_thold =
5733                                                 nla_get_s32(rssi);
5734                         }
5735                         i++;
5736                 }
5737
5738                 /* there was no other matchset, so the RSSI one is alone */
5739                 if (i == 0)
5740                         request->match_sets[0].rssi_thold = default_match_rssi;
5741
5742                 request->min_rssi_thold = INT_MAX;
5743                 for (i = 0; i < n_match_sets; i++)
5744                         request->min_rssi_thold =
5745                                 min(request->match_sets[i].rssi_thold,
5746                                     request->min_rssi_thold);
5747         } else {
5748                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
5749         }
5750
5751         if (ie_len) {
5752                 request->ie_len = ie_len;
5753                 memcpy((void *)request->ie,
5754                        nla_data(info->attrs[NL80211_ATTR_IE]),
5755                        request->ie_len);
5756         }
5757
5758         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5759                 request->flags = nla_get_u32(
5760                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5761                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5762                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5763                         err = -EOPNOTSUPP;
5764                         goto out_free;
5765                 }
5766         }
5767
5768         request->dev = dev;
5769         request->wiphy = &rdev->wiphy;
5770         request->interval = interval;
5771         request->scan_start = jiffies;
5772
5773         err = rdev_sched_scan_start(rdev, dev, request);
5774         if (!err) {
5775                 rdev->sched_scan_req = request;
5776                 nl80211_send_sched_scan(rdev, dev,
5777                                         NL80211_CMD_START_SCHED_SCAN);
5778                 goto out;
5779         }
5780
5781 out_free:
5782         kfree(request);
5783 out:
5784         return err;
5785 }
5786
5787 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5788                                    struct genl_info *info)
5789 {
5790         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5791
5792         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5793             !rdev->ops->sched_scan_stop)
5794                 return -EOPNOTSUPP;
5795
5796         return __cfg80211_stop_sched_scan(rdev, false);
5797 }
5798
5799 static int nl80211_start_radar_detection(struct sk_buff *skb,
5800                                          struct genl_info *info)
5801 {
5802         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5803         struct net_device *dev = info->user_ptr[1];
5804         struct wireless_dev *wdev = dev->ieee80211_ptr;
5805         struct cfg80211_chan_def chandef;
5806         enum nl80211_dfs_regions dfs_region;
5807         unsigned int cac_time_ms;
5808         int err;
5809
5810         dfs_region = reg_get_dfs_region(wdev->wiphy);
5811         if (dfs_region == NL80211_DFS_UNSET)
5812                 return -EINVAL;
5813
5814         err = nl80211_parse_chandef(rdev, info, &chandef);
5815         if (err)
5816                 return err;
5817
5818         if (netif_carrier_ok(dev))
5819                 return -EBUSY;
5820
5821         if (wdev->cac_started)
5822                 return -EBUSY;
5823
5824         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
5825                                             NL80211_IFTYPE_UNSPECIFIED);
5826         if (err < 0)
5827                 return err;
5828
5829         if (err == 0)
5830                 return -EINVAL;
5831
5832         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
5833                 return -EINVAL;
5834
5835         if (!rdev->ops->start_radar_detection)
5836                 return -EOPNOTSUPP;
5837
5838         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
5839         if (WARN_ON(!cac_time_ms))
5840                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
5841
5842         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
5843                                                cac_time_ms);
5844         if (!err) {
5845                 wdev->chandef = chandef;
5846                 wdev->cac_started = true;
5847                 wdev->cac_start_time = jiffies;
5848                 wdev->cac_time_ms = cac_time_ms;
5849         }
5850         return err;
5851 }
5852
5853 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
5854 {
5855         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5856         struct net_device *dev = info->user_ptr[1];
5857         struct wireless_dev *wdev = dev->ieee80211_ptr;
5858         struct cfg80211_csa_settings params;
5859         /* csa_attrs is defined static to avoid waste of stack size - this
5860          * function is called under RTNL lock, so this should not be a problem.
5861          */
5862         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
5863         u8 radar_detect_width = 0;
5864         int err;
5865         bool need_new_beacon = false;
5866
5867         if (!rdev->ops->channel_switch ||
5868             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
5869                 return -EOPNOTSUPP;
5870
5871         switch (dev->ieee80211_ptr->iftype) {
5872         case NL80211_IFTYPE_AP:
5873         case NL80211_IFTYPE_P2P_GO:
5874                 need_new_beacon = true;
5875
5876                 /* useless if AP is not running */
5877                 if (!wdev->beacon_interval)
5878                         return -ENOTCONN;
5879                 break;
5880         case NL80211_IFTYPE_ADHOC:
5881                 if (!wdev->ssid_len)
5882                         return -ENOTCONN;
5883                 break;
5884         case NL80211_IFTYPE_MESH_POINT:
5885                 if (!wdev->mesh_id_len)
5886                         return -ENOTCONN;
5887                 break;
5888         default:
5889                 return -EOPNOTSUPP;
5890         }
5891
5892         memset(&params, 0, sizeof(params));
5893
5894         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5895             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
5896                 return -EINVAL;
5897
5898         /* only important for AP, IBSS and mesh create IEs internally */
5899         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
5900                 return -EINVAL;
5901
5902         params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
5903
5904         if (!need_new_beacon)
5905                 goto skip_beacons;
5906
5907         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
5908         if (err)
5909                 return err;
5910
5911         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
5912                                info->attrs[NL80211_ATTR_CSA_IES],
5913                                nl80211_policy);
5914         if (err)
5915                 return err;
5916
5917         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
5918         if (err)
5919                 return err;
5920
5921         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
5922                 return -EINVAL;
5923
5924         params.counter_offset_beacon =
5925                 nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
5926         if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
5927                 return -EINVAL;
5928
5929         /* sanity check - counters should be the same */
5930         if (params.beacon_csa.tail[params.counter_offset_beacon] !=
5931             params.count)
5932                 return -EINVAL;
5933
5934         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
5935                 params.counter_offset_presp =
5936                         nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
5937                 if (params.counter_offset_presp >=
5938                     params.beacon_csa.probe_resp_len)
5939                         return -EINVAL;
5940
5941                 if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
5942                     params.count)
5943                         return -EINVAL;
5944         }
5945
5946 skip_beacons:
5947         err = nl80211_parse_chandef(rdev, info, &params.chandef);
5948         if (err)
5949                 return err;
5950
5951         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
5952                                      wdev->iftype))
5953                 return -EINVAL;
5954
5955         err = cfg80211_chandef_dfs_required(wdev->wiphy,
5956                                             &params.chandef,
5957                                             wdev->iftype);
5958         if (err < 0)
5959                 return err;
5960
5961         if (err > 0) {
5962                 radar_detect_width = BIT(params.chandef.width);
5963                 params.radar_required = true;
5964         }
5965
5966         /* TODO: I left this here for now.  With channel switch, the
5967          * verification is a bit more complicated, because we only do
5968          * it later when the channel switch really happens.
5969          */
5970         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5971                                            params.chandef.chan,
5972                                            CHAN_MODE_SHARED,
5973                                            radar_detect_width);
5974         if (err)
5975                 return err;
5976
5977         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
5978                 params.block_tx = true;
5979
5980         wdev_lock(wdev);
5981         err = rdev_channel_switch(rdev, dev, &params);
5982         wdev_unlock(wdev);
5983
5984         return err;
5985 }
5986
5987 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5988                             u32 seq, int flags,
5989                             struct cfg80211_registered_device *rdev,
5990                             struct wireless_dev *wdev,
5991                             struct cfg80211_internal_bss *intbss)
5992 {
5993         struct cfg80211_bss *res = &intbss->pub;
5994         const struct cfg80211_bss_ies *ies;
5995         void *hdr;
5996         struct nlattr *bss;
5997         bool tsf = false;
5998
5999         ASSERT_WDEV_LOCK(wdev);
6000
6001         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6002                              NL80211_CMD_NEW_SCAN_RESULTS);
6003         if (!hdr)
6004                 return -1;
6005
6006         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6007
6008         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6009                 goto nla_put_failure;
6010         if (wdev->netdev &&
6011             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6012                 goto nla_put_failure;
6013         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
6014                 goto nla_put_failure;
6015
6016         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6017         if (!bss)
6018                 goto nla_put_failure;
6019         if ((!is_zero_ether_addr(res->bssid) &&
6020              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6021                 goto nla_put_failure;
6022
6023         rcu_read_lock();
6024         ies = rcu_dereference(res->ies);
6025         if (ies) {
6026                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6027                         goto fail_unlock_rcu;
6028                 tsf = true;
6029                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6030                                         ies->len, ies->data))
6031                         goto fail_unlock_rcu;
6032         }
6033         ies = rcu_dereference(res->beacon_ies);
6034         if (ies) {
6035                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6036                         goto fail_unlock_rcu;
6037                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6038                                         ies->len, ies->data))
6039                         goto fail_unlock_rcu;
6040         }
6041         rcu_read_unlock();
6042
6043         if (res->beacon_interval &&
6044             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6045                 goto nla_put_failure;
6046         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6047             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6048             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6049             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6050                         jiffies_to_msecs(jiffies - intbss->ts)))
6051                 goto nla_put_failure;
6052
6053         switch (rdev->wiphy.signal_type) {
6054         case CFG80211_SIGNAL_TYPE_MBM:
6055                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6056                         goto nla_put_failure;
6057                 break;
6058         case CFG80211_SIGNAL_TYPE_UNSPEC:
6059                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6060                         goto nla_put_failure;
6061                 break;
6062         default:
6063                 break;
6064         }
6065
6066         switch (wdev->iftype) {
6067         case NL80211_IFTYPE_P2P_CLIENT:
6068         case NL80211_IFTYPE_STATION:
6069                 if (intbss == wdev->current_bss &&
6070                     nla_put_u32(msg, NL80211_BSS_STATUS,
6071                                 NL80211_BSS_STATUS_ASSOCIATED))
6072                         goto nla_put_failure;
6073                 break;
6074         case NL80211_IFTYPE_ADHOC:
6075                 if (intbss == wdev->current_bss &&
6076                     nla_put_u32(msg, NL80211_BSS_STATUS,
6077                                 NL80211_BSS_STATUS_IBSS_JOINED))
6078                         goto nla_put_failure;
6079                 break;
6080         default:
6081                 break;
6082         }
6083
6084         nla_nest_end(msg, bss);
6085
6086         return genlmsg_end(msg, hdr);
6087
6088  fail_unlock_rcu:
6089         rcu_read_unlock();
6090  nla_put_failure:
6091         genlmsg_cancel(msg, hdr);
6092         return -EMSGSIZE;
6093 }
6094
6095 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6096 {
6097         struct cfg80211_registered_device *rdev;
6098         struct cfg80211_internal_bss *scan;
6099         struct wireless_dev *wdev;
6100         int start = cb->args[2], idx = 0;
6101         int err;
6102
6103         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6104         if (err)
6105                 return err;
6106
6107         wdev_lock(wdev);
6108         spin_lock_bh(&rdev->bss_lock);
6109         cfg80211_bss_expire(rdev);
6110
6111         cb->seq = rdev->bss_generation;
6112
6113         list_for_each_entry(scan, &rdev->bss_list, list) {
6114                 if (++idx <= start)
6115                         continue;
6116                 if (nl80211_send_bss(skb, cb,
6117                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6118                                 rdev, wdev, scan) < 0) {
6119                         idx--;
6120                         break;
6121                 }
6122         }
6123
6124         spin_unlock_bh(&rdev->bss_lock);
6125         wdev_unlock(wdev);
6126
6127         cb->args[2] = idx;
6128         nl80211_finish_wdev_dump(rdev);
6129
6130         return skb->len;
6131 }
6132
6133 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6134                                 int flags, struct net_device *dev,
6135                                 struct survey_info *survey)
6136 {
6137         void *hdr;
6138         struct nlattr *infoattr;
6139
6140         hdr = nl80211hdr_put(msg, portid, seq, flags,
6141                              NL80211_CMD_NEW_SURVEY_RESULTS);
6142         if (!hdr)
6143                 return -ENOMEM;
6144
6145         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6146                 goto nla_put_failure;
6147
6148         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6149         if (!infoattr)
6150                 goto nla_put_failure;
6151
6152         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6153                         survey->channel->center_freq))
6154                 goto nla_put_failure;
6155
6156         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6157             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6158                 goto nla_put_failure;
6159         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6160             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6161                 goto nla_put_failure;
6162         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
6163             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
6164                         survey->channel_time))
6165                 goto nla_put_failure;
6166         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
6167             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
6168                         survey->channel_time_busy))
6169                 goto nla_put_failure;
6170         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
6171             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
6172                         survey->channel_time_ext_busy))
6173                 goto nla_put_failure;
6174         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
6175             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
6176                         survey->channel_time_rx))
6177                 goto nla_put_failure;
6178         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
6179             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
6180                         survey->channel_time_tx))
6181                 goto nla_put_failure;
6182
6183         nla_nest_end(msg, infoattr);
6184
6185         return genlmsg_end(msg, hdr);
6186
6187  nla_put_failure:
6188         genlmsg_cancel(msg, hdr);
6189         return -EMSGSIZE;
6190 }
6191
6192 static int nl80211_dump_survey(struct sk_buff *skb,
6193                         struct netlink_callback *cb)
6194 {
6195         struct survey_info survey;
6196         struct cfg80211_registered_device *rdev;
6197         struct wireless_dev *wdev;
6198         int survey_idx = cb->args[2];
6199         int res;
6200
6201         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6202         if (res)
6203                 return res;
6204
6205         if (!wdev->netdev) {
6206                 res = -EINVAL;
6207                 goto out_err;
6208         }
6209
6210         if (!rdev->ops->dump_survey) {
6211                 res = -EOPNOTSUPP;
6212                 goto out_err;
6213         }
6214
6215         while (1) {
6216                 struct ieee80211_channel *chan;
6217
6218                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6219                 if (res == -ENOENT)
6220                         break;
6221                 if (res)
6222                         goto out_err;
6223
6224                 /* Survey without a channel doesn't make sense */
6225                 if (!survey.channel) {
6226                         res = -EINVAL;
6227                         goto out;
6228                 }
6229
6230                 chan = ieee80211_get_channel(&rdev->wiphy,
6231                                              survey.channel->center_freq);
6232                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
6233                         survey_idx++;
6234                         continue;
6235                 }
6236
6237                 if (nl80211_send_survey(skb,
6238                                 NETLINK_CB(cb->skb).portid,
6239                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6240                                 wdev->netdev, &survey) < 0)
6241                         goto out;
6242                 survey_idx++;
6243         }
6244
6245  out:
6246         cb->args[2] = survey_idx;
6247         res = skb->len;
6248  out_err:
6249         nl80211_finish_wdev_dump(rdev);
6250         return res;
6251 }
6252
6253 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6254 {
6255         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6256                                   NL80211_WPA_VERSION_2));
6257 }
6258
6259 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6260 {
6261         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6262         struct net_device *dev = info->user_ptr[1];
6263         struct ieee80211_channel *chan;
6264         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6265         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6266         enum nl80211_auth_type auth_type;
6267         struct key_parse key;
6268         bool local_state_change;
6269
6270         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6271                 return -EINVAL;
6272
6273         if (!info->attrs[NL80211_ATTR_MAC])
6274                 return -EINVAL;
6275
6276         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6277                 return -EINVAL;
6278
6279         if (!info->attrs[NL80211_ATTR_SSID])
6280                 return -EINVAL;
6281
6282         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6283                 return -EINVAL;
6284
6285         err = nl80211_parse_key(info, &key);
6286         if (err)
6287                 return err;
6288
6289         if (key.idx >= 0) {
6290                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6291                         return -EINVAL;
6292                 if (!key.p.key || !key.p.key_len)
6293                         return -EINVAL;
6294                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6295                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6296                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6297                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6298                         return -EINVAL;
6299                 if (key.idx > 4)
6300                         return -EINVAL;
6301         } else {
6302                 key.p.key_len = 0;
6303                 key.p.key = NULL;
6304         }
6305
6306         if (key.idx >= 0) {
6307                 int i;
6308                 bool ok = false;
6309                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6310                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6311                                 ok = true;
6312                                 break;
6313                         }
6314                 }
6315                 if (!ok)
6316                         return -EINVAL;
6317         }
6318
6319         if (!rdev->ops->auth)
6320                 return -EOPNOTSUPP;
6321
6322         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6323             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6324                 return -EOPNOTSUPP;
6325
6326         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6327         chan = nl80211_get_valid_chan(&rdev->wiphy,
6328                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6329         if (!chan)
6330                 return -EINVAL;
6331
6332         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6333         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6334
6335         if (info->attrs[NL80211_ATTR_IE]) {
6336                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6337                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6338         }
6339
6340         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6341         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6342                 return -EINVAL;
6343
6344         if (auth_type == NL80211_AUTHTYPE_SAE &&
6345             !info->attrs[NL80211_ATTR_SAE_DATA])
6346                 return -EINVAL;
6347
6348         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6349                 if (auth_type != NL80211_AUTHTYPE_SAE)
6350                         return -EINVAL;
6351                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6352                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6353                 /* need to include at least Auth Transaction and Status Code */
6354                 if (sae_data_len < 4)
6355                         return -EINVAL;
6356         }
6357
6358         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6359
6360         /*
6361          * Since we no longer track auth state, ignore
6362          * requests to only change local state.
6363          */
6364         if (local_state_change)
6365                 return 0;
6366
6367         wdev_lock(dev->ieee80211_ptr);
6368         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6369                                  ssid, ssid_len, ie, ie_len,
6370                                  key.p.key, key.p.key_len, key.idx,
6371                                  sae_data, sae_data_len);
6372         wdev_unlock(dev->ieee80211_ptr);
6373         return err;
6374 }
6375
6376 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6377                                    struct genl_info *info,
6378                                    struct cfg80211_crypto_settings *settings,
6379                                    int cipher_limit)
6380 {
6381         memset(settings, 0, sizeof(*settings));
6382
6383         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6384
6385         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6386                 u16 proto;
6387                 proto = nla_get_u16(
6388                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6389                 settings->control_port_ethertype = cpu_to_be16(proto);
6390                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6391                     proto != ETH_P_PAE)
6392                         return -EINVAL;
6393                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6394                         settings->control_port_no_encrypt = true;
6395         } else
6396                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6397
6398         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6399                 void *data;
6400                 int len, i;
6401
6402                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6403                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6404                 settings->n_ciphers_pairwise = len / sizeof(u32);
6405
6406                 if (len % sizeof(u32))
6407                         return -EINVAL;
6408
6409                 if (settings->n_ciphers_pairwise > cipher_limit)
6410                         return -EINVAL;
6411
6412                 memcpy(settings->ciphers_pairwise, data, len);
6413
6414                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6415                         if (!cfg80211_supported_cipher_suite(
6416                                         &rdev->wiphy,
6417                                         settings->ciphers_pairwise[i]))
6418                                 return -EINVAL;
6419         }
6420
6421         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6422                 settings->cipher_group =
6423                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6424                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6425                                                      settings->cipher_group))
6426                         return -EINVAL;
6427         }
6428
6429         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6430                 settings->wpa_versions =
6431                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6432                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6433                         return -EINVAL;
6434         }
6435
6436         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6437                 void *data;
6438                 int len;
6439
6440                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6441                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6442                 settings->n_akm_suites = len / sizeof(u32);
6443
6444                 if (len % sizeof(u32))
6445                         return -EINVAL;
6446
6447                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6448                         return -EINVAL;
6449
6450                 memcpy(settings->akm_suites, data, len);
6451         }
6452
6453         return 0;
6454 }
6455
6456 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6457 {
6458         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6459         struct net_device *dev = info->user_ptr[1];
6460         struct ieee80211_channel *chan;
6461         struct cfg80211_assoc_request req = {};
6462         const u8 *bssid, *ssid;
6463         int err, ssid_len = 0;
6464
6465         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6466                 return -EINVAL;
6467
6468         if (!info->attrs[NL80211_ATTR_MAC] ||
6469             !info->attrs[NL80211_ATTR_SSID] ||
6470             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6471                 return -EINVAL;
6472
6473         if (!rdev->ops->assoc)
6474                 return -EOPNOTSUPP;
6475
6476         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6477             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6478                 return -EOPNOTSUPP;
6479
6480         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6481
6482         chan = nl80211_get_valid_chan(&rdev->wiphy,
6483                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6484         if (!chan)
6485                 return -EINVAL;
6486
6487         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6488         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6489
6490         if (info->attrs[NL80211_ATTR_IE]) {
6491                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6492                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6493         }
6494
6495         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6496                 enum nl80211_mfp mfp =
6497                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6498                 if (mfp == NL80211_MFP_REQUIRED)
6499                         req.use_mfp = true;
6500                 else if (mfp != NL80211_MFP_NO)
6501                         return -EINVAL;
6502         }
6503
6504         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6505                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6506
6507         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6508                 req.flags |= ASSOC_REQ_DISABLE_HT;
6509
6510         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6511                 memcpy(&req.ht_capa_mask,
6512                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6513                        sizeof(req.ht_capa_mask));
6514
6515         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6516                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6517                         return -EINVAL;
6518                 memcpy(&req.ht_capa,
6519                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6520                        sizeof(req.ht_capa));
6521         }
6522
6523         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6524                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6525
6526         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6527                 memcpy(&req.vht_capa_mask,
6528                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6529                        sizeof(req.vht_capa_mask));
6530
6531         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6532                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6533                         return -EINVAL;
6534                 memcpy(&req.vht_capa,
6535                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6536                        sizeof(req.vht_capa));
6537         }
6538
6539         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6540         if (!err) {
6541                 wdev_lock(dev->ieee80211_ptr);
6542                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6543                                           ssid, ssid_len, &req);
6544                 wdev_unlock(dev->ieee80211_ptr);
6545         }
6546
6547         return err;
6548 }
6549
6550 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6551 {
6552         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6553         struct net_device *dev = info->user_ptr[1];
6554         const u8 *ie = NULL, *bssid;
6555         int ie_len = 0, err;
6556         u16 reason_code;
6557         bool local_state_change;
6558
6559         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6560                 return -EINVAL;
6561
6562         if (!info->attrs[NL80211_ATTR_MAC])
6563                 return -EINVAL;
6564
6565         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6566                 return -EINVAL;
6567
6568         if (!rdev->ops->deauth)
6569                 return -EOPNOTSUPP;
6570
6571         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6572             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6573                 return -EOPNOTSUPP;
6574
6575         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6576
6577         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6578         if (reason_code == 0) {
6579                 /* Reason Code 0 is reserved */
6580                 return -EINVAL;
6581         }
6582
6583         if (info->attrs[NL80211_ATTR_IE]) {
6584                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6585                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6586         }
6587
6588         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6589
6590         wdev_lock(dev->ieee80211_ptr);
6591         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6592                                    local_state_change);
6593         wdev_unlock(dev->ieee80211_ptr);
6594         return err;
6595 }
6596
6597 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6598 {
6599         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6600         struct net_device *dev = info->user_ptr[1];
6601         const u8 *ie = NULL, *bssid;
6602         int ie_len = 0, err;
6603         u16 reason_code;
6604         bool local_state_change;
6605
6606         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6607                 return -EINVAL;
6608
6609         if (!info->attrs[NL80211_ATTR_MAC])
6610                 return -EINVAL;
6611
6612         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6613                 return -EINVAL;
6614
6615         if (!rdev->ops->disassoc)
6616                 return -EOPNOTSUPP;
6617
6618         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6619             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6620                 return -EOPNOTSUPP;
6621
6622         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6623
6624         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6625         if (reason_code == 0) {
6626                 /* Reason Code 0 is reserved */
6627                 return -EINVAL;
6628         }
6629
6630         if (info->attrs[NL80211_ATTR_IE]) {
6631                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6632                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6633         }
6634
6635         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6636
6637         wdev_lock(dev->ieee80211_ptr);
6638         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6639                                      local_state_change);
6640         wdev_unlock(dev->ieee80211_ptr);
6641         return err;
6642 }
6643
6644 static bool
6645 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6646                          int mcast_rate[IEEE80211_NUM_BANDS],
6647                          int rateval)
6648 {
6649         struct wiphy *wiphy = &rdev->wiphy;
6650         bool found = false;
6651         int band, i;
6652
6653         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6654                 struct ieee80211_supported_band *sband;
6655
6656                 sband = wiphy->bands[band];
6657                 if (!sband)
6658                         continue;
6659
6660                 for (i = 0; i < sband->n_bitrates; i++) {
6661                         if (sband->bitrates[i].bitrate == rateval) {
6662                                 mcast_rate[band] = i + 1;
6663                                 found = true;
6664                                 break;
6665                         }
6666                 }
6667         }
6668
6669         return found;
6670 }
6671
6672 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6673 {
6674         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6675         struct net_device *dev = info->user_ptr[1];
6676         struct cfg80211_ibss_params ibss;
6677         struct wiphy *wiphy;
6678         struct cfg80211_cached_keys *connkeys = NULL;
6679         int err;
6680
6681         memset(&ibss, 0, sizeof(ibss));
6682
6683         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6684                 return -EINVAL;
6685
6686         if (!info->attrs[NL80211_ATTR_SSID] ||
6687             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6688                 return -EINVAL;
6689
6690         ibss.beacon_interval = 100;
6691
6692         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6693                 ibss.beacon_interval =
6694                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6695                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6696                         return -EINVAL;
6697         }
6698
6699         if (!rdev->ops->join_ibss)
6700                 return -EOPNOTSUPP;
6701
6702         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6703                 return -EOPNOTSUPP;
6704
6705         wiphy = &rdev->wiphy;
6706
6707         if (info->attrs[NL80211_ATTR_MAC]) {
6708                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6709
6710                 if (!is_valid_ether_addr(ibss.bssid))
6711                         return -EINVAL;
6712         }
6713         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6714         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6715
6716         if (info->attrs[NL80211_ATTR_IE]) {
6717                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6718                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6719         }
6720
6721         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6722         if (err)
6723                 return err;
6724
6725         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
6726                                      NL80211_IFTYPE_ADHOC))
6727                 return -EINVAL;
6728
6729         switch (ibss.chandef.width) {
6730         case NL80211_CHAN_WIDTH_5:
6731         case NL80211_CHAN_WIDTH_10:
6732         case NL80211_CHAN_WIDTH_20_NOHT:
6733                 break;
6734         case NL80211_CHAN_WIDTH_20:
6735         case NL80211_CHAN_WIDTH_40:
6736                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6737                         break;
6738         default:
6739                 return -EINVAL;
6740         }
6741
6742         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6743         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6744
6745         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6746                 u8 *rates =
6747                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6748                 int n_rates =
6749                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6750                 struct ieee80211_supported_band *sband =
6751                         wiphy->bands[ibss.chandef.chan->band];
6752
6753                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6754                                              &ibss.basic_rates);
6755                 if (err)
6756                         return err;
6757         }
6758
6759         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6760                 memcpy(&ibss.ht_capa_mask,
6761                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6762                        sizeof(ibss.ht_capa_mask));
6763
6764         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6765                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6766                         return -EINVAL;
6767                 memcpy(&ibss.ht_capa,
6768                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6769                        sizeof(ibss.ht_capa));
6770         }
6771
6772         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6773             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6774                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6775                 return -EINVAL;
6776
6777         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6778                 bool no_ht = false;
6779
6780                 connkeys = nl80211_parse_connkeys(rdev,
6781                                           info->attrs[NL80211_ATTR_KEYS],
6782                                           &no_ht);
6783                 if (IS_ERR(connkeys))
6784                         return PTR_ERR(connkeys);
6785
6786                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6787                     no_ht) {
6788                         kfree(connkeys);
6789                         return -EINVAL;
6790                 }
6791         }
6792
6793         ibss.control_port =
6794                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6795
6796         ibss.userspace_handles_dfs =
6797                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
6798
6799         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6800         if (err)
6801                 kfree(connkeys);
6802         return err;
6803 }
6804
6805 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6806 {
6807         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6808         struct net_device *dev = info->user_ptr[1];
6809
6810         if (!rdev->ops->leave_ibss)
6811                 return -EOPNOTSUPP;
6812
6813         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6814                 return -EOPNOTSUPP;
6815
6816         return cfg80211_leave_ibss(rdev, dev, false);
6817 }
6818
6819 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6820 {
6821         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6822         struct net_device *dev = info->user_ptr[1];
6823         int mcast_rate[IEEE80211_NUM_BANDS];
6824         u32 nla_rate;
6825         int err;
6826
6827         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6828             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6829                 return -EOPNOTSUPP;
6830
6831         if (!rdev->ops->set_mcast_rate)
6832                 return -EOPNOTSUPP;
6833
6834         memset(mcast_rate, 0, sizeof(mcast_rate));
6835
6836         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6837                 return -EINVAL;
6838
6839         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6840         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6841                 return -EINVAL;
6842
6843         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6844
6845         return err;
6846 }
6847
6848 static struct sk_buff *
6849 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
6850                             int approxlen, u32 portid, u32 seq,
6851                             enum nl80211_commands cmd,
6852                             enum nl80211_attrs attr,
6853                             const struct nl80211_vendor_cmd_info *info,
6854                             gfp_t gfp)
6855 {
6856         struct sk_buff *skb;
6857         void *hdr;
6858         struct nlattr *data;
6859
6860         skb = nlmsg_new(approxlen + 100, gfp);
6861         if (!skb)
6862                 return NULL;
6863
6864         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
6865         if (!hdr) {
6866                 kfree_skb(skb);
6867                 return NULL;
6868         }
6869
6870         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6871                 goto nla_put_failure;
6872
6873         if (info) {
6874                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
6875                                 info->vendor_id))
6876                         goto nla_put_failure;
6877                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
6878                                 info->subcmd))
6879                         goto nla_put_failure;
6880         }
6881
6882         data = nla_nest_start(skb, attr);
6883
6884         ((void **)skb->cb)[0] = rdev;
6885         ((void **)skb->cb)[1] = hdr;
6886         ((void **)skb->cb)[2] = data;
6887
6888         return skb;
6889
6890  nla_put_failure:
6891         kfree_skb(skb);
6892         return NULL;
6893 }
6894
6895 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
6896                                            enum nl80211_commands cmd,
6897                                            enum nl80211_attrs attr,
6898                                            int vendor_event_idx,
6899                                            int approxlen, gfp_t gfp)
6900 {
6901         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
6902         const struct nl80211_vendor_cmd_info *info;
6903
6904         switch (cmd) {
6905         case NL80211_CMD_TESTMODE:
6906                 if (WARN_ON(vendor_event_idx != -1))
6907                         return NULL;
6908                 info = NULL;
6909                 break;
6910         case NL80211_CMD_VENDOR:
6911                 if (WARN_ON(vendor_event_idx < 0 ||
6912                             vendor_event_idx >= wiphy->n_vendor_events))
6913                         return NULL;
6914                 info = &wiphy->vendor_events[vendor_event_idx];
6915                 break;
6916         default:
6917                 WARN_ON(1);
6918                 return NULL;
6919         }
6920
6921         return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
6922                                            cmd, attr, info, gfp);
6923 }
6924 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
6925
6926 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
6927 {
6928         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6929         void *hdr = ((void **)skb->cb)[1];
6930         struct nlattr *data = ((void **)skb->cb)[2];
6931         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
6932
6933         nla_nest_end(skb, data);
6934         genlmsg_end(skb, hdr);
6935
6936         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
6937                 mcgrp = NL80211_MCGRP_VENDOR;
6938
6939         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
6940                                 mcgrp, gfp);
6941 }
6942 EXPORT_SYMBOL(__cfg80211_send_event_skb);
6943
6944 #ifdef CONFIG_NL80211_TESTMODE
6945 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6946 {
6947         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6948         struct wireless_dev *wdev =
6949                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
6950         int err;
6951
6952         if (!rdev->ops->testmode_cmd)
6953                 return -EOPNOTSUPP;
6954
6955         if (IS_ERR(wdev)) {
6956                 err = PTR_ERR(wdev);
6957                 if (err != -EINVAL)
6958                         return err;
6959                 wdev = NULL;
6960         } else if (wdev->wiphy != &rdev->wiphy) {
6961                 return -EINVAL;
6962         }
6963
6964         if (!info->attrs[NL80211_ATTR_TESTDATA])
6965                 return -EINVAL;
6966
6967         rdev->cur_cmd_info = info;
6968         err = rdev_testmode_cmd(rdev, wdev,
6969                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6970                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6971         rdev->cur_cmd_info = NULL;
6972
6973         return err;
6974 }
6975
6976 static int nl80211_testmode_dump(struct sk_buff *skb,
6977                                  struct netlink_callback *cb)
6978 {
6979         struct cfg80211_registered_device *rdev;
6980         int err;
6981         long phy_idx;
6982         void *data = NULL;
6983         int data_len = 0;
6984
6985         rtnl_lock();
6986
6987         if (cb->args[0]) {
6988                 /*
6989                  * 0 is a valid index, but not valid for args[0],
6990                  * so we need to offset by 1.
6991                  */
6992                 phy_idx = cb->args[0] - 1;
6993         } else {
6994                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6995                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6996                                   nl80211_policy);
6997                 if (err)
6998                         goto out_err;
6999
7000                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7001                                                   nl80211_fam.attrbuf);
7002                 if (IS_ERR(rdev)) {
7003                         err = PTR_ERR(rdev);
7004                         goto out_err;
7005                 }
7006                 phy_idx = rdev->wiphy_idx;
7007                 rdev = NULL;
7008
7009                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7010                         cb->args[1] =
7011                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7012         }
7013
7014         if (cb->args[1]) {
7015                 data = nla_data((void *)cb->args[1]);
7016                 data_len = nla_len((void *)cb->args[1]);
7017         }
7018
7019         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7020         if (!rdev) {
7021                 err = -ENOENT;
7022                 goto out_err;
7023         }
7024
7025         if (!rdev->ops->testmode_dump) {
7026                 err = -EOPNOTSUPP;
7027                 goto out_err;
7028         }
7029
7030         while (1) {
7031                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7032                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7033                                            NL80211_CMD_TESTMODE);
7034                 struct nlattr *tmdata;
7035
7036                 if (!hdr)
7037                         break;
7038
7039                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7040                         genlmsg_cancel(skb, hdr);
7041                         break;
7042                 }
7043
7044                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7045                 if (!tmdata) {
7046                         genlmsg_cancel(skb, hdr);
7047                         break;
7048                 }
7049                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7050                 nla_nest_end(skb, tmdata);
7051
7052                 if (err == -ENOBUFS || err == -ENOENT) {
7053                         genlmsg_cancel(skb, hdr);
7054                         break;
7055                 } else if (err) {
7056                         genlmsg_cancel(skb, hdr);
7057                         goto out_err;
7058                 }
7059
7060                 genlmsg_end(skb, hdr);
7061         }
7062
7063         err = skb->len;
7064         /* see above */
7065         cb->args[0] = phy_idx + 1;
7066  out_err:
7067         rtnl_unlock();
7068         return err;
7069 }
7070 #endif
7071
7072 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7073 {
7074         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7075         struct net_device *dev = info->user_ptr[1];
7076         struct cfg80211_connect_params connect;
7077         struct wiphy *wiphy;
7078         struct cfg80211_cached_keys *connkeys = NULL;
7079         int err;
7080
7081         memset(&connect, 0, sizeof(connect));
7082
7083         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7084                 return -EINVAL;
7085
7086         if (!info->attrs[NL80211_ATTR_SSID] ||
7087             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7088                 return -EINVAL;
7089
7090         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
7091                 connect.auth_type =
7092                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7093                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
7094                                              NL80211_CMD_CONNECT))
7095                         return -EINVAL;
7096         } else
7097                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7098
7099         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7100
7101         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7102                                       NL80211_MAX_NR_CIPHER_SUITES);
7103         if (err)
7104                 return err;
7105
7106         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7107             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7108                 return -EOPNOTSUPP;
7109
7110         wiphy = &rdev->wiphy;
7111
7112         connect.bg_scan_period = -1;
7113         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7114                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7115                 connect.bg_scan_period =
7116                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7117         }
7118
7119         if (info->attrs[NL80211_ATTR_MAC])
7120                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7121         else if (info->attrs[NL80211_ATTR_MAC_HINT])
7122                 connect.bssid_hint =
7123                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7124         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7125         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7126
7127         if (info->attrs[NL80211_ATTR_IE]) {
7128                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7129                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7130         }
7131
7132         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7133                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7134                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7135                     connect.mfp != NL80211_MFP_NO)
7136                         return -EINVAL;
7137         } else {
7138                 connect.mfp = NL80211_MFP_NO;
7139         }
7140
7141         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7142                 connect.channel = nl80211_get_valid_chan(
7143                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7144                 if (!connect.channel)
7145                         return -EINVAL;
7146         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7147                 connect.channel_hint = nl80211_get_valid_chan(
7148                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
7149                 if (!connect.channel_hint)
7150                         return -EINVAL;
7151         }
7152
7153         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7154                 connkeys = nl80211_parse_connkeys(rdev,
7155                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7156                 if (IS_ERR(connkeys))
7157                         return PTR_ERR(connkeys);
7158         }
7159
7160         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7161                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7162
7163         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7164                 memcpy(&connect.ht_capa_mask,
7165                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7166                        sizeof(connect.ht_capa_mask));
7167
7168         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7169                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7170                         kfree(connkeys);
7171                         return -EINVAL;
7172                 }
7173                 memcpy(&connect.ht_capa,
7174                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7175                        sizeof(connect.ht_capa));
7176         }
7177
7178         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7179                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7180
7181         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7182                 memcpy(&connect.vht_capa_mask,
7183                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7184                        sizeof(connect.vht_capa_mask));
7185
7186         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7187                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7188                         kfree(connkeys);
7189                         return -EINVAL;
7190                 }
7191                 memcpy(&connect.vht_capa,
7192                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7193                        sizeof(connect.vht_capa));
7194         }
7195
7196         wdev_lock(dev->ieee80211_ptr);
7197         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7198         wdev_unlock(dev->ieee80211_ptr);
7199         if (err)
7200                 kfree(connkeys);
7201         return err;
7202 }
7203
7204 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7205 {
7206         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7207         struct net_device *dev = info->user_ptr[1];
7208         u16 reason;
7209         int ret;
7210
7211         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7212                 reason = WLAN_REASON_DEAUTH_LEAVING;
7213         else
7214                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7215
7216         if (reason == 0)
7217                 return -EINVAL;
7218
7219         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7220             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7221                 return -EOPNOTSUPP;
7222
7223         wdev_lock(dev->ieee80211_ptr);
7224         ret = cfg80211_disconnect(rdev, dev, reason, true);
7225         wdev_unlock(dev->ieee80211_ptr);
7226         return ret;
7227 }
7228
7229 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7230 {
7231         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7232         struct net *net;
7233         int err;
7234         u32 pid;
7235
7236         if (!info->attrs[NL80211_ATTR_PID])
7237                 return -EINVAL;
7238
7239         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7240
7241         net = get_net_ns_by_pid(pid);
7242         if (IS_ERR(net))
7243                 return PTR_ERR(net);
7244
7245         err = 0;
7246
7247         /* check if anything to do */
7248         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7249                 err = cfg80211_switch_netns(rdev, net);
7250
7251         put_net(net);
7252         return err;
7253 }
7254
7255 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7256 {
7257         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7258         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7259                         struct cfg80211_pmksa *pmksa) = NULL;
7260         struct net_device *dev = info->user_ptr[1];
7261         struct cfg80211_pmksa pmksa;
7262
7263         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7264
7265         if (!info->attrs[NL80211_ATTR_MAC])
7266                 return -EINVAL;
7267
7268         if (!info->attrs[NL80211_ATTR_PMKID])
7269                 return -EINVAL;
7270
7271         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7272         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7273
7274         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7275             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7276                 return -EOPNOTSUPP;
7277
7278         switch (info->genlhdr->cmd) {
7279         case NL80211_CMD_SET_PMKSA:
7280                 rdev_ops = rdev->ops->set_pmksa;
7281                 break;
7282         case NL80211_CMD_DEL_PMKSA:
7283                 rdev_ops = rdev->ops->del_pmksa;
7284                 break;
7285         default:
7286                 WARN_ON(1);
7287                 break;
7288         }
7289
7290         if (!rdev_ops)
7291                 return -EOPNOTSUPP;
7292
7293         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7294 }
7295
7296 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7297 {
7298         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7299         struct net_device *dev = info->user_ptr[1];
7300
7301         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7302             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7303                 return -EOPNOTSUPP;
7304
7305         if (!rdev->ops->flush_pmksa)
7306                 return -EOPNOTSUPP;
7307
7308         return rdev_flush_pmksa(rdev, dev);
7309 }
7310
7311 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7312 {
7313         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7314         struct net_device *dev = info->user_ptr[1];
7315         u8 action_code, dialog_token;
7316         u32 peer_capability = 0;
7317         u16 status_code;
7318         u8 *peer;
7319
7320         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7321             !rdev->ops->tdls_mgmt)
7322                 return -EOPNOTSUPP;
7323
7324         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7325             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7326             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7327             !info->attrs[NL80211_ATTR_IE] ||
7328             !info->attrs[NL80211_ATTR_MAC])
7329                 return -EINVAL;
7330
7331         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7332         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7333         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7334         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7335         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
7336                 peer_capability =
7337                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
7338
7339         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7340                               dialog_token, status_code, peer_capability,
7341                               nla_data(info->attrs[NL80211_ATTR_IE]),
7342                               nla_len(info->attrs[NL80211_ATTR_IE]));
7343 }
7344
7345 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7346 {
7347         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7348         struct net_device *dev = info->user_ptr[1];
7349         enum nl80211_tdls_operation operation;
7350         u8 *peer;
7351
7352         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7353             !rdev->ops->tdls_oper)
7354                 return -EOPNOTSUPP;
7355
7356         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7357             !info->attrs[NL80211_ATTR_MAC])
7358                 return -EINVAL;
7359
7360         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7361         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7362
7363         return rdev_tdls_oper(rdev, dev, peer, operation);
7364 }
7365
7366 static int nl80211_remain_on_channel(struct sk_buff *skb,
7367                                      struct genl_info *info)
7368 {
7369         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7370         struct wireless_dev *wdev = info->user_ptr[1];
7371         struct cfg80211_chan_def chandef;
7372         struct sk_buff *msg;
7373         void *hdr;
7374         u64 cookie;
7375         u32 duration;
7376         int err;
7377
7378         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7379             !info->attrs[NL80211_ATTR_DURATION])
7380                 return -EINVAL;
7381
7382         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7383
7384         if (!rdev->ops->remain_on_channel ||
7385             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7386                 return -EOPNOTSUPP;
7387
7388         /*
7389          * We should be on that channel for at least a minimum amount of
7390          * time (10ms) but no longer than the driver supports.
7391          */
7392         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7393             duration > rdev->wiphy.max_remain_on_channel_duration)
7394                 return -EINVAL;
7395
7396         err = nl80211_parse_chandef(rdev, info, &chandef);
7397         if (err)
7398                 return err;
7399
7400         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7401         if (!msg)
7402                 return -ENOMEM;
7403
7404         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7405                              NL80211_CMD_REMAIN_ON_CHANNEL);
7406         if (!hdr) {
7407                 err = -ENOBUFS;
7408                 goto free_msg;
7409         }
7410
7411         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7412                                      duration, &cookie);
7413
7414         if (err)
7415                 goto free_msg;
7416
7417         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7418                 goto nla_put_failure;
7419
7420         genlmsg_end(msg, hdr);
7421
7422         return genlmsg_reply(msg, info);
7423
7424  nla_put_failure:
7425         err = -ENOBUFS;
7426  free_msg:
7427         nlmsg_free(msg);
7428         return err;
7429 }
7430
7431 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7432                                             struct genl_info *info)
7433 {
7434         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7435         struct wireless_dev *wdev = info->user_ptr[1];
7436         u64 cookie;
7437
7438         if (!info->attrs[NL80211_ATTR_COOKIE])
7439                 return -EINVAL;
7440
7441         if (!rdev->ops->cancel_remain_on_channel)
7442                 return -EOPNOTSUPP;
7443
7444         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7445
7446         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7447 }
7448
7449 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7450                            u8 *rates, u8 rates_len)
7451 {
7452         u8 i;
7453         u32 mask = 0;
7454
7455         for (i = 0; i < rates_len; i++) {
7456                 int rate = (rates[i] & 0x7f) * 5;
7457                 int ridx;
7458                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7459                         struct ieee80211_rate *srate =
7460                                 &sband->bitrates[ridx];
7461                         if (rate == srate->bitrate) {
7462                                 mask |= 1 << ridx;
7463                                 break;
7464                         }
7465                 }
7466                 if (ridx == sband->n_bitrates)
7467                         return 0; /* rate not found */
7468         }
7469
7470         return mask;
7471 }
7472
7473 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7474                                u8 *rates, u8 rates_len,
7475                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7476 {
7477         u8 i;
7478
7479         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7480
7481         for (i = 0; i < rates_len; i++) {
7482                 int ridx, rbit;
7483
7484                 ridx = rates[i] / 8;
7485                 rbit = BIT(rates[i] % 8);
7486
7487                 /* check validity */
7488                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7489                         return false;
7490
7491                 /* check availability */
7492                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7493                         mcs[ridx] |= rbit;
7494                 else
7495                         return false;
7496         }
7497
7498         return true;
7499 }
7500
7501 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
7502 {
7503         u16 mcs_mask = 0;
7504
7505         switch (vht_mcs_map) {
7506         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
7507                 break;
7508         case IEEE80211_VHT_MCS_SUPPORT_0_7:
7509                 mcs_mask = 0x00FF;
7510                 break;
7511         case IEEE80211_VHT_MCS_SUPPORT_0_8:
7512                 mcs_mask = 0x01FF;
7513                 break;
7514         case IEEE80211_VHT_MCS_SUPPORT_0_9:
7515                 mcs_mask = 0x03FF;
7516                 break;
7517         default:
7518                 break;
7519         }
7520
7521         return mcs_mask;
7522 }
7523
7524 static void vht_build_mcs_mask(u16 vht_mcs_map,
7525                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
7526 {
7527         u8 nss;
7528
7529         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
7530                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
7531                 vht_mcs_map >>= 2;
7532         }
7533 }
7534
7535 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
7536                              struct nl80211_txrate_vht *txrate,
7537                              u16 mcs[NL80211_VHT_NSS_MAX])
7538 {
7539         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7540         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
7541         u8 i;
7542
7543         if (!sband->vht_cap.vht_supported)
7544                 return false;
7545
7546         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
7547
7548         /* Build vht_mcs_mask from VHT capabilities */
7549         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
7550
7551         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
7552                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
7553                         mcs[i] = txrate->mcs[i];
7554                 else
7555                         return false;
7556         }
7557
7558         return true;
7559 }
7560
7561 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7562         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7563                                     .len = NL80211_MAX_SUPP_RATES },
7564         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
7565                                 .len = NL80211_MAX_SUPP_HT_RATES },
7566         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
7567         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
7568 };
7569
7570 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7571                                        struct genl_info *info)
7572 {
7573         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7574         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7575         struct cfg80211_bitrate_mask mask;
7576         int rem, i;
7577         struct net_device *dev = info->user_ptr[1];
7578         struct nlattr *tx_rates;
7579         struct ieee80211_supported_band *sband;
7580         u16 vht_tx_mcs_map;
7581
7582         if (!rdev->ops->set_bitrate_mask)
7583                 return -EOPNOTSUPP;
7584
7585         memset(&mask, 0, sizeof(mask));
7586         /* Default to all rates enabled */
7587         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7588                 sband = rdev->wiphy.bands[i];
7589
7590                 if (!sband)
7591                         continue;
7592
7593                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
7594                 memcpy(mask.control[i].ht_mcs,
7595                        sband->ht_cap.mcs.rx_mask,
7596                        sizeof(mask.control[i].ht_mcs));
7597
7598                 if (!sband->vht_cap.vht_supported)
7599                         continue;
7600
7601                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7602                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
7603         }
7604
7605         /* if no rates are given set it back to the defaults */
7606         if (!info->attrs[NL80211_ATTR_TX_RATES])
7607                 goto out;
7608
7609         /*
7610          * The nested attribute uses enum nl80211_band as the index. This maps
7611          * directly to the enum ieee80211_band values used in cfg80211.
7612          */
7613         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7614         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
7615                 enum ieee80211_band band = nla_type(tx_rates);
7616                 int err;
7617
7618                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7619                         return -EINVAL;
7620                 sband = rdev->wiphy.bands[band];
7621                 if (sband == NULL)
7622                         return -EINVAL;
7623                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7624                                 nla_len(tx_rates), nl80211_txattr_policy);
7625                 if (err)
7626                         return err;
7627                 if (tb[NL80211_TXRATE_LEGACY]) {
7628                         mask.control[band].legacy = rateset_to_mask(
7629                                 sband,
7630                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7631                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7632                         if ((mask.control[band].legacy == 0) &&
7633                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7634                                 return -EINVAL;
7635                 }
7636                 if (tb[NL80211_TXRATE_HT]) {
7637                         if (!ht_rateset_to_mask(
7638                                         sband,
7639                                         nla_data(tb[NL80211_TXRATE_HT]),
7640                                         nla_len(tb[NL80211_TXRATE_HT]),
7641                                         mask.control[band].ht_mcs))
7642                                 return -EINVAL;
7643                 }
7644                 if (tb[NL80211_TXRATE_VHT]) {
7645                         if (!vht_set_mcs_mask(
7646                                         sband,
7647                                         nla_data(tb[NL80211_TXRATE_VHT]),
7648                                         mask.control[band].vht_mcs))
7649                                 return -EINVAL;
7650                 }
7651                 if (tb[NL80211_TXRATE_GI]) {
7652                         mask.control[band].gi =
7653                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
7654                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
7655                                 return -EINVAL;
7656                 }
7657
7658                 if (mask.control[band].legacy == 0) {
7659                         /* don't allow empty legacy rates if HT or VHT
7660                          * are not even supported.
7661                          */
7662                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
7663                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
7664                                 return -EINVAL;
7665
7666                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7667                                 if (mask.control[band].ht_mcs[i])
7668                                         goto out;
7669
7670                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
7671                                 if (mask.control[band].vht_mcs[i])
7672                                         goto out;
7673
7674                         /* legacy and mcs rates may not be both empty */
7675                         return -EINVAL;
7676                 }
7677         }
7678
7679 out:
7680         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7681 }
7682
7683 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7684 {
7685         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7686         struct wireless_dev *wdev = info->user_ptr[1];
7687         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7688
7689         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7690                 return -EINVAL;
7691
7692         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7693                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7694
7695         switch (wdev->iftype) {
7696         case NL80211_IFTYPE_STATION:
7697         case NL80211_IFTYPE_ADHOC:
7698         case NL80211_IFTYPE_P2P_CLIENT:
7699         case NL80211_IFTYPE_AP:
7700         case NL80211_IFTYPE_AP_VLAN:
7701         case NL80211_IFTYPE_MESH_POINT:
7702         case NL80211_IFTYPE_P2P_GO:
7703         case NL80211_IFTYPE_P2P_DEVICE:
7704                 break;
7705         default:
7706                 return -EOPNOTSUPP;
7707         }
7708
7709         /* not much point in registering if we can't reply */
7710         if (!rdev->ops->mgmt_tx)
7711                 return -EOPNOTSUPP;
7712
7713         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7714                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7715                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7716 }
7717
7718 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7719 {
7720         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7721         struct wireless_dev *wdev = info->user_ptr[1];
7722         struct cfg80211_chan_def chandef;
7723         int err;
7724         void *hdr = NULL;
7725         u64 cookie;
7726         struct sk_buff *msg = NULL;
7727         struct cfg80211_mgmt_tx_params params = {
7728                 .dont_wait_for_ack =
7729                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
7730         };
7731
7732         if (!info->attrs[NL80211_ATTR_FRAME])
7733                 return -EINVAL;
7734
7735         if (!rdev->ops->mgmt_tx)
7736                 return -EOPNOTSUPP;
7737
7738         switch (wdev->iftype) {
7739         case NL80211_IFTYPE_P2P_DEVICE:
7740                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7741                         return -EINVAL;
7742         case NL80211_IFTYPE_STATION:
7743         case NL80211_IFTYPE_ADHOC:
7744         case NL80211_IFTYPE_P2P_CLIENT:
7745         case NL80211_IFTYPE_AP:
7746         case NL80211_IFTYPE_AP_VLAN:
7747         case NL80211_IFTYPE_MESH_POINT:
7748         case NL80211_IFTYPE_P2P_GO:
7749                 break;
7750         default:
7751                 return -EOPNOTSUPP;
7752         }
7753
7754         if (info->attrs[NL80211_ATTR_DURATION]) {
7755                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7756                         return -EINVAL;
7757                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7758
7759                 /*
7760                  * We should wait on the channel for at least a minimum amount
7761                  * of time (10ms) but no longer than the driver supports.
7762                  */
7763                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7764                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
7765                         return -EINVAL;
7766
7767         }
7768
7769         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7770
7771         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7772                 return -EINVAL;
7773
7774         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7775
7776         /* get the channel if any has been specified, otherwise pass NULL to
7777          * the driver. The latter will use the current one
7778          */
7779         chandef.chan = NULL;
7780         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7781                 err = nl80211_parse_chandef(rdev, info, &chandef);
7782                 if (err)
7783                         return err;
7784         }
7785
7786         if (!chandef.chan && params.offchan)
7787                 return -EINVAL;
7788
7789         if (!params.dont_wait_for_ack) {
7790                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7791                 if (!msg)
7792                         return -ENOMEM;
7793
7794                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7795                                      NL80211_CMD_FRAME);
7796                 if (!hdr) {
7797                         err = -ENOBUFS;
7798                         goto free_msg;
7799                 }
7800         }
7801
7802         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
7803         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
7804         params.chan = chandef.chan;
7805         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
7806         if (err)
7807                 goto free_msg;
7808
7809         if (msg) {
7810                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7811                         goto nla_put_failure;
7812
7813                 genlmsg_end(msg, hdr);
7814                 return genlmsg_reply(msg, info);
7815         }
7816
7817         return 0;
7818
7819  nla_put_failure:
7820         err = -ENOBUFS;
7821  free_msg:
7822         nlmsg_free(msg);
7823         return err;
7824 }
7825
7826 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7827 {
7828         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7829         struct wireless_dev *wdev = info->user_ptr[1];
7830         u64 cookie;
7831
7832         if (!info->attrs[NL80211_ATTR_COOKIE])
7833                 return -EINVAL;
7834
7835         if (!rdev->ops->mgmt_tx_cancel_wait)
7836                 return -EOPNOTSUPP;
7837
7838         switch (wdev->iftype) {
7839         case NL80211_IFTYPE_STATION:
7840         case NL80211_IFTYPE_ADHOC:
7841         case NL80211_IFTYPE_P2P_CLIENT:
7842         case NL80211_IFTYPE_AP:
7843         case NL80211_IFTYPE_AP_VLAN:
7844         case NL80211_IFTYPE_P2P_GO:
7845         case NL80211_IFTYPE_P2P_DEVICE:
7846                 break;
7847         default:
7848                 return -EOPNOTSUPP;
7849         }
7850
7851         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7852
7853         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7854 }
7855
7856 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7857 {
7858         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7859         struct wireless_dev *wdev;
7860         struct net_device *dev = info->user_ptr[1];
7861         u8 ps_state;
7862         bool state;
7863         int err;
7864
7865         if (!info->attrs[NL80211_ATTR_PS_STATE])
7866                 return -EINVAL;
7867
7868         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7869
7870         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7871                 return -EINVAL;
7872
7873         wdev = dev->ieee80211_ptr;
7874
7875         if (!rdev->ops->set_power_mgmt)
7876                 return -EOPNOTSUPP;
7877
7878         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7879
7880         if (state == wdev->ps)
7881                 return 0;
7882
7883         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7884         if (!err)
7885                 wdev->ps = state;
7886         return err;
7887 }
7888
7889 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7890 {
7891         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7892         enum nl80211_ps_state ps_state;
7893         struct wireless_dev *wdev;
7894         struct net_device *dev = info->user_ptr[1];
7895         struct sk_buff *msg;
7896         void *hdr;
7897         int err;
7898
7899         wdev = dev->ieee80211_ptr;
7900
7901         if (!rdev->ops->set_power_mgmt)
7902                 return -EOPNOTSUPP;
7903
7904         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7905         if (!msg)
7906                 return -ENOMEM;
7907
7908         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7909                              NL80211_CMD_GET_POWER_SAVE);
7910         if (!hdr) {
7911                 err = -ENOBUFS;
7912                 goto free_msg;
7913         }
7914
7915         if (wdev->ps)
7916                 ps_state = NL80211_PS_ENABLED;
7917         else
7918                 ps_state = NL80211_PS_DISABLED;
7919
7920         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7921                 goto nla_put_failure;
7922
7923         genlmsg_end(msg, hdr);
7924         return genlmsg_reply(msg, info);
7925
7926  nla_put_failure:
7927         err = -ENOBUFS;
7928  free_msg:
7929         nlmsg_free(msg);
7930         return err;
7931 }
7932
7933 static const struct nla_policy
7934 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
7935         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7936         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7937         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7938         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7939         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7940         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7941 };
7942
7943 static int nl80211_set_cqm_txe(struct genl_info *info,
7944                                u32 rate, u32 pkts, u32 intvl)
7945 {
7946         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7947         struct net_device *dev = info->user_ptr[1];
7948         struct wireless_dev *wdev = dev->ieee80211_ptr;
7949
7950         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7951                 return -EINVAL;
7952
7953         if (!rdev->ops->set_cqm_txe_config)
7954                 return -EOPNOTSUPP;
7955
7956         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7957             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7958                 return -EOPNOTSUPP;
7959
7960         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7961 }
7962
7963 static int nl80211_set_cqm_rssi(struct genl_info *info,
7964                                 s32 threshold, u32 hysteresis)
7965 {
7966         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7967         struct net_device *dev = info->user_ptr[1];
7968         struct wireless_dev *wdev = dev->ieee80211_ptr;
7969
7970         if (threshold > 0)
7971                 return -EINVAL;
7972
7973         /* disabling - hysteresis should also be zero then */
7974         if (threshold == 0)
7975                 hysteresis = 0;
7976
7977         if (!rdev->ops->set_cqm_rssi_config)
7978                 return -EOPNOTSUPP;
7979
7980         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7981             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7982                 return -EOPNOTSUPP;
7983
7984         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7985 }
7986
7987 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7988 {
7989         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7990         struct nlattr *cqm;
7991         int err;
7992
7993         cqm = info->attrs[NL80211_ATTR_CQM];
7994         if (!cqm)
7995                 return -EINVAL;
7996
7997         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7998                                nl80211_attr_cqm_policy);
7999         if (err)
8000                 return err;
8001
8002         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
8003             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8004                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
8005                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8006
8007                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
8008         }
8009
8010         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
8011             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
8012             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
8013                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
8014                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
8015                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
8016
8017                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
8018         }
8019
8020         return -EINVAL;
8021 }
8022
8023 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
8024 {
8025         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8026         struct net_device *dev = info->user_ptr[1];
8027         struct mesh_config cfg;
8028         struct mesh_setup setup;
8029         int err;
8030
8031         /* start with default */
8032         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8033         memcpy(&setup, &default_mesh_setup, sizeof(setup));
8034
8035         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8036                 /* and parse parameters if given */
8037                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
8038                 if (err)
8039                         return err;
8040         }
8041
8042         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
8043             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
8044                 return -EINVAL;
8045
8046         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
8047         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
8048
8049         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8050             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
8051                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8052                         return -EINVAL;
8053
8054         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
8055                 setup.beacon_interval =
8056                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8057                 if (setup.beacon_interval < 10 ||
8058                     setup.beacon_interval > 10000)
8059                         return -EINVAL;
8060         }
8061
8062         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
8063                 setup.dtim_period =
8064                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
8065                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
8066                         return -EINVAL;
8067         }
8068
8069         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
8070                 /* parse additional setup parameters if given */
8071                 err = nl80211_parse_mesh_setup(info, &setup);
8072                 if (err)
8073                         return err;
8074         }
8075
8076         if (setup.user_mpm)
8077                 cfg.auto_open_plinks = false;
8078
8079         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8080                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8081                 if (err)
8082                         return err;
8083         } else {
8084                 /* cfg80211_join_mesh() will sort it out */
8085                 setup.chandef.chan = NULL;
8086         }
8087
8088         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8089                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8090                 int n_rates =
8091                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8092                 struct ieee80211_supported_band *sband;
8093
8094                 if (!setup.chandef.chan)
8095                         return -EINVAL;
8096
8097                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
8098
8099                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8100                                              &setup.basic_rates);
8101                 if (err)
8102                         return err;
8103         }
8104
8105         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8106 }
8107
8108 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
8109 {
8110         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8111         struct net_device *dev = info->user_ptr[1];
8112
8113         return cfg80211_leave_mesh(rdev, dev);
8114 }
8115
8116 #ifdef CONFIG_PM
8117 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8118                                         struct cfg80211_registered_device *rdev)
8119 {
8120         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8121         struct nlattr *nl_pats, *nl_pat;
8122         int i, pat_len;
8123
8124         if (!wowlan->n_patterns)
8125                 return 0;
8126
8127         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8128         if (!nl_pats)
8129                 return -ENOBUFS;
8130
8131         for (i = 0; i < wowlan->n_patterns; i++) {
8132                 nl_pat = nla_nest_start(msg, i + 1);
8133                 if (!nl_pat)
8134                         return -ENOBUFS;
8135                 pat_len = wowlan->patterns[i].pattern_len;
8136                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8137                             wowlan->patterns[i].mask) ||
8138                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8139                             wowlan->patterns[i].pattern) ||
8140                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8141                                 wowlan->patterns[i].pkt_offset))
8142                         return -ENOBUFS;
8143                 nla_nest_end(msg, nl_pat);
8144         }
8145         nla_nest_end(msg, nl_pats);
8146
8147         return 0;
8148 }
8149
8150 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8151                                    struct cfg80211_wowlan_tcp *tcp)
8152 {
8153         struct nlattr *nl_tcp;
8154
8155         if (!tcp)
8156                 return 0;
8157
8158         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8159         if (!nl_tcp)
8160                 return -ENOBUFS;
8161
8162         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8163             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8164             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8165             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8166             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8167             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8168                     tcp->payload_len, tcp->payload) ||
8169             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8170                         tcp->data_interval) ||
8171             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8172                     tcp->wake_len, tcp->wake_data) ||
8173             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8174                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8175                 return -ENOBUFS;
8176
8177         if (tcp->payload_seq.len &&
8178             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8179                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8180                 return -ENOBUFS;
8181
8182         if (tcp->payload_tok.len &&
8183             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8184                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8185                     &tcp->payload_tok))
8186                 return -ENOBUFS;
8187
8188         nla_nest_end(msg, nl_tcp);
8189
8190         return 0;
8191 }
8192
8193 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8194 {
8195         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8196         struct sk_buff *msg;
8197         void *hdr;
8198         u32 size = NLMSG_DEFAULT_SIZE;
8199
8200         if (!rdev->wiphy.wowlan)
8201                 return -EOPNOTSUPP;
8202
8203         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8204                 /* adjust size to have room for all the data */
8205                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8206                         rdev->wiphy.wowlan_config->tcp->payload_len +
8207                         rdev->wiphy.wowlan_config->tcp->wake_len +
8208                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8209         }
8210
8211         msg = nlmsg_new(size, GFP_KERNEL);
8212         if (!msg)
8213                 return -ENOMEM;
8214
8215         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8216                              NL80211_CMD_GET_WOWLAN);
8217         if (!hdr)
8218                 goto nla_put_failure;
8219
8220         if (rdev->wiphy.wowlan_config) {
8221                 struct nlattr *nl_wowlan;
8222
8223                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8224                 if (!nl_wowlan)
8225                         goto nla_put_failure;
8226
8227                 if ((rdev->wiphy.wowlan_config->any &&
8228                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8229                     (rdev->wiphy.wowlan_config->disconnect &&
8230                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8231                     (rdev->wiphy.wowlan_config->magic_pkt &&
8232                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8233                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8234                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8235                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8236                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8237                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8238                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8239                     (rdev->wiphy.wowlan_config->rfkill_release &&
8240                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8241                         goto nla_put_failure;
8242
8243                 if (nl80211_send_wowlan_patterns(msg, rdev))
8244                         goto nla_put_failure;
8245
8246                 if (nl80211_send_wowlan_tcp(msg,
8247                                             rdev->wiphy.wowlan_config->tcp))
8248                         goto nla_put_failure;
8249
8250                 nla_nest_end(msg, nl_wowlan);
8251         }
8252
8253         genlmsg_end(msg, hdr);
8254         return genlmsg_reply(msg, info);
8255
8256 nla_put_failure:
8257         nlmsg_free(msg);
8258         return -ENOBUFS;
8259 }
8260
8261 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8262                                     struct nlattr *attr,
8263                                     struct cfg80211_wowlan *trig)
8264 {
8265         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8266         struct cfg80211_wowlan_tcp *cfg;
8267         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8268         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8269         u32 size;
8270         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8271         int err, port;
8272
8273         if (!rdev->wiphy.wowlan->tcp)
8274                 return -EINVAL;
8275
8276         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8277                         nla_data(attr), nla_len(attr),
8278                         nl80211_wowlan_tcp_policy);
8279         if (err)
8280                 return err;
8281
8282         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8283             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8284             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8285             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8286             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8287             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8288             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8289             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8290                 return -EINVAL;
8291
8292         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8293         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8294                 return -EINVAL;
8295
8296         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8297                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8298             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8299                 return -EINVAL;
8300
8301         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8302         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8303                 return -EINVAL;
8304
8305         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8306         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8307                 return -EINVAL;
8308
8309         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8310                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8311
8312                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8313                 tokens_size = tokln - sizeof(*tok);
8314
8315                 if (!tok->len || tokens_size % tok->len)
8316                         return -EINVAL;
8317                 if (!rdev->wiphy.wowlan->tcp->tok)
8318                         return -EINVAL;
8319                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8320                         return -EINVAL;
8321                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8322                         return -EINVAL;
8323                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8324                         return -EINVAL;
8325                 if (tok->offset + tok->len > data_size)
8326                         return -EINVAL;
8327         }
8328
8329         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8330                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8331                 if (!rdev->wiphy.wowlan->tcp->seq)
8332                         return -EINVAL;
8333                 if (seq->len == 0 || seq->len > 4)
8334                         return -EINVAL;
8335                 if (seq->len + seq->offset > data_size)
8336                         return -EINVAL;
8337         }
8338
8339         size = sizeof(*cfg);
8340         size += data_size;
8341         size += wake_size + wake_mask_size;
8342         size += tokens_size;
8343
8344         cfg = kzalloc(size, GFP_KERNEL);
8345         if (!cfg)
8346                 return -ENOMEM;
8347         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8348         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8349         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8350                ETH_ALEN);
8351         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8352                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8353         else
8354                 port = 0;
8355 #ifdef CONFIG_INET
8356         /* allocate a socket and port for it and use it */
8357         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8358                             IPPROTO_TCP, &cfg->sock, 1);
8359         if (err) {
8360                 kfree(cfg);
8361                 return err;
8362         }
8363         if (inet_csk_get_port(cfg->sock->sk, port)) {
8364                 sock_release(cfg->sock);
8365                 kfree(cfg);
8366                 return -EADDRINUSE;
8367         }
8368         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8369 #else
8370         if (!port) {
8371                 kfree(cfg);
8372                 return -EINVAL;
8373         }
8374         cfg->src_port = port;
8375 #endif
8376
8377         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
8378         cfg->payload_len = data_size;
8379         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
8380         memcpy((void *)cfg->payload,
8381                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
8382                data_size);
8383         if (seq)
8384                 cfg->payload_seq = *seq;
8385         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
8386         cfg->wake_len = wake_size;
8387         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
8388         memcpy((void *)cfg->wake_data,
8389                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
8390                wake_size);
8391         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
8392                          data_size + wake_size;
8393         memcpy((void *)cfg->wake_mask,
8394                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
8395                wake_mask_size);
8396         if (tok) {
8397                 cfg->tokens_size = tokens_size;
8398                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
8399         }
8400
8401         trig->tcp = cfg;
8402
8403         return 0;
8404 }
8405
8406 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
8407 {
8408         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8409         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
8410         struct cfg80211_wowlan new_triggers = {};
8411         struct cfg80211_wowlan *ntrig;
8412         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8413         int err, i;
8414         bool prev_enabled = rdev->wiphy.wowlan_config;
8415
8416         if (!wowlan)
8417                 return -EOPNOTSUPP;
8418
8419         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
8420                 cfg80211_rdev_free_wowlan(rdev);
8421                 rdev->wiphy.wowlan_config = NULL;
8422                 goto set_wakeup;
8423         }
8424
8425         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
8426                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8427                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8428                         nl80211_wowlan_policy);
8429         if (err)
8430                 return err;
8431
8432         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
8433                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
8434                         return -EINVAL;
8435                 new_triggers.any = true;
8436         }
8437
8438         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
8439                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
8440                         return -EINVAL;
8441                 new_triggers.disconnect = true;
8442         }
8443
8444         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
8445                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
8446                         return -EINVAL;
8447                 new_triggers.magic_pkt = true;
8448         }
8449
8450         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
8451                 return -EINVAL;
8452
8453         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
8454                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
8455                         return -EINVAL;
8456                 new_triggers.gtk_rekey_failure = true;
8457         }
8458
8459         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
8460                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
8461                         return -EINVAL;
8462                 new_triggers.eap_identity_req = true;
8463         }
8464
8465         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
8466                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
8467                         return -EINVAL;
8468                 new_triggers.four_way_handshake = true;
8469         }
8470
8471         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
8472                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
8473                         return -EINVAL;
8474                 new_triggers.rfkill_release = true;
8475         }
8476
8477         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
8478                 struct nlattr *pat;
8479                 int n_patterns = 0;
8480                 int rem, pat_len, mask_len, pkt_offset;
8481                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8482
8483                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8484                                     rem)
8485                         n_patterns++;
8486                 if (n_patterns > wowlan->n_patterns)
8487                         return -EINVAL;
8488
8489                 new_triggers.patterns = kcalloc(n_patterns,
8490                                                 sizeof(new_triggers.patterns[0]),
8491                                                 GFP_KERNEL);
8492                 if (!new_triggers.patterns)
8493                         return -ENOMEM;
8494
8495                 new_triggers.n_patterns = n_patterns;
8496                 i = 0;
8497
8498                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8499                                     rem) {
8500                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8501                                   nla_len(pat), NULL);
8502                         err = -EINVAL;
8503                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8504                             !pat_tb[NL80211_PKTPAT_PATTERN])
8505                                 goto error;
8506                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8507                         mask_len = DIV_ROUND_UP(pat_len, 8);
8508                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8509                                 goto error;
8510                         if (pat_len > wowlan->pattern_max_len ||
8511                             pat_len < wowlan->pattern_min_len)
8512                                 goto error;
8513
8514                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8515                                 pkt_offset = 0;
8516                         else
8517                                 pkt_offset = nla_get_u32(
8518                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8519                         if (pkt_offset > wowlan->max_pkt_offset)
8520                                 goto error;
8521                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8522
8523                         new_triggers.patterns[i].mask =
8524                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
8525                         if (!new_triggers.patterns[i].mask) {
8526                                 err = -ENOMEM;
8527                                 goto error;
8528                         }
8529                         new_triggers.patterns[i].pattern =
8530                                 new_triggers.patterns[i].mask + mask_len;
8531                         memcpy(new_triggers.patterns[i].mask,
8532                                nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8533                                mask_len);
8534                         new_triggers.patterns[i].pattern_len = pat_len;
8535                         memcpy(new_triggers.patterns[i].pattern,
8536                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8537                                pat_len);
8538                         i++;
8539                 }
8540         }
8541
8542         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8543                 err = nl80211_parse_wowlan_tcp(
8544                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8545                         &new_triggers);
8546                 if (err)
8547                         goto error;
8548         }
8549
8550         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8551         if (!ntrig) {
8552                 err = -ENOMEM;
8553                 goto error;
8554         }
8555         cfg80211_rdev_free_wowlan(rdev);
8556         rdev->wiphy.wowlan_config = ntrig;
8557
8558  set_wakeup:
8559         if (rdev->ops->set_wakeup &&
8560             prev_enabled != !!rdev->wiphy.wowlan_config)
8561                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8562
8563         return 0;
8564  error:
8565         for (i = 0; i < new_triggers.n_patterns; i++)
8566                 kfree(new_triggers.patterns[i].mask);
8567         kfree(new_triggers.patterns);
8568         if (new_triggers.tcp && new_triggers.tcp->sock)
8569                 sock_release(new_triggers.tcp->sock);
8570         kfree(new_triggers.tcp);
8571         return err;
8572 }
8573 #endif
8574
8575 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
8576                                        struct cfg80211_registered_device *rdev)
8577 {
8578         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
8579         int i, j, pat_len;
8580         struct cfg80211_coalesce_rules *rule;
8581
8582         if (!rdev->coalesce->n_rules)
8583                 return 0;
8584
8585         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
8586         if (!nl_rules)
8587                 return -ENOBUFS;
8588
8589         for (i = 0; i < rdev->coalesce->n_rules; i++) {
8590                 nl_rule = nla_nest_start(msg, i + 1);
8591                 if (!nl_rule)
8592                         return -ENOBUFS;
8593
8594                 rule = &rdev->coalesce->rules[i];
8595                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
8596                                 rule->delay))
8597                         return -ENOBUFS;
8598
8599                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
8600                                 rule->condition))
8601                         return -ENOBUFS;
8602
8603                 nl_pats = nla_nest_start(msg,
8604                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
8605                 if (!nl_pats)
8606                         return -ENOBUFS;
8607
8608                 for (j = 0; j < rule->n_patterns; j++) {
8609                         nl_pat = nla_nest_start(msg, j + 1);
8610                         if (!nl_pat)
8611                                 return -ENOBUFS;
8612                         pat_len = rule->patterns[j].pattern_len;
8613                         if (nla_put(msg, NL80211_PKTPAT_MASK,
8614                                     DIV_ROUND_UP(pat_len, 8),
8615                                     rule->patterns[j].mask) ||
8616                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8617                                     rule->patterns[j].pattern) ||
8618                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8619                                         rule->patterns[j].pkt_offset))
8620                                 return -ENOBUFS;
8621                         nla_nest_end(msg, nl_pat);
8622                 }
8623                 nla_nest_end(msg, nl_pats);
8624                 nla_nest_end(msg, nl_rule);
8625         }
8626         nla_nest_end(msg, nl_rules);
8627
8628         return 0;
8629 }
8630
8631 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
8632 {
8633         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8634         struct sk_buff *msg;
8635         void *hdr;
8636
8637         if (!rdev->wiphy.coalesce)
8638                 return -EOPNOTSUPP;
8639
8640         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8641         if (!msg)
8642                 return -ENOMEM;
8643
8644         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8645                              NL80211_CMD_GET_COALESCE);
8646         if (!hdr)
8647                 goto nla_put_failure;
8648
8649         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
8650                 goto nla_put_failure;
8651
8652         genlmsg_end(msg, hdr);
8653         return genlmsg_reply(msg, info);
8654
8655 nla_put_failure:
8656         nlmsg_free(msg);
8657         return -ENOBUFS;
8658 }
8659
8660 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
8661 {
8662         struct cfg80211_coalesce *coalesce = rdev->coalesce;
8663         int i, j;
8664         struct cfg80211_coalesce_rules *rule;
8665
8666         if (!coalesce)
8667                 return;
8668
8669         for (i = 0; i < coalesce->n_rules; i++) {
8670                 rule = &coalesce->rules[i];
8671                 for (j = 0; j < rule->n_patterns; j++)
8672                         kfree(rule->patterns[j].mask);
8673                 kfree(rule->patterns);
8674         }
8675         kfree(coalesce->rules);
8676         kfree(coalesce);
8677         rdev->coalesce = NULL;
8678 }
8679
8680 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
8681                                        struct nlattr *rule,
8682                                        struct cfg80211_coalesce_rules *new_rule)
8683 {
8684         int err, i;
8685         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8686         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
8687         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
8688         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8689
8690         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
8691                         nla_len(rule), nl80211_coalesce_policy);
8692         if (err)
8693                 return err;
8694
8695         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
8696                 new_rule->delay =
8697                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
8698         if (new_rule->delay > coalesce->max_delay)
8699                 return -EINVAL;
8700
8701         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
8702                 new_rule->condition =
8703                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
8704         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
8705             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
8706                 return -EINVAL;
8707
8708         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
8709                 return -EINVAL;
8710
8711         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8712                             rem)
8713                 n_patterns++;
8714         if (n_patterns > coalesce->n_patterns)
8715                 return -EINVAL;
8716
8717         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
8718                                      GFP_KERNEL);
8719         if (!new_rule->patterns)
8720                 return -ENOMEM;
8721
8722         new_rule->n_patterns = n_patterns;
8723         i = 0;
8724
8725         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8726                             rem) {
8727                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8728                           nla_len(pat), NULL);
8729                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
8730                     !pat_tb[NL80211_PKTPAT_PATTERN])
8731                         return -EINVAL;
8732                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8733                 mask_len = DIV_ROUND_UP(pat_len, 8);
8734                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8735                         return -EINVAL;
8736                 if (pat_len > coalesce->pattern_max_len ||
8737                     pat_len < coalesce->pattern_min_len)
8738                         return -EINVAL;
8739
8740                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
8741                         pkt_offset = 0;
8742                 else
8743                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
8744                 if (pkt_offset > coalesce->max_pkt_offset)
8745                         return -EINVAL;
8746                 new_rule->patterns[i].pkt_offset = pkt_offset;
8747
8748                 new_rule->patterns[i].mask =
8749                         kmalloc(mask_len + pat_len, GFP_KERNEL);
8750                 if (!new_rule->patterns[i].mask)
8751                         return -ENOMEM;
8752                 new_rule->patterns[i].pattern =
8753                         new_rule->patterns[i].mask + mask_len;
8754                 memcpy(new_rule->patterns[i].mask,
8755                        nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
8756                 new_rule->patterns[i].pattern_len = pat_len;
8757                 memcpy(new_rule->patterns[i].pattern,
8758                        nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
8759                 i++;
8760         }
8761
8762         return 0;
8763 }
8764
8765 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
8766 {
8767         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8768         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8769         struct cfg80211_coalesce new_coalesce = {};
8770         struct cfg80211_coalesce *n_coalesce;
8771         int err, rem_rule, n_rules = 0, i, j;
8772         struct nlattr *rule;
8773         struct cfg80211_coalesce_rules *tmp_rule;
8774
8775         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
8776                 return -EOPNOTSUPP;
8777
8778         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
8779                 cfg80211_rdev_free_coalesce(rdev);
8780                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
8781                 return 0;
8782         }
8783
8784         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8785                             rem_rule)
8786                 n_rules++;
8787         if (n_rules > coalesce->n_rules)
8788                 return -EINVAL;
8789
8790         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
8791                                      GFP_KERNEL);
8792         if (!new_coalesce.rules)
8793                 return -ENOMEM;
8794
8795         new_coalesce.n_rules = n_rules;
8796         i = 0;
8797
8798         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8799                             rem_rule) {
8800                 err = nl80211_parse_coalesce_rule(rdev, rule,
8801                                                   &new_coalesce.rules[i]);
8802                 if (err)
8803                         goto error;
8804
8805                 i++;
8806         }
8807
8808         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
8809         if (err)
8810                 goto error;
8811
8812         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
8813         if (!n_coalesce) {
8814                 err = -ENOMEM;
8815                 goto error;
8816         }
8817         cfg80211_rdev_free_coalesce(rdev);
8818         rdev->coalesce = n_coalesce;
8819
8820         return 0;
8821 error:
8822         for (i = 0; i < new_coalesce.n_rules; i++) {
8823                 tmp_rule = &new_coalesce.rules[i];
8824                 for (j = 0; j < tmp_rule->n_patterns; j++)
8825                         kfree(tmp_rule->patterns[j].mask);
8826                 kfree(tmp_rule->patterns);
8827         }
8828         kfree(new_coalesce.rules);
8829
8830         return err;
8831 }
8832
8833 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8834 {
8835         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8836         struct net_device *dev = info->user_ptr[1];
8837         struct wireless_dev *wdev = dev->ieee80211_ptr;
8838         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8839         struct cfg80211_gtk_rekey_data rekey_data;
8840         int err;
8841
8842         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8843                 return -EINVAL;
8844
8845         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8846                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8847                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8848                         nl80211_rekey_policy);
8849         if (err)
8850                 return err;
8851
8852         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8853                 return -ERANGE;
8854         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8855                 return -ERANGE;
8856         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8857                 return -ERANGE;
8858
8859         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8860                NL80211_KEK_LEN);
8861         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8862                NL80211_KCK_LEN);
8863         memcpy(rekey_data.replay_ctr,
8864                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8865                NL80211_REPLAY_CTR_LEN);
8866
8867         wdev_lock(wdev);
8868         if (!wdev->current_bss) {
8869                 err = -ENOTCONN;
8870                 goto out;
8871         }
8872
8873         if (!rdev->ops->set_rekey_data) {
8874                 err = -EOPNOTSUPP;
8875                 goto out;
8876         }
8877
8878         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8879  out:
8880         wdev_unlock(wdev);
8881         return err;
8882 }
8883
8884 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8885                                              struct genl_info *info)
8886 {
8887         struct net_device *dev = info->user_ptr[1];
8888         struct wireless_dev *wdev = dev->ieee80211_ptr;
8889
8890         if (wdev->iftype != NL80211_IFTYPE_AP &&
8891             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8892                 return -EINVAL;
8893
8894         if (wdev->ap_unexpected_nlportid)
8895                 return -EBUSY;
8896
8897         wdev->ap_unexpected_nlportid = info->snd_portid;
8898         return 0;
8899 }
8900
8901 static int nl80211_probe_client(struct sk_buff *skb,
8902                                 struct genl_info *info)
8903 {
8904         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8905         struct net_device *dev = info->user_ptr[1];
8906         struct wireless_dev *wdev = dev->ieee80211_ptr;
8907         struct sk_buff *msg;
8908         void *hdr;
8909         const u8 *addr;
8910         u64 cookie;
8911         int err;
8912
8913         if (wdev->iftype != NL80211_IFTYPE_AP &&
8914             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8915                 return -EOPNOTSUPP;
8916
8917         if (!info->attrs[NL80211_ATTR_MAC])
8918                 return -EINVAL;
8919
8920         if (!rdev->ops->probe_client)
8921                 return -EOPNOTSUPP;
8922
8923         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8924         if (!msg)
8925                 return -ENOMEM;
8926
8927         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8928                              NL80211_CMD_PROBE_CLIENT);
8929         if (!hdr) {
8930                 err = -ENOBUFS;
8931                 goto free_msg;
8932         }
8933
8934         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8935
8936         err = rdev_probe_client(rdev, dev, addr, &cookie);
8937         if (err)
8938                 goto free_msg;
8939
8940         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8941                 goto nla_put_failure;
8942
8943         genlmsg_end(msg, hdr);
8944
8945         return genlmsg_reply(msg, info);
8946
8947  nla_put_failure:
8948         err = -ENOBUFS;
8949  free_msg:
8950         nlmsg_free(msg);
8951         return err;
8952 }
8953
8954 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8955 {
8956         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8957         struct cfg80211_beacon_registration *reg, *nreg;
8958         int rv;
8959
8960         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8961                 return -EOPNOTSUPP;
8962
8963         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8964         if (!nreg)
8965                 return -ENOMEM;
8966
8967         /* First, check if already registered. */
8968         spin_lock_bh(&rdev->beacon_registrations_lock);
8969         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8970                 if (reg->nlportid == info->snd_portid) {
8971                         rv = -EALREADY;
8972                         goto out_err;
8973                 }
8974         }
8975         /* Add it to the list */
8976         nreg->nlportid = info->snd_portid;
8977         list_add(&nreg->list, &rdev->beacon_registrations);
8978
8979         spin_unlock_bh(&rdev->beacon_registrations_lock);
8980
8981         return 0;
8982 out_err:
8983         spin_unlock_bh(&rdev->beacon_registrations_lock);
8984         kfree(nreg);
8985         return rv;
8986 }
8987
8988 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8989 {
8990         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8991         struct wireless_dev *wdev = info->user_ptr[1];
8992         int err;
8993
8994         if (!rdev->ops->start_p2p_device)
8995                 return -EOPNOTSUPP;
8996
8997         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8998                 return -EOPNOTSUPP;
8999
9000         if (wdev->p2p_started)
9001                 return 0;
9002
9003         if (rfkill_blocked(rdev->rfkill))
9004                 return -ERFKILL;
9005
9006         err = rdev_start_p2p_device(rdev, wdev);
9007         if (err)
9008                 return err;
9009
9010         wdev->p2p_started = true;
9011         rdev->opencount++;
9012
9013         return 0;
9014 }
9015
9016 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
9017 {
9018         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9019         struct wireless_dev *wdev = info->user_ptr[1];
9020
9021         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9022                 return -EOPNOTSUPP;
9023
9024         if (!rdev->ops->stop_p2p_device)
9025                 return -EOPNOTSUPP;
9026
9027         cfg80211_stop_p2p_device(rdev, wdev);
9028
9029         return 0;
9030 }
9031
9032 static int nl80211_get_protocol_features(struct sk_buff *skb,
9033                                          struct genl_info *info)
9034 {
9035         void *hdr;
9036         struct sk_buff *msg;
9037
9038         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9039         if (!msg)
9040                 return -ENOMEM;
9041
9042         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9043                              NL80211_CMD_GET_PROTOCOL_FEATURES);
9044         if (!hdr)
9045                 goto nla_put_failure;
9046
9047         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
9048                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
9049                 goto nla_put_failure;
9050
9051         genlmsg_end(msg, hdr);
9052         return genlmsg_reply(msg, info);
9053
9054  nla_put_failure:
9055         kfree_skb(msg);
9056         return -ENOBUFS;
9057 }
9058
9059 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
9060 {
9061         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9062         struct cfg80211_update_ft_ies_params ft_params;
9063         struct net_device *dev = info->user_ptr[1];
9064
9065         if (!rdev->ops->update_ft_ies)
9066                 return -EOPNOTSUPP;
9067
9068         if (!info->attrs[NL80211_ATTR_MDID] ||
9069             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9070                 return -EINVAL;
9071
9072         memset(&ft_params, 0, sizeof(ft_params));
9073         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
9074         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9075         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9076
9077         return rdev_update_ft_ies(rdev, dev, &ft_params);
9078 }
9079
9080 static int nl80211_crit_protocol_start(struct sk_buff *skb,
9081                                        struct genl_info *info)
9082 {
9083         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9084         struct wireless_dev *wdev = info->user_ptr[1];
9085         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
9086         u16 duration;
9087         int ret;
9088
9089         if (!rdev->ops->crit_proto_start)
9090                 return -EOPNOTSUPP;
9091
9092         if (WARN_ON(!rdev->ops->crit_proto_stop))
9093                 return -EINVAL;
9094
9095         if (rdev->crit_proto_nlportid)
9096                 return -EBUSY;
9097
9098         /* determine protocol if provided */
9099         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
9100                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
9101
9102         if (proto >= NUM_NL80211_CRIT_PROTO)
9103                 return -EINVAL;
9104
9105         /* timeout must be provided */
9106         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
9107                 return -EINVAL;
9108
9109         duration =
9110                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
9111
9112         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
9113                 return -ERANGE;
9114
9115         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
9116         if (!ret)
9117                 rdev->crit_proto_nlportid = info->snd_portid;
9118
9119         return ret;
9120 }
9121
9122 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
9123                                       struct genl_info *info)
9124 {
9125         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9126         struct wireless_dev *wdev = info->user_ptr[1];
9127
9128         if (!rdev->ops->crit_proto_stop)
9129                 return -EOPNOTSUPP;
9130
9131         if (rdev->crit_proto_nlportid) {
9132                 rdev->crit_proto_nlportid = 0;
9133                 rdev_crit_proto_stop(rdev, wdev);
9134         }
9135         return 0;
9136 }
9137
9138 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
9139 {
9140         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9141         struct wireless_dev *wdev =
9142                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9143         int i, err;
9144         u32 vid, subcmd;
9145
9146         if (!rdev->wiphy.vendor_commands)
9147                 return -EOPNOTSUPP;
9148
9149         if (IS_ERR(wdev)) {
9150                 err = PTR_ERR(wdev);
9151                 if (err != -EINVAL)
9152                         return err;
9153                 wdev = NULL;
9154         } else if (wdev->wiphy != &rdev->wiphy) {
9155                 return -EINVAL;
9156         }
9157
9158         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9159             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9160                 return -EINVAL;
9161
9162         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9163         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9164         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9165                 const struct wiphy_vendor_command *vcmd;
9166                 void *data = NULL;
9167                 int len = 0;
9168
9169                 vcmd = &rdev->wiphy.vendor_commands[i];
9170
9171                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9172                         continue;
9173
9174                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9175                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9176                         if (!wdev)
9177                                 return -EINVAL;
9178                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9179                             !wdev->netdev)
9180                                 return -EINVAL;
9181
9182                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9183                                 if (wdev->netdev &&
9184                                     !netif_running(wdev->netdev))
9185                                         return -ENETDOWN;
9186                                 if (!wdev->netdev && !wdev->p2p_started)
9187                                         return -ENETDOWN;
9188                         }
9189                 } else {
9190                         wdev = NULL;
9191                 }
9192
9193                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9194                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9195                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9196                 }
9197
9198                 rdev->cur_cmd_info = info;
9199                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9200                                                           data, len);
9201                 rdev->cur_cmd_info = NULL;
9202                 return err;
9203         }
9204
9205         return -EOPNOTSUPP;
9206 }
9207
9208 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
9209                                            enum nl80211_commands cmd,
9210                                            enum nl80211_attrs attr,
9211                                            int approxlen)
9212 {
9213         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9214
9215         if (WARN_ON(!rdev->cur_cmd_info))
9216                 return NULL;
9217
9218         return __cfg80211_alloc_vendor_skb(rdev, approxlen,
9219                                            rdev->cur_cmd_info->snd_portid,
9220                                            rdev->cur_cmd_info->snd_seq,
9221                                            cmd, attr, NULL, GFP_KERNEL);
9222 }
9223 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
9224
9225 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
9226 {
9227         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9228         void *hdr = ((void **)skb->cb)[1];
9229         struct nlattr *data = ((void **)skb->cb)[2];
9230
9231         if (WARN_ON(!rdev->cur_cmd_info)) {
9232                 kfree_skb(skb);
9233                 return -EINVAL;
9234         }
9235
9236         nla_nest_end(skb, data);
9237         genlmsg_end(skb, hdr);
9238         return genlmsg_reply(skb, rdev->cur_cmd_info);
9239 }
9240 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
9241
9242
9243 static int nl80211_set_qos_map(struct sk_buff *skb,
9244                                struct genl_info *info)
9245 {
9246         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9247         struct cfg80211_qos_map *qos_map = NULL;
9248         struct net_device *dev = info->user_ptr[1];
9249         u8 *pos, len, num_des, des_len, des;
9250         int ret;
9251
9252         if (!rdev->ops->set_qos_map)
9253                 return -EOPNOTSUPP;
9254
9255         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
9256                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
9257                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
9258
9259                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
9260                     len > IEEE80211_QOS_MAP_LEN_MAX)
9261                         return -EINVAL;
9262
9263                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
9264                 if (!qos_map)
9265                         return -ENOMEM;
9266
9267                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
9268                 if (num_des) {
9269                         des_len = num_des *
9270                                 sizeof(struct cfg80211_dscp_exception);
9271                         memcpy(qos_map->dscp_exception, pos, des_len);
9272                         qos_map->num_des = num_des;
9273                         for (des = 0; des < num_des; des++) {
9274                                 if (qos_map->dscp_exception[des].up > 7) {
9275                                         kfree(qos_map);
9276                                         return -EINVAL;
9277                                 }
9278                         }
9279                         pos += des_len;
9280                 }
9281                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
9282         }
9283
9284         wdev_lock(dev->ieee80211_ptr);
9285         ret = nl80211_key_allowed(dev->ieee80211_ptr);
9286         if (!ret)
9287                 ret = rdev_set_qos_map(rdev, dev, qos_map);
9288         wdev_unlock(dev->ieee80211_ptr);
9289
9290         kfree(qos_map);
9291         return ret;
9292 }
9293
9294 #define NL80211_FLAG_NEED_WIPHY         0x01
9295 #define NL80211_FLAG_NEED_NETDEV        0x02
9296 #define NL80211_FLAG_NEED_RTNL          0x04
9297 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
9298 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
9299                                          NL80211_FLAG_CHECK_NETDEV_UP)
9300 #define NL80211_FLAG_NEED_WDEV          0x10
9301 /* If a netdev is associated, it must be UP, P2P must be started */
9302 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
9303                                          NL80211_FLAG_CHECK_NETDEV_UP)
9304
9305 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
9306                             struct genl_info *info)
9307 {
9308         struct cfg80211_registered_device *rdev;
9309         struct wireless_dev *wdev;
9310         struct net_device *dev;
9311         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
9312
9313         if (rtnl)
9314                 rtnl_lock();
9315
9316         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
9317                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9318                 if (IS_ERR(rdev)) {
9319                         if (rtnl)
9320                                 rtnl_unlock();
9321                         return PTR_ERR(rdev);
9322                 }
9323                 info->user_ptr[0] = rdev;
9324         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
9325                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9326                 ASSERT_RTNL();
9327
9328                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
9329                                                   info->attrs);
9330                 if (IS_ERR(wdev)) {
9331                         if (rtnl)
9332                                 rtnl_unlock();
9333                         return PTR_ERR(wdev);
9334                 }
9335
9336                 dev = wdev->netdev;
9337                 rdev = wiphy_to_rdev(wdev->wiphy);
9338
9339                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
9340                         if (!dev) {
9341                                 if (rtnl)
9342                                         rtnl_unlock();
9343                                 return -EINVAL;
9344                         }
9345
9346                         info->user_ptr[1] = dev;
9347                 } else {
9348                         info->user_ptr[1] = wdev;
9349                 }
9350
9351                 if (dev) {
9352                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
9353                             !netif_running(dev)) {
9354                                 if (rtnl)
9355                                         rtnl_unlock();
9356                                 return -ENETDOWN;
9357                         }
9358
9359                         dev_hold(dev);
9360                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
9361                         if (!wdev->p2p_started) {
9362                                 if (rtnl)
9363                                         rtnl_unlock();
9364                                 return -ENETDOWN;
9365                         }
9366                 }
9367
9368                 info->user_ptr[0] = rdev;
9369         }
9370
9371         return 0;
9372 }
9373
9374 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
9375                               struct genl_info *info)
9376 {
9377         if (info->user_ptr[1]) {
9378                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9379                         struct wireless_dev *wdev = info->user_ptr[1];
9380
9381                         if (wdev->netdev)
9382                                 dev_put(wdev->netdev);
9383                 } else {
9384                         dev_put(info->user_ptr[1]);
9385                 }
9386         }
9387         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
9388                 rtnl_unlock();
9389 }
9390
9391 static const struct genl_ops nl80211_ops[] = {
9392         {
9393                 .cmd = NL80211_CMD_GET_WIPHY,
9394                 .doit = nl80211_get_wiphy,
9395                 .dumpit = nl80211_dump_wiphy,
9396                 .done = nl80211_dump_wiphy_done,
9397                 .policy = nl80211_policy,
9398                 /* can be retrieved by unprivileged users */
9399                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9400                                   NL80211_FLAG_NEED_RTNL,
9401         },
9402         {
9403                 .cmd = NL80211_CMD_SET_WIPHY,
9404                 .doit = nl80211_set_wiphy,
9405                 .policy = nl80211_policy,
9406                 .flags = GENL_ADMIN_PERM,
9407                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9408         },
9409         {
9410                 .cmd = NL80211_CMD_GET_INTERFACE,
9411                 .doit = nl80211_get_interface,
9412                 .dumpit = nl80211_dump_interface,
9413                 .policy = nl80211_policy,
9414                 /* can be retrieved by unprivileged users */
9415                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9416                                   NL80211_FLAG_NEED_RTNL,
9417         },
9418         {
9419                 .cmd = NL80211_CMD_SET_INTERFACE,
9420                 .doit = nl80211_set_interface,
9421                 .policy = nl80211_policy,
9422                 .flags = GENL_ADMIN_PERM,
9423                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9424                                   NL80211_FLAG_NEED_RTNL,
9425         },
9426         {
9427                 .cmd = NL80211_CMD_NEW_INTERFACE,
9428                 .doit = nl80211_new_interface,
9429                 .policy = nl80211_policy,
9430                 .flags = GENL_ADMIN_PERM,
9431                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9432                                   NL80211_FLAG_NEED_RTNL,
9433         },
9434         {
9435                 .cmd = NL80211_CMD_DEL_INTERFACE,
9436                 .doit = nl80211_del_interface,
9437                 .policy = nl80211_policy,
9438                 .flags = GENL_ADMIN_PERM,
9439                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9440                                   NL80211_FLAG_NEED_RTNL,
9441         },
9442         {
9443                 .cmd = NL80211_CMD_GET_KEY,
9444                 .doit = nl80211_get_key,
9445                 .policy = nl80211_policy,
9446                 .flags = GENL_ADMIN_PERM,
9447                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9448                                   NL80211_FLAG_NEED_RTNL,
9449         },
9450         {
9451                 .cmd = NL80211_CMD_SET_KEY,
9452                 .doit = nl80211_set_key,
9453                 .policy = nl80211_policy,
9454                 .flags = GENL_ADMIN_PERM,
9455                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9456                                   NL80211_FLAG_NEED_RTNL,
9457         },
9458         {
9459                 .cmd = NL80211_CMD_NEW_KEY,
9460                 .doit = nl80211_new_key,
9461                 .policy = nl80211_policy,
9462                 .flags = GENL_ADMIN_PERM,
9463                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9464                                   NL80211_FLAG_NEED_RTNL,
9465         },
9466         {
9467                 .cmd = NL80211_CMD_DEL_KEY,
9468                 .doit = nl80211_del_key,
9469                 .policy = nl80211_policy,
9470                 .flags = GENL_ADMIN_PERM,
9471                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9472                                   NL80211_FLAG_NEED_RTNL,
9473         },
9474         {
9475                 .cmd = NL80211_CMD_SET_BEACON,
9476                 .policy = nl80211_policy,
9477                 .flags = GENL_ADMIN_PERM,
9478                 .doit = nl80211_set_beacon,
9479                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9480                                   NL80211_FLAG_NEED_RTNL,
9481         },
9482         {
9483                 .cmd = NL80211_CMD_START_AP,
9484                 .policy = nl80211_policy,
9485                 .flags = GENL_ADMIN_PERM,
9486                 .doit = nl80211_start_ap,
9487                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9488                                   NL80211_FLAG_NEED_RTNL,
9489         },
9490         {
9491                 .cmd = NL80211_CMD_STOP_AP,
9492                 .policy = nl80211_policy,
9493                 .flags = GENL_ADMIN_PERM,
9494                 .doit = nl80211_stop_ap,
9495                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9496                                   NL80211_FLAG_NEED_RTNL,
9497         },
9498         {
9499                 .cmd = NL80211_CMD_GET_STATION,
9500                 .doit = nl80211_get_station,
9501                 .dumpit = nl80211_dump_station,
9502                 .policy = nl80211_policy,
9503                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9504                                   NL80211_FLAG_NEED_RTNL,
9505         },
9506         {
9507                 .cmd = NL80211_CMD_SET_STATION,
9508                 .doit = nl80211_set_station,
9509                 .policy = nl80211_policy,
9510                 .flags = GENL_ADMIN_PERM,
9511                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9512                                   NL80211_FLAG_NEED_RTNL,
9513         },
9514         {
9515                 .cmd = NL80211_CMD_NEW_STATION,
9516                 .doit = nl80211_new_station,
9517                 .policy = nl80211_policy,
9518                 .flags = GENL_ADMIN_PERM,
9519                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9520                                   NL80211_FLAG_NEED_RTNL,
9521         },
9522         {
9523                 .cmd = NL80211_CMD_DEL_STATION,
9524                 .doit = nl80211_del_station,
9525                 .policy = nl80211_policy,
9526                 .flags = GENL_ADMIN_PERM,
9527                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9528                                   NL80211_FLAG_NEED_RTNL,
9529         },
9530         {
9531                 .cmd = NL80211_CMD_GET_MPATH,
9532                 .doit = nl80211_get_mpath,
9533                 .dumpit = nl80211_dump_mpath,
9534                 .policy = nl80211_policy,
9535                 .flags = GENL_ADMIN_PERM,
9536                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9537                                   NL80211_FLAG_NEED_RTNL,
9538         },
9539         {
9540                 .cmd = NL80211_CMD_SET_MPATH,
9541                 .doit = nl80211_set_mpath,
9542                 .policy = nl80211_policy,
9543                 .flags = GENL_ADMIN_PERM,
9544                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9545                                   NL80211_FLAG_NEED_RTNL,
9546         },
9547         {
9548                 .cmd = NL80211_CMD_NEW_MPATH,
9549                 .doit = nl80211_new_mpath,
9550                 .policy = nl80211_policy,
9551                 .flags = GENL_ADMIN_PERM,
9552                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9553                                   NL80211_FLAG_NEED_RTNL,
9554         },
9555         {
9556                 .cmd = NL80211_CMD_DEL_MPATH,
9557                 .doit = nl80211_del_mpath,
9558                 .policy = nl80211_policy,
9559                 .flags = GENL_ADMIN_PERM,
9560                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9561                                   NL80211_FLAG_NEED_RTNL,
9562         },
9563         {
9564                 .cmd = NL80211_CMD_SET_BSS,
9565                 .doit = nl80211_set_bss,
9566                 .policy = nl80211_policy,
9567                 .flags = GENL_ADMIN_PERM,
9568                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9569                                   NL80211_FLAG_NEED_RTNL,
9570         },
9571         {
9572                 .cmd = NL80211_CMD_GET_REG,
9573                 .doit = nl80211_get_reg,
9574                 .policy = nl80211_policy,
9575                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9576                 /* can be retrieved by unprivileged users */
9577         },
9578         {
9579                 .cmd = NL80211_CMD_SET_REG,
9580                 .doit = nl80211_set_reg,
9581                 .policy = nl80211_policy,
9582                 .flags = GENL_ADMIN_PERM,
9583                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9584         },
9585         {
9586                 .cmd = NL80211_CMD_REQ_SET_REG,
9587                 .doit = nl80211_req_set_reg,
9588                 .policy = nl80211_policy,
9589                 .flags = GENL_ADMIN_PERM,
9590         },
9591         {
9592                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
9593                 .doit = nl80211_get_mesh_config,
9594                 .policy = nl80211_policy,
9595                 /* can be retrieved by unprivileged users */
9596                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9597                                   NL80211_FLAG_NEED_RTNL,
9598         },
9599         {
9600                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
9601                 .doit = nl80211_update_mesh_config,
9602                 .policy = nl80211_policy,
9603                 .flags = GENL_ADMIN_PERM,
9604                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9605                                   NL80211_FLAG_NEED_RTNL,
9606         },
9607         {
9608                 .cmd = NL80211_CMD_TRIGGER_SCAN,
9609                 .doit = nl80211_trigger_scan,
9610                 .policy = nl80211_policy,
9611                 .flags = GENL_ADMIN_PERM,
9612                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9613                                   NL80211_FLAG_NEED_RTNL,
9614         },
9615         {
9616                 .cmd = NL80211_CMD_GET_SCAN,
9617                 .policy = nl80211_policy,
9618                 .dumpit = nl80211_dump_scan,
9619         },
9620         {
9621                 .cmd = NL80211_CMD_START_SCHED_SCAN,
9622                 .doit = nl80211_start_sched_scan,
9623                 .policy = nl80211_policy,
9624                 .flags = GENL_ADMIN_PERM,
9625                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9626                                   NL80211_FLAG_NEED_RTNL,
9627         },
9628         {
9629                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
9630                 .doit = nl80211_stop_sched_scan,
9631                 .policy = nl80211_policy,
9632                 .flags = GENL_ADMIN_PERM,
9633                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9634                                   NL80211_FLAG_NEED_RTNL,
9635         },
9636         {
9637                 .cmd = NL80211_CMD_AUTHENTICATE,
9638                 .doit = nl80211_authenticate,
9639                 .policy = nl80211_policy,
9640                 .flags = GENL_ADMIN_PERM,
9641                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9642                                   NL80211_FLAG_NEED_RTNL,
9643         },
9644         {
9645                 .cmd = NL80211_CMD_ASSOCIATE,
9646                 .doit = nl80211_associate,
9647                 .policy = nl80211_policy,
9648                 .flags = GENL_ADMIN_PERM,
9649                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9650                                   NL80211_FLAG_NEED_RTNL,
9651         },
9652         {
9653                 .cmd = NL80211_CMD_DEAUTHENTICATE,
9654                 .doit = nl80211_deauthenticate,
9655                 .policy = nl80211_policy,
9656                 .flags = GENL_ADMIN_PERM,
9657                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9658                                   NL80211_FLAG_NEED_RTNL,
9659         },
9660         {
9661                 .cmd = NL80211_CMD_DISASSOCIATE,
9662                 .doit = nl80211_disassociate,
9663                 .policy = nl80211_policy,
9664                 .flags = GENL_ADMIN_PERM,
9665                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9666                                   NL80211_FLAG_NEED_RTNL,
9667         },
9668         {
9669                 .cmd = NL80211_CMD_JOIN_IBSS,
9670                 .doit = nl80211_join_ibss,
9671                 .policy = nl80211_policy,
9672                 .flags = GENL_ADMIN_PERM,
9673                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9674                                   NL80211_FLAG_NEED_RTNL,
9675         },
9676         {
9677                 .cmd = NL80211_CMD_LEAVE_IBSS,
9678                 .doit = nl80211_leave_ibss,
9679                 .policy = nl80211_policy,
9680                 .flags = GENL_ADMIN_PERM,
9681                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9682                                   NL80211_FLAG_NEED_RTNL,
9683         },
9684 #ifdef CONFIG_NL80211_TESTMODE
9685         {
9686                 .cmd = NL80211_CMD_TESTMODE,
9687                 .doit = nl80211_testmode_do,
9688                 .dumpit = nl80211_testmode_dump,
9689                 .policy = nl80211_policy,
9690                 .flags = GENL_ADMIN_PERM,
9691                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9692                                   NL80211_FLAG_NEED_RTNL,
9693         },
9694 #endif
9695         {
9696                 .cmd = NL80211_CMD_CONNECT,
9697                 .doit = nl80211_connect,
9698                 .policy = nl80211_policy,
9699                 .flags = GENL_ADMIN_PERM,
9700                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9701                                   NL80211_FLAG_NEED_RTNL,
9702         },
9703         {
9704                 .cmd = NL80211_CMD_DISCONNECT,
9705                 .doit = nl80211_disconnect,
9706                 .policy = nl80211_policy,
9707                 .flags = GENL_ADMIN_PERM,
9708                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9709                                   NL80211_FLAG_NEED_RTNL,
9710         },
9711         {
9712                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
9713                 .doit = nl80211_wiphy_netns,
9714                 .policy = nl80211_policy,
9715                 .flags = GENL_ADMIN_PERM,
9716                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9717                                   NL80211_FLAG_NEED_RTNL,
9718         },
9719         {
9720                 .cmd = NL80211_CMD_GET_SURVEY,
9721                 .policy = nl80211_policy,
9722                 .dumpit = nl80211_dump_survey,
9723         },
9724         {
9725                 .cmd = NL80211_CMD_SET_PMKSA,
9726                 .doit = nl80211_setdel_pmksa,
9727                 .policy = nl80211_policy,
9728                 .flags = GENL_ADMIN_PERM,
9729                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9730                                   NL80211_FLAG_NEED_RTNL,
9731         },
9732         {
9733                 .cmd = NL80211_CMD_DEL_PMKSA,
9734                 .doit = nl80211_setdel_pmksa,
9735                 .policy = nl80211_policy,
9736                 .flags = GENL_ADMIN_PERM,
9737                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9738                                   NL80211_FLAG_NEED_RTNL,
9739         },
9740         {
9741                 .cmd = NL80211_CMD_FLUSH_PMKSA,
9742                 .doit = nl80211_flush_pmksa,
9743                 .policy = nl80211_policy,
9744                 .flags = GENL_ADMIN_PERM,
9745                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9746                                   NL80211_FLAG_NEED_RTNL,
9747         },
9748         {
9749                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
9750                 .doit = nl80211_remain_on_channel,
9751                 .policy = nl80211_policy,
9752                 .flags = GENL_ADMIN_PERM,
9753                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9754                                   NL80211_FLAG_NEED_RTNL,
9755         },
9756         {
9757                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9758                 .doit = nl80211_cancel_remain_on_channel,
9759                 .policy = nl80211_policy,
9760                 .flags = GENL_ADMIN_PERM,
9761                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9762                                   NL80211_FLAG_NEED_RTNL,
9763         },
9764         {
9765                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
9766                 .doit = nl80211_set_tx_bitrate_mask,
9767                 .policy = nl80211_policy,
9768                 .flags = GENL_ADMIN_PERM,
9769                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9770                                   NL80211_FLAG_NEED_RTNL,
9771         },
9772         {
9773                 .cmd = NL80211_CMD_REGISTER_FRAME,
9774                 .doit = nl80211_register_mgmt,
9775                 .policy = nl80211_policy,
9776                 .flags = GENL_ADMIN_PERM,
9777                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9778                                   NL80211_FLAG_NEED_RTNL,
9779         },
9780         {
9781                 .cmd = NL80211_CMD_FRAME,
9782                 .doit = nl80211_tx_mgmt,
9783                 .policy = nl80211_policy,
9784                 .flags = GENL_ADMIN_PERM,
9785                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9786                                   NL80211_FLAG_NEED_RTNL,
9787         },
9788         {
9789                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
9790                 .doit = nl80211_tx_mgmt_cancel_wait,
9791                 .policy = nl80211_policy,
9792                 .flags = GENL_ADMIN_PERM,
9793                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9794                                   NL80211_FLAG_NEED_RTNL,
9795         },
9796         {
9797                 .cmd = NL80211_CMD_SET_POWER_SAVE,
9798                 .doit = nl80211_set_power_save,
9799                 .policy = nl80211_policy,
9800                 .flags = GENL_ADMIN_PERM,
9801                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9802                                   NL80211_FLAG_NEED_RTNL,
9803         },
9804         {
9805                 .cmd = NL80211_CMD_GET_POWER_SAVE,
9806                 .doit = nl80211_get_power_save,
9807                 .policy = nl80211_policy,
9808                 /* can be retrieved by unprivileged users */
9809                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9810                                   NL80211_FLAG_NEED_RTNL,
9811         },
9812         {
9813                 .cmd = NL80211_CMD_SET_CQM,
9814                 .doit = nl80211_set_cqm,
9815                 .policy = nl80211_policy,
9816                 .flags = GENL_ADMIN_PERM,
9817                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9818                                   NL80211_FLAG_NEED_RTNL,
9819         },
9820         {
9821                 .cmd = NL80211_CMD_SET_CHANNEL,
9822                 .doit = nl80211_set_channel,
9823                 .policy = nl80211_policy,
9824                 .flags = GENL_ADMIN_PERM,
9825                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9826                                   NL80211_FLAG_NEED_RTNL,
9827         },
9828         {
9829                 .cmd = NL80211_CMD_SET_WDS_PEER,
9830                 .doit = nl80211_set_wds_peer,
9831                 .policy = nl80211_policy,
9832                 .flags = GENL_ADMIN_PERM,
9833                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9834                                   NL80211_FLAG_NEED_RTNL,
9835         },
9836         {
9837                 .cmd = NL80211_CMD_JOIN_MESH,
9838                 .doit = nl80211_join_mesh,
9839                 .policy = nl80211_policy,
9840                 .flags = GENL_ADMIN_PERM,
9841                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9842                                   NL80211_FLAG_NEED_RTNL,
9843         },
9844         {
9845                 .cmd = NL80211_CMD_LEAVE_MESH,
9846                 .doit = nl80211_leave_mesh,
9847                 .policy = nl80211_policy,
9848                 .flags = GENL_ADMIN_PERM,
9849                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9850                                   NL80211_FLAG_NEED_RTNL,
9851         },
9852 #ifdef CONFIG_PM
9853         {
9854                 .cmd = NL80211_CMD_GET_WOWLAN,
9855                 .doit = nl80211_get_wowlan,
9856                 .policy = nl80211_policy,
9857                 /* can be retrieved by unprivileged users */
9858                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9859                                   NL80211_FLAG_NEED_RTNL,
9860         },
9861         {
9862                 .cmd = NL80211_CMD_SET_WOWLAN,
9863                 .doit = nl80211_set_wowlan,
9864                 .policy = nl80211_policy,
9865                 .flags = GENL_ADMIN_PERM,
9866                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9867                                   NL80211_FLAG_NEED_RTNL,
9868         },
9869 #endif
9870         {
9871                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
9872                 .doit = nl80211_set_rekey_data,
9873                 .policy = nl80211_policy,
9874                 .flags = GENL_ADMIN_PERM,
9875                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9876                                   NL80211_FLAG_NEED_RTNL,
9877         },
9878         {
9879                 .cmd = NL80211_CMD_TDLS_MGMT,
9880                 .doit = nl80211_tdls_mgmt,
9881                 .policy = nl80211_policy,
9882                 .flags = GENL_ADMIN_PERM,
9883                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9884                                   NL80211_FLAG_NEED_RTNL,
9885         },
9886         {
9887                 .cmd = NL80211_CMD_TDLS_OPER,
9888                 .doit = nl80211_tdls_oper,
9889                 .policy = nl80211_policy,
9890                 .flags = GENL_ADMIN_PERM,
9891                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9892                                   NL80211_FLAG_NEED_RTNL,
9893         },
9894         {
9895                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
9896                 .doit = nl80211_register_unexpected_frame,
9897                 .policy = nl80211_policy,
9898                 .flags = GENL_ADMIN_PERM,
9899                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9900                                   NL80211_FLAG_NEED_RTNL,
9901         },
9902         {
9903                 .cmd = NL80211_CMD_PROBE_CLIENT,
9904                 .doit = nl80211_probe_client,
9905                 .policy = nl80211_policy,
9906                 .flags = GENL_ADMIN_PERM,
9907                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9908                                   NL80211_FLAG_NEED_RTNL,
9909         },
9910         {
9911                 .cmd = NL80211_CMD_REGISTER_BEACONS,
9912                 .doit = nl80211_register_beacons,
9913                 .policy = nl80211_policy,
9914                 .flags = GENL_ADMIN_PERM,
9915                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9916                                   NL80211_FLAG_NEED_RTNL,
9917         },
9918         {
9919                 .cmd = NL80211_CMD_SET_NOACK_MAP,
9920                 .doit = nl80211_set_noack_map,
9921                 .policy = nl80211_policy,
9922                 .flags = GENL_ADMIN_PERM,
9923                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9924                                   NL80211_FLAG_NEED_RTNL,
9925         },
9926         {
9927                 .cmd = NL80211_CMD_START_P2P_DEVICE,
9928                 .doit = nl80211_start_p2p_device,
9929                 .policy = nl80211_policy,
9930                 .flags = GENL_ADMIN_PERM,
9931                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9932                                   NL80211_FLAG_NEED_RTNL,
9933         },
9934         {
9935                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
9936                 .doit = nl80211_stop_p2p_device,
9937                 .policy = nl80211_policy,
9938                 .flags = GENL_ADMIN_PERM,
9939                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9940                                   NL80211_FLAG_NEED_RTNL,
9941         },
9942         {
9943                 .cmd = NL80211_CMD_SET_MCAST_RATE,
9944                 .doit = nl80211_set_mcast_rate,
9945                 .policy = nl80211_policy,
9946                 .flags = GENL_ADMIN_PERM,
9947                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9948                                   NL80211_FLAG_NEED_RTNL,
9949         },
9950         {
9951                 .cmd = NL80211_CMD_SET_MAC_ACL,
9952                 .doit = nl80211_set_mac_acl,
9953                 .policy = nl80211_policy,
9954                 .flags = GENL_ADMIN_PERM,
9955                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9956                                   NL80211_FLAG_NEED_RTNL,
9957         },
9958         {
9959                 .cmd = NL80211_CMD_RADAR_DETECT,
9960                 .doit = nl80211_start_radar_detection,
9961                 .policy = nl80211_policy,
9962                 .flags = GENL_ADMIN_PERM,
9963                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9964                                   NL80211_FLAG_NEED_RTNL,
9965         },
9966         {
9967                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
9968                 .doit = nl80211_get_protocol_features,
9969                 .policy = nl80211_policy,
9970         },
9971         {
9972                 .cmd = NL80211_CMD_UPDATE_FT_IES,
9973                 .doit = nl80211_update_ft_ies,
9974                 .policy = nl80211_policy,
9975                 .flags = GENL_ADMIN_PERM,
9976                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9977                                   NL80211_FLAG_NEED_RTNL,
9978         },
9979         {
9980                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
9981                 .doit = nl80211_crit_protocol_start,
9982                 .policy = nl80211_policy,
9983                 .flags = GENL_ADMIN_PERM,
9984                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9985                                   NL80211_FLAG_NEED_RTNL,
9986         },
9987         {
9988                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
9989                 .doit = nl80211_crit_protocol_stop,
9990                 .policy = nl80211_policy,
9991                 .flags = GENL_ADMIN_PERM,
9992                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9993                                   NL80211_FLAG_NEED_RTNL,
9994         },
9995         {
9996                 .cmd = NL80211_CMD_GET_COALESCE,
9997                 .doit = nl80211_get_coalesce,
9998                 .policy = nl80211_policy,
9999                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10000                                   NL80211_FLAG_NEED_RTNL,
10001         },
10002         {
10003                 .cmd = NL80211_CMD_SET_COALESCE,
10004                 .doit = nl80211_set_coalesce,
10005                 .policy = nl80211_policy,
10006                 .flags = GENL_ADMIN_PERM,
10007                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10008                                   NL80211_FLAG_NEED_RTNL,
10009         },
10010         {
10011                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
10012                 .doit = nl80211_channel_switch,
10013                 .policy = nl80211_policy,
10014                 .flags = GENL_ADMIN_PERM,
10015                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10016                                   NL80211_FLAG_NEED_RTNL,
10017         },
10018         {
10019                 .cmd = NL80211_CMD_VENDOR,
10020                 .doit = nl80211_vendor_cmd,
10021                 .policy = nl80211_policy,
10022                 .flags = GENL_ADMIN_PERM,
10023                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10024                                   NL80211_FLAG_NEED_RTNL,
10025         },
10026         {
10027                 .cmd = NL80211_CMD_SET_QOS_MAP,
10028                 .doit = nl80211_set_qos_map,
10029                 .policy = nl80211_policy,
10030                 .flags = GENL_ADMIN_PERM,
10031                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10032                                   NL80211_FLAG_NEED_RTNL,
10033         },
10034 };
10035
10036 /* notification functions */
10037
10038 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
10039 {
10040         struct sk_buff *msg;
10041         struct nl80211_dump_wiphy_state state = {};
10042
10043         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10044         if (!msg)
10045                 return;
10046
10047         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
10048                 nlmsg_free(msg);
10049                 return;
10050         }
10051
10052         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10053                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
10054 }
10055
10056 static int nl80211_add_scan_req(struct sk_buff *msg,
10057                                 struct cfg80211_registered_device *rdev)
10058 {
10059         struct cfg80211_scan_request *req = rdev->scan_req;
10060         struct nlattr *nest;
10061         int i;
10062
10063         if (WARN_ON(!req))
10064                 return 0;
10065
10066         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
10067         if (!nest)
10068                 goto nla_put_failure;
10069         for (i = 0; i < req->n_ssids; i++) {
10070                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
10071                         goto nla_put_failure;
10072         }
10073         nla_nest_end(msg, nest);
10074
10075         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10076         if (!nest)
10077                 goto nla_put_failure;
10078         for (i = 0; i < req->n_channels; i++) {
10079                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10080                         goto nla_put_failure;
10081         }
10082         nla_nest_end(msg, nest);
10083
10084         if (req->ie &&
10085             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
10086                 goto nla_put_failure;
10087
10088         if (req->flags &&
10089             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
10090                 goto nla_put_failure;
10091
10092         return 0;
10093  nla_put_failure:
10094         return -ENOBUFS;
10095 }
10096
10097 static int nl80211_send_scan_msg(struct sk_buff *msg,
10098                                  struct cfg80211_registered_device *rdev,
10099                                  struct wireless_dev *wdev,
10100                                  u32 portid, u32 seq, int flags,
10101                                  u32 cmd)
10102 {
10103         void *hdr;
10104
10105         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10106         if (!hdr)
10107                 return -1;
10108
10109         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10110             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10111                                          wdev->netdev->ifindex)) ||
10112             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10113                 goto nla_put_failure;
10114
10115         /* ignore errors and send incomplete event anyway */
10116         nl80211_add_scan_req(msg, rdev);
10117
10118         return genlmsg_end(msg, hdr);
10119
10120  nla_put_failure:
10121         genlmsg_cancel(msg, hdr);
10122         return -EMSGSIZE;
10123 }
10124
10125 static int
10126 nl80211_send_sched_scan_msg(struct sk_buff *msg,
10127                             struct cfg80211_registered_device *rdev,
10128                             struct net_device *netdev,
10129                             u32 portid, u32 seq, int flags, u32 cmd)
10130 {
10131         void *hdr;
10132
10133         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10134         if (!hdr)
10135                 return -1;
10136
10137         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10138             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10139                 goto nla_put_failure;
10140
10141         return genlmsg_end(msg, hdr);
10142
10143  nla_put_failure:
10144         genlmsg_cancel(msg, hdr);
10145         return -EMSGSIZE;
10146 }
10147
10148 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
10149                              struct wireless_dev *wdev)
10150 {
10151         struct sk_buff *msg;
10152
10153         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10154         if (!msg)
10155                 return;
10156
10157         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10158                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
10159                 nlmsg_free(msg);
10160                 return;
10161         }
10162
10163         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10164                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10165 }
10166
10167 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
10168                                        struct wireless_dev *wdev, bool aborted)
10169 {
10170         struct sk_buff *msg;
10171
10172         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10173         if (!msg)
10174                 return NULL;
10175
10176         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10177                                   aborted ? NL80211_CMD_SCAN_ABORTED :
10178                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
10179                 nlmsg_free(msg);
10180                 return NULL;
10181         }
10182
10183         return msg;
10184 }
10185
10186 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
10187                               struct sk_buff *msg)
10188 {
10189         if (!msg)
10190                 return;
10191
10192         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10193                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10194 }
10195
10196 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
10197                                      struct net_device *netdev)
10198 {
10199         struct sk_buff *msg;
10200
10201         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10202         if (!msg)
10203                 return;
10204
10205         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
10206                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
10207                 nlmsg_free(msg);
10208                 return;
10209         }
10210
10211         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10212                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10213 }
10214
10215 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
10216                              struct net_device *netdev, u32 cmd)
10217 {
10218         struct sk_buff *msg;
10219
10220         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10221         if (!msg)
10222                 return;
10223
10224         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
10225                 nlmsg_free(msg);
10226                 return;
10227         }
10228
10229         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10230                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10231 }
10232
10233 /*
10234  * This can happen on global regulatory changes or device specific settings
10235  * based on custom world regulatory domains.
10236  */
10237 void nl80211_send_reg_change_event(struct regulatory_request *request)
10238 {
10239         struct sk_buff *msg;
10240         void *hdr;
10241
10242         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10243         if (!msg)
10244                 return;
10245
10246         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
10247         if (!hdr) {
10248                 nlmsg_free(msg);
10249                 return;
10250         }
10251
10252         /* Userspace can always count this one always being set */
10253         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
10254                 goto nla_put_failure;
10255
10256         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
10257                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10258                                NL80211_REGDOM_TYPE_WORLD))
10259                         goto nla_put_failure;
10260         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
10261                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10262                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
10263                         goto nla_put_failure;
10264         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
10265                    request->intersect) {
10266                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10267                                NL80211_REGDOM_TYPE_INTERSECTION))
10268                         goto nla_put_failure;
10269         } else {
10270                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10271                                NL80211_REGDOM_TYPE_COUNTRY) ||
10272                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
10273                                    request->alpha2))
10274                         goto nla_put_failure;
10275         }
10276
10277         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
10278             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
10279                 goto nla_put_failure;
10280
10281         genlmsg_end(msg, hdr);
10282
10283         rcu_read_lock();
10284         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10285                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10286         rcu_read_unlock();
10287
10288         return;
10289
10290 nla_put_failure:
10291         genlmsg_cancel(msg, hdr);
10292         nlmsg_free(msg);
10293 }
10294
10295 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
10296                                     struct net_device *netdev,
10297                                     const u8 *buf, size_t len,
10298                                     enum nl80211_commands cmd, gfp_t gfp)
10299 {
10300         struct sk_buff *msg;
10301         void *hdr;
10302
10303         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10304         if (!msg)
10305                 return;
10306
10307         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10308         if (!hdr) {
10309                 nlmsg_free(msg);
10310                 return;
10311         }
10312
10313         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10314             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10315             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
10316                 goto nla_put_failure;
10317
10318         genlmsg_end(msg, hdr);
10319
10320         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10321                                 NL80211_MCGRP_MLME, gfp);
10322         return;
10323
10324  nla_put_failure:
10325         genlmsg_cancel(msg, hdr);
10326         nlmsg_free(msg);
10327 }
10328
10329 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
10330                           struct net_device *netdev, const u8 *buf,
10331                           size_t len, gfp_t gfp)
10332 {
10333         nl80211_send_mlme_event(rdev, netdev, buf, len,
10334                                 NL80211_CMD_AUTHENTICATE, gfp);
10335 }
10336
10337 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
10338                            struct net_device *netdev, const u8 *buf,
10339                            size_t len, gfp_t gfp)
10340 {
10341         nl80211_send_mlme_event(rdev, netdev, buf, len,
10342                                 NL80211_CMD_ASSOCIATE, gfp);
10343 }
10344
10345 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
10346                          struct net_device *netdev, const u8 *buf,
10347                          size_t len, gfp_t gfp)
10348 {
10349         nl80211_send_mlme_event(rdev, netdev, buf, len,
10350                                 NL80211_CMD_DEAUTHENTICATE, gfp);
10351 }
10352
10353 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
10354                            struct net_device *netdev, const u8 *buf,
10355                            size_t len, gfp_t gfp)
10356 {
10357         nl80211_send_mlme_event(rdev, netdev, buf, len,
10358                                 NL80211_CMD_DISASSOCIATE, gfp);
10359 }
10360
10361 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
10362                                   size_t len)
10363 {
10364         struct wireless_dev *wdev = dev->ieee80211_ptr;
10365         struct wiphy *wiphy = wdev->wiphy;
10366         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10367         const struct ieee80211_mgmt *mgmt = (void *)buf;
10368         u32 cmd;
10369
10370         if (WARN_ON(len < 2))
10371                 return;
10372
10373         if (ieee80211_is_deauth(mgmt->frame_control))
10374                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
10375         else
10376                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
10377
10378         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
10379         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
10380 }
10381 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
10382
10383 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
10384                                       struct net_device *netdev, int cmd,
10385                                       const u8 *addr, gfp_t gfp)
10386 {
10387         struct sk_buff *msg;
10388         void *hdr;
10389
10390         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10391         if (!msg)
10392                 return;
10393
10394         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10395         if (!hdr) {
10396                 nlmsg_free(msg);
10397                 return;
10398         }
10399
10400         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10401             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10402             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
10403             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10404                 goto nla_put_failure;
10405
10406         genlmsg_end(msg, hdr);
10407
10408         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10409                                 NL80211_MCGRP_MLME, gfp);
10410         return;
10411
10412  nla_put_failure:
10413         genlmsg_cancel(msg, hdr);
10414         nlmsg_free(msg);
10415 }
10416
10417 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
10418                                struct net_device *netdev, const u8 *addr,
10419                                gfp_t gfp)
10420 {
10421         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
10422                                   addr, gfp);
10423 }
10424
10425 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
10426                                 struct net_device *netdev, const u8 *addr,
10427                                 gfp_t gfp)
10428 {
10429         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
10430                                   addr, gfp);
10431 }
10432
10433 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
10434                                  struct net_device *netdev, const u8 *bssid,
10435                                  const u8 *req_ie, size_t req_ie_len,
10436                                  const u8 *resp_ie, size_t resp_ie_len,
10437                                  u16 status, gfp_t gfp)
10438 {
10439         struct sk_buff *msg;
10440         void *hdr;
10441
10442         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10443         if (!msg)
10444                 return;
10445
10446         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
10447         if (!hdr) {
10448                 nlmsg_free(msg);
10449                 return;
10450         }
10451
10452         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10453             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10454             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
10455             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
10456             (req_ie &&
10457              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10458             (resp_ie &&
10459              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10460                 goto nla_put_failure;
10461
10462         genlmsg_end(msg, hdr);
10463
10464         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10465                                 NL80211_MCGRP_MLME, gfp);
10466         return;
10467
10468  nla_put_failure:
10469         genlmsg_cancel(msg, hdr);
10470         nlmsg_free(msg);
10471
10472 }
10473
10474 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
10475                          struct net_device *netdev, const u8 *bssid,
10476                          const u8 *req_ie, size_t req_ie_len,
10477                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
10478 {
10479         struct sk_buff *msg;
10480         void *hdr;
10481
10482         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10483         if (!msg)
10484                 return;
10485
10486         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
10487         if (!hdr) {
10488                 nlmsg_free(msg);
10489                 return;
10490         }
10491
10492         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10493             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10494             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
10495             (req_ie &&
10496              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10497             (resp_ie &&
10498              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10499                 goto nla_put_failure;
10500
10501         genlmsg_end(msg, hdr);
10502
10503         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10504                                 NL80211_MCGRP_MLME, gfp);
10505         return;
10506
10507  nla_put_failure:
10508         genlmsg_cancel(msg, hdr);
10509         nlmsg_free(msg);
10510
10511 }
10512
10513 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
10514                                struct net_device *netdev, u16 reason,
10515                                const u8 *ie, size_t ie_len, bool from_ap)
10516 {
10517         struct sk_buff *msg;
10518         void *hdr;
10519
10520         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10521         if (!msg)
10522                 return;
10523
10524         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
10525         if (!hdr) {
10526                 nlmsg_free(msg);
10527                 return;
10528         }
10529
10530         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10531             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10532             (from_ap && reason &&
10533              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
10534             (from_ap &&
10535              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
10536             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
10537                 goto nla_put_failure;
10538
10539         genlmsg_end(msg, hdr);
10540
10541         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10542                                 NL80211_MCGRP_MLME, GFP_KERNEL);
10543         return;
10544
10545  nla_put_failure:
10546         genlmsg_cancel(msg, hdr);
10547         nlmsg_free(msg);
10548
10549 }
10550
10551 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
10552                              struct net_device *netdev, const u8 *bssid,
10553                              gfp_t gfp)
10554 {
10555         struct sk_buff *msg;
10556         void *hdr;
10557
10558         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10559         if (!msg)
10560                 return;
10561
10562         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
10563         if (!hdr) {
10564                 nlmsg_free(msg);
10565                 return;
10566         }
10567
10568         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10569             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10570             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10571                 goto nla_put_failure;
10572
10573         genlmsg_end(msg, hdr);
10574
10575         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10576                                 NL80211_MCGRP_MLME, gfp);
10577         return;
10578
10579  nla_put_failure:
10580         genlmsg_cancel(msg, hdr);
10581         nlmsg_free(msg);
10582 }
10583
10584 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
10585                                         const u8* ie, u8 ie_len, gfp_t gfp)
10586 {
10587         struct wireless_dev *wdev = dev->ieee80211_ptr;
10588         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
10589         struct sk_buff *msg;
10590         void *hdr;
10591
10592         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10593                 return;
10594
10595         trace_cfg80211_notify_new_peer_candidate(dev, addr);
10596
10597         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10598         if (!msg)
10599                 return;
10600
10601         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
10602         if (!hdr) {
10603                 nlmsg_free(msg);
10604                 return;
10605         }
10606
10607         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10608             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10609             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10610             (ie_len && ie &&
10611              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
10612                 goto nla_put_failure;
10613
10614         genlmsg_end(msg, hdr);
10615
10616         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10617                                 NL80211_MCGRP_MLME, gfp);
10618         return;
10619
10620  nla_put_failure:
10621         genlmsg_cancel(msg, hdr);
10622         nlmsg_free(msg);
10623 }
10624 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
10625
10626 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
10627                                  struct net_device *netdev, const u8 *addr,
10628                                  enum nl80211_key_type key_type, int key_id,
10629                                  const u8 *tsc, gfp_t gfp)
10630 {
10631         struct sk_buff *msg;
10632         void *hdr;
10633
10634         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10635         if (!msg)
10636                 return;
10637
10638         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
10639         if (!hdr) {
10640                 nlmsg_free(msg);
10641                 return;
10642         }
10643
10644         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10645             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10646             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
10647             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
10648             (key_id != -1 &&
10649              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
10650             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
10651                 goto nla_put_failure;
10652
10653         genlmsg_end(msg, hdr);
10654
10655         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10656                                 NL80211_MCGRP_MLME, gfp);
10657         return;
10658
10659  nla_put_failure:
10660         genlmsg_cancel(msg, hdr);
10661         nlmsg_free(msg);
10662 }
10663
10664 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
10665                                     struct ieee80211_channel *channel_before,
10666                                     struct ieee80211_channel *channel_after)
10667 {
10668         struct sk_buff *msg;
10669         void *hdr;
10670         struct nlattr *nl_freq;
10671
10672         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
10673         if (!msg)
10674                 return;
10675
10676         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
10677         if (!hdr) {
10678                 nlmsg_free(msg);
10679                 return;
10680         }
10681
10682         /*
10683          * Since we are applying the beacon hint to a wiphy we know its
10684          * wiphy_idx is valid
10685          */
10686         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
10687                 goto nla_put_failure;
10688
10689         /* Before */
10690         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
10691         if (!nl_freq)
10692                 goto nla_put_failure;
10693         if (nl80211_msg_put_channel(msg, channel_before, false))
10694                 goto nla_put_failure;
10695         nla_nest_end(msg, nl_freq);
10696
10697         /* After */
10698         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
10699         if (!nl_freq)
10700                 goto nla_put_failure;
10701         if (nl80211_msg_put_channel(msg, channel_after, false))
10702                 goto nla_put_failure;
10703         nla_nest_end(msg, nl_freq);
10704
10705         genlmsg_end(msg, hdr);
10706
10707         rcu_read_lock();
10708         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10709                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10710         rcu_read_unlock();
10711
10712         return;
10713
10714 nla_put_failure:
10715         genlmsg_cancel(msg, hdr);
10716         nlmsg_free(msg);
10717 }
10718
10719 static void nl80211_send_remain_on_chan_event(
10720         int cmd, struct cfg80211_registered_device *rdev,
10721         struct wireless_dev *wdev, u64 cookie,
10722         struct ieee80211_channel *chan,
10723         unsigned int duration, gfp_t gfp)
10724 {
10725         struct sk_buff *msg;
10726         void *hdr;
10727
10728         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10729         if (!msg)
10730                 return;
10731
10732         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10733         if (!hdr) {
10734                 nlmsg_free(msg);
10735                 return;
10736         }
10737
10738         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10739             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10740                                          wdev->netdev->ifindex)) ||
10741             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10742             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
10743             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10744                         NL80211_CHAN_NO_HT) ||
10745             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
10746                 goto nla_put_failure;
10747
10748         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
10749             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
10750                 goto nla_put_failure;
10751
10752         genlmsg_end(msg, hdr);
10753
10754         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10755                                 NL80211_MCGRP_MLME, gfp);
10756         return;
10757
10758  nla_put_failure:
10759         genlmsg_cancel(msg, hdr);
10760         nlmsg_free(msg);
10761 }
10762
10763 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
10764                                struct ieee80211_channel *chan,
10765                                unsigned int duration, gfp_t gfp)
10766 {
10767         struct wiphy *wiphy = wdev->wiphy;
10768         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10769
10770         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
10771         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
10772                                           rdev, wdev, cookie, chan,
10773                                           duration, gfp);
10774 }
10775 EXPORT_SYMBOL(cfg80211_ready_on_channel);
10776
10777 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
10778                                         struct ieee80211_channel *chan,
10779                                         gfp_t gfp)
10780 {
10781         struct wiphy *wiphy = wdev->wiphy;
10782         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10783
10784         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
10785         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10786                                           rdev, wdev, cookie, chan, 0, gfp);
10787 }
10788 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
10789
10790 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
10791                       struct station_info *sinfo, gfp_t gfp)
10792 {
10793         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10794         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10795         struct sk_buff *msg;
10796
10797         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
10798
10799         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10800         if (!msg)
10801                 return;
10802
10803         if (nl80211_send_station(msg, 0, 0, 0,
10804                                  rdev, dev, mac_addr, sinfo) < 0) {
10805                 nlmsg_free(msg);
10806                 return;
10807         }
10808
10809         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10810                                 NL80211_MCGRP_MLME, gfp);
10811 }
10812 EXPORT_SYMBOL(cfg80211_new_sta);
10813
10814 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
10815 {
10816         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10817         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10818         struct sk_buff *msg;
10819         void *hdr;
10820
10821         trace_cfg80211_del_sta(dev, mac_addr);
10822
10823         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10824         if (!msg)
10825                 return;
10826
10827         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
10828         if (!hdr) {
10829                 nlmsg_free(msg);
10830                 return;
10831         }
10832
10833         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10834             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
10835                 goto nla_put_failure;
10836
10837         genlmsg_end(msg, hdr);
10838
10839         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10840                                 NL80211_MCGRP_MLME, gfp);
10841         return;
10842
10843  nla_put_failure:
10844         genlmsg_cancel(msg, hdr);
10845         nlmsg_free(msg);
10846 }
10847 EXPORT_SYMBOL(cfg80211_del_sta);
10848
10849 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
10850                           enum nl80211_connect_failed_reason reason,
10851                           gfp_t gfp)
10852 {
10853         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10854         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10855         struct sk_buff *msg;
10856         void *hdr;
10857
10858         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10859         if (!msg)
10860                 return;
10861
10862         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
10863         if (!hdr) {
10864                 nlmsg_free(msg);
10865                 return;
10866         }
10867
10868         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10869             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
10870             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
10871                 goto nla_put_failure;
10872
10873         genlmsg_end(msg, hdr);
10874
10875         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10876                                 NL80211_MCGRP_MLME, gfp);
10877         return;
10878
10879  nla_put_failure:
10880         genlmsg_cancel(msg, hdr);
10881         nlmsg_free(msg);
10882 }
10883 EXPORT_SYMBOL(cfg80211_conn_failed);
10884
10885 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
10886                                        const u8 *addr, gfp_t gfp)
10887 {
10888         struct wireless_dev *wdev = dev->ieee80211_ptr;
10889         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
10890         struct sk_buff *msg;
10891         void *hdr;
10892         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
10893
10894         if (!nlportid)
10895                 return false;
10896
10897         msg = nlmsg_new(100, gfp);
10898         if (!msg)
10899                 return true;
10900
10901         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10902         if (!hdr) {
10903                 nlmsg_free(msg);
10904                 return true;
10905         }
10906
10907         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10908             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10909             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10910                 goto nla_put_failure;
10911
10912         genlmsg_end(msg, hdr);
10913         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10914         return true;
10915
10916  nla_put_failure:
10917         genlmsg_cancel(msg, hdr);
10918         nlmsg_free(msg);
10919         return true;
10920 }
10921
10922 bool cfg80211_rx_spurious_frame(struct net_device *dev,
10923                                 const u8 *addr, gfp_t gfp)
10924 {
10925         struct wireless_dev *wdev = dev->ieee80211_ptr;
10926         bool ret;
10927
10928         trace_cfg80211_rx_spurious_frame(dev, addr);
10929
10930         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10931                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
10932                 trace_cfg80211_return_bool(false);
10933                 return false;
10934         }
10935         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
10936                                          addr, gfp);
10937         trace_cfg80211_return_bool(ret);
10938         return ret;
10939 }
10940 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
10941
10942 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
10943                                         const u8 *addr, gfp_t gfp)
10944 {
10945         struct wireless_dev *wdev = dev->ieee80211_ptr;
10946         bool ret;
10947
10948         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
10949
10950         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10951                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
10952                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
10953                 trace_cfg80211_return_bool(false);
10954                 return false;
10955         }
10956         ret = __nl80211_unexpected_frame(dev,
10957                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
10958                                          addr, gfp);
10959         trace_cfg80211_return_bool(ret);
10960         return ret;
10961 }
10962 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
10963
10964 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
10965                       struct wireless_dev *wdev, u32 nlportid,
10966                       int freq, int sig_dbm,
10967                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
10968 {
10969         struct net_device *netdev = wdev->netdev;
10970         struct sk_buff *msg;
10971         void *hdr;
10972
10973         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10974         if (!msg)
10975                 return -ENOMEM;
10976
10977         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10978         if (!hdr) {
10979                 nlmsg_free(msg);
10980                 return -ENOMEM;
10981         }
10982
10983         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10984             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10985                                         netdev->ifindex)) ||
10986             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10987             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
10988             (sig_dbm &&
10989              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10990             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10991             (flags &&
10992              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
10993                 goto nla_put_failure;
10994
10995         genlmsg_end(msg, hdr);
10996
10997         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10998
10999  nla_put_failure:
11000         genlmsg_cancel(msg, hdr);
11001         nlmsg_free(msg);
11002         return -ENOBUFS;
11003 }
11004
11005 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
11006                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
11007 {
11008         struct wiphy *wiphy = wdev->wiphy;
11009         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11010         struct net_device *netdev = wdev->netdev;
11011         struct sk_buff *msg;
11012         void *hdr;
11013
11014         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
11015
11016         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11017         if (!msg)
11018                 return;
11019
11020         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
11021         if (!hdr) {
11022                 nlmsg_free(msg);
11023                 return;
11024         }
11025
11026         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11027             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11028                                    netdev->ifindex)) ||
11029             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11030             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11031             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11032             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
11033                 goto nla_put_failure;
11034
11035         genlmsg_end(msg, hdr);
11036
11037         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11038                                 NL80211_MCGRP_MLME, gfp);
11039         return;
11040
11041  nla_put_failure:
11042         genlmsg_cancel(msg, hdr);
11043         nlmsg_free(msg);
11044 }
11045 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
11046
11047 void cfg80211_cqm_rssi_notify(struct net_device *dev,
11048                               enum nl80211_cqm_rssi_threshold_event rssi_event,
11049                               gfp_t gfp)
11050 {
11051         struct wireless_dev *wdev = dev->ieee80211_ptr;
11052         struct wiphy *wiphy = wdev->wiphy;
11053         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11054         struct sk_buff *msg;
11055         struct nlattr *pinfoattr;
11056         void *hdr;
11057
11058         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
11059
11060         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11061         if (!msg)
11062                 return;
11063
11064         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11065         if (!hdr) {
11066                 nlmsg_free(msg);
11067                 return;
11068         }
11069
11070         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11071             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
11072                 goto nla_put_failure;
11073
11074         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11075         if (!pinfoattr)
11076                 goto nla_put_failure;
11077
11078         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
11079                         rssi_event))
11080                 goto nla_put_failure;
11081
11082         nla_nest_end(msg, pinfoattr);
11083
11084         genlmsg_end(msg, hdr);
11085
11086         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11087                                 NL80211_MCGRP_MLME, gfp);
11088         return;
11089
11090  nla_put_failure:
11091         genlmsg_cancel(msg, hdr);
11092         nlmsg_free(msg);
11093 }
11094 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
11095
11096 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
11097                                      struct net_device *netdev, const u8 *bssid,
11098                                      const u8 *replay_ctr, gfp_t gfp)
11099 {
11100         struct sk_buff *msg;
11101         struct nlattr *rekey_attr;
11102         void *hdr;
11103
11104         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11105         if (!msg)
11106                 return;
11107
11108         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
11109         if (!hdr) {
11110                 nlmsg_free(msg);
11111                 return;
11112         }
11113
11114         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11115             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11116             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11117                 goto nla_put_failure;
11118
11119         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
11120         if (!rekey_attr)
11121                 goto nla_put_failure;
11122
11123         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
11124                     NL80211_REPLAY_CTR_LEN, replay_ctr))
11125                 goto nla_put_failure;
11126
11127         nla_nest_end(msg, rekey_attr);
11128
11129         genlmsg_end(msg, hdr);
11130
11131         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11132                                 NL80211_MCGRP_MLME, gfp);
11133         return;
11134
11135  nla_put_failure:
11136         genlmsg_cancel(msg, hdr);
11137         nlmsg_free(msg);
11138 }
11139
11140 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
11141                                const u8 *replay_ctr, gfp_t gfp)
11142 {
11143         struct wireless_dev *wdev = dev->ieee80211_ptr;
11144         struct wiphy *wiphy = wdev->wiphy;
11145         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11146
11147         trace_cfg80211_gtk_rekey_notify(dev, bssid);
11148         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
11149 }
11150 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
11151
11152 static void
11153 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
11154                                struct net_device *netdev, int index,
11155                                const u8 *bssid, bool preauth, gfp_t gfp)
11156 {
11157         struct sk_buff *msg;
11158         struct nlattr *attr;
11159         void *hdr;
11160
11161         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11162         if (!msg)
11163                 return;
11164
11165         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
11166         if (!hdr) {
11167                 nlmsg_free(msg);
11168                 return;
11169         }
11170
11171         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11172             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11173                 goto nla_put_failure;
11174
11175         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
11176         if (!attr)
11177                 goto nla_put_failure;
11178
11179         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
11180             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
11181             (preauth &&
11182              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
11183                 goto nla_put_failure;
11184
11185         nla_nest_end(msg, attr);
11186
11187         genlmsg_end(msg, hdr);
11188
11189         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11190                                 NL80211_MCGRP_MLME, gfp);
11191         return;
11192
11193  nla_put_failure:
11194         genlmsg_cancel(msg, hdr);
11195         nlmsg_free(msg);
11196 }
11197
11198 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
11199                                      const u8 *bssid, bool preauth, gfp_t gfp)
11200 {
11201         struct wireless_dev *wdev = dev->ieee80211_ptr;
11202         struct wiphy *wiphy = wdev->wiphy;
11203         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11204
11205         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
11206         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
11207 }
11208 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
11209
11210 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
11211                                      struct net_device *netdev,
11212                                      struct cfg80211_chan_def *chandef,
11213                                      gfp_t gfp)
11214 {
11215         struct sk_buff *msg;
11216         void *hdr;
11217
11218         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11219         if (!msg)
11220                 return;
11221
11222         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
11223         if (!hdr) {
11224                 nlmsg_free(msg);
11225                 return;
11226         }
11227
11228         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11229                 goto nla_put_failure;
11230
11231         if (nl80211_send_chandef(msg, chandef))
11232                 goto nla_put_failure;
11233
11234         genlmsg_end(msg, hdr);
11235
11236         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11237                                 NL80211_MCGRP_MLME, gfp);
11238         return;
11239
11240  nla_put_failure:
11241         genlmsg_cancel(msg, hdr);
11242         nlmsg_free(msg);
11243 }
11244
11245 void cfg80211_ch_switch_notify(struct net_device *dev,
11246                                struct cfg80211_chan_def *chandef)
11247 {
11248         struct wireless_dev *wdev = dev->ieee80211_ptr;
11249         struct wiphy *wiphy = wdev->wiphy;
11250         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11251
11252         ASSERT_WDEV_LOCK(wdev);
11253
11254         trace_cfg80211_ch_switch_notify(dev, chandef);
11255
11256         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11257                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11258                     wdev->iftype != NL80211_IFTYPE_ADHOC &&
11259                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11260                 return;
11261
11262         wdev->chandef = *chandef;
11263         wdev->preset_chandef = *chandef;
11264         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
11265 }
11266 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
11267
11268 void cfg80211_cqm_txe_notify(struct net_device *dev,
11269                              const u8 *peer, u32 num_packets,
11270                              u32 rate, u32 intvl, gfp_t gfp)
11271 {
11272         struct wireless_dev *wdev = dev->ieee80211_ptr;
11273         struct wiphy *wiphy = wdev->wiphy;
11274         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11275         struct sk_buff *msg;
11276         struct nlattr *pinfoattr;
11277         void *hdr;
11278
11279         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11280         if (!msg)
11281                 return;
11282
11283         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11284         if (!hdr) {
11285                 nlmsg_free(msg);
11286                 return;
11287         }
11288
11289         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11290             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11291             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11292                 goto nla_put_failure;
11293
11294         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11295         if (!pinfoattr)
11296                 goto nla_put_failure;
11297
11298         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
11299                 goto nla_put_failure;
11300
11301         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
11302                 goto nla_put_failure;
11303
11304         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
11305                 goto nla_put_failure;
11306
11307         nla_nest_end(msg, pinfoattr);
11308
11309         genlmsg_end(msg, hdr);
11310
11311         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11312                                 NL80211_MCGRP_MLME, gfp);
11313         return;
11314
11315  nla_put_failure:
11316         genlmsg_cancel(msg, hdr);
11317         nlmsg_free(msg);
11318 }
11319 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
11320
11321 void
11322 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
11323                      const struct cfg80211_chan_def *chandef,
11324                      enum nl80211_radar_event event,
11325                      struct net_device *netdev, gfp_t gfp)
11326 {
11327         struct sk_buff *msg;
11328         void *hdr;
11329
11330         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11331         if (!msg)
11332                 return;
11333
11334         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
11335         if (!hdr) {
11336                 nlmsg_free(msg);
11337                 return;
11338         }
11339
11340         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11341                 goto nla_put_failure;
11342
11343         /* NOP and radar events don't need a netdev parameter */
11344         if (netdev) {
11345                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
11346
11347                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11348                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11349                         goto nla_put_failure;
11350         }
11351
11352         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
11353                 goto nla_put_failure;
11354
11355         if (nl80211_send_chandef(msg, chandef))
11356                 goto nla_put_failure;
11357
11358         genlmsg_end(msg, hdr);
11359
11360         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11361                                 NL80211_MCGRP_MLME, gfp);
11362         return;
11363
11364  nla_put_failure:
11365         genlmsg_cancel(msg, hdr);
11366         nlmsg_free(msg);
11367 }
11368
11369 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
11370                                  const u8 *peer, u32 num_packets, gfp_t gfp)
11371 {
11372         struct wireless_dev *wdev = dev->ieee80211_ptr;
11373         struct wiphy *wiphy = wdev->wiphy;
11374         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11375         struct sk_buff *msg;
11376         struct nlattr *pinfoattr;
11377         void *hdr;
11378
11379         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
11380
11381         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11382         if (!msg)
11383                 return;
11384
11385         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11386         if (!hdr) {
11387                 nlmsg_free(msg);
11388                 return;
11389         }
11390
11391         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11392             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11393             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11394                 goto nla_put_failure;
11395
11396         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11397         if (!pinfoattr)
11398                 goto nla_put_failure;
11399
11400         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
11401                 goto nla_put_failure;
11402
11403         nla_nest_end(msg, pinfoattr);
11404
11405         genlmsg_end(msg, hdr);
11406
11407         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11408                                 NL80211_MCGRP_MLME, gfp);
11409         return;
11410
11411  nla_put_failure:
11412         genlmsg_cancel(msg, hdr);
11413         nlmsg_free(msg);
11414 }
11415 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
11416
11417 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
11418                            u64 cookie, bool acked, gfp_t gfp)
11419 {
11420         struct wireless_dev *wdev = dev->ieee80211_ptr;
11421         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11422         struct sk_buff *msg;
11423         void *hdr;
11424
11425         trace_cfg80211_probe_status(dev, addr, cookie, acked);
11426
11427         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11428
11429         if (!msg)
11430                 return;
11431
11432         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
11433         if (!hdr) {
11434                 nlmsg_free(msg);
11435                 return;
11436         }
11437
11438         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11439             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11440             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11441             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11442             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
11443                 goto nla_put_failure;
11444
11445         genlmsg_end(msg, hdr);
11446
11447         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11448                                 NL80211_MCGRP_MLME, gfp);
11449         return;
11450
11451  nla_put_failure:
11452         genlmsg_cancel(msg, hdr);
11453         nlmsg_free(msg);
11454 }
11455 EXPORT_SYMBOL(cfg80211_probe_status);
11456
11457 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
11458                                  const u8 *frame, size_t len,
11459                                  int freq, int sig_dbm)
11460 {
11461         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11462         struct sk_buff *msg;
11463         void *hdr;
11464         struct cfg80211_beacon_registration *reg;
11465
11466         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
11467
11468         spin_lock_bh(&rdev->beacon_registrations_lock);
11469         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11470                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
11471                 if (!msg) {
11472                         spin_unlock_bh(&rdev->beacon_registrations_lock);
11473                         return;
11474                 }
11475
11476                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11477                 if (!hdr)
11478                         goto nla_put_failure;
11479
11480                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11481                     (freq &&
11482                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
11483                     (sig_dbm &&
11484                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11485                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
11486                         goto nla_put_failure;
11487
11488                 genlmsg_end(msg, hdr);
11489
11490                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
11491         }
11492         spin_unlock_bh(&rdev->beacon_registrations_lock);
11493         return;
11494
11495  nla_put_failure:
11496         spin_unlock_bh(&rdev->beacon_registrations_lock);
11497         if (hdr)
11498                 genlmsg_cancel(msg, hdr);
11499         nlmsg_free(msg);
11500 }
11501 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
11502
11503 #ifdef CONFIG_PM
11504 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
11505                                    struct cfg80211_wowlan_wakeup *wakeup,
11506                                    gfp_t gfp)
11507 {
11508         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11509         struct sk_buff *msg;
11510         void *hdr;
11511         int size = 200;
11512
11513         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
11514
11515         if (wakeup)
11516                 size += wakeup->packet_present_len;
11517
11518         msg = nlmsg_new(size, gfp);
11519         if (!msg)
11520                 return;
11521
11522         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
11523         if (!hdr)
11524                 goto free_msg;
11525
11526         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11527             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11528                 goto free_msg;
11529
11530         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11531                                         wdev->netdev->ifindex))
11532                 goto free_msg;
11533
11534         if (wakeup) {
11535                 struct nlattr *reasons;
11536
11537                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
11538                 if (!reasons)
11539                         goto free_msg;
11540
11541                 if (wakeup->disconnect &&
11542                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
11543                         goto free_msg;
11544                 if (wakeup->magic_pkt &&
11545                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
11546                         goto free_msg;
11547                 if (wakeup->gtk_rekey_failure &&
11548                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
11549                         goto free_msg;
11550                 if (wakeup->eap_identity_req &&
11551                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
11552                         goto free_msg;
11553                 if (wakeup->four_way_handshake &&
11554                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
11555                         goto free_msg;
11556                 if (wakeup->rfkill_release &&
11557                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
11558                         goto free_msg;
11559
11560                 if (wakeup->pattern_idx >= 0 &&
11561                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
11562                                 wakeup->pattern_idx))
11563                         goto free_msg;
11564
11565                 if (wakeup->tcp_match &&
11566                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
11567                         goto free_msg;
11568
11569                 if (wakeup->tcp_connlost &&
11570                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
11571                         goto free_msg;
11572
11573                 if (wakeup->tcp_nomoretokens &&
11574                     nla_put_flag(msg,
11575                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
11576                         goto free_msg;
11577
11578                 if (wakeup->packet) {
11579                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
11580                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
11581
11582                         if (!wakeup->packet_80211) {
11583                                 pkt_attr =
11584                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
11585                                 len_attr =
11586                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
11587                         }
11588
11589                         if (wakeup->packet_len &&
11590                             nla_put_u32(msg, len_attr, wakeup->packet_len))
11591                                 goto free_msg;
11592
11593                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
11594                                     wakeup->packet))
11595                                 goto free_msg;
11596                 }
11597
11598                 nla_nest_end(msg, reasons);
11599         }
11600
11601         genlmsg_end(msg, hdr);
11602
11603         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11604                                 NL80211_MCGRP_MLME, gfp);
11605         return;
11606
11607  free_msg:
11608         nlmsg_free(msg);
11609 }
11610 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
11611 #endif
11612
11613 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
11614                                 enum nl80211_tdls_operation oper,
11615                                 u16 reason_code, gfp_t gfp)
11616 {
11617         struct wireless_dev *wdev = dev->ieee80211_ptr;
11618         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11619         struct sk_buff *msg;
11620         void *hdr;
11621
11622         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
11623                                          reason_code);
11624
11625         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11626         if (!msg)
11627                 return;
11628
11629         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
11630         if (!hdr) {
11631                 nlmsg_free(msg);
11632                 return;
11633         }
11634
11635         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11636             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11637             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
11638             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
11639             (reason_code > 0 &&
11640              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
11641                 goto nla_put_failure;
11642
11643         genlmsg_end(msg, hdr);
11644
11645         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11646                                 NL80211_MCGRP_MLME, gfp);
11647         return;
11648
11649  nla_put_failure:
11650         genlmsg_cancel(msg, hdr);
11651         nlmsg_free(msg);
11652 }
11653 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
11654
11655 static int nl80211_netlink_notify(struct notifier_block * nb,
11656                                   unsigned long state,
11657                                   void *_notify)
11658 {
11659         struct netlink_notify *notify = _notify;
11660         struct cfg80211_registered_device *rdev;
11661         struct wireless_dev *wdev;
11662         struct cfg80211_beacon_registration *reg, *tmp;
11663
11664         if (state != NETLINK_URELEASE)
11665                 return NOTIFY_DONE;
11666
11667         rcu_read_lock();
11668
11669         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
11670                 bool schedule_destroy_work = false;
11671
11672                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
11673                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
11674
11675                         if (wdev->owner_nlportid == notify->portid)
11676                                 schedule_destroy_work = true;
11677                 }
11678
11679                 spin_lock_bh(&rdev->beacon_registrations_lock);
11680                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
11681                                          list) {
11682                         if (reg->nlportid == notify->portid) {
11683                                 list_del(&reg->list);
11684                                 kfree(reg);
11685                                 break;
11686                         }
11687                 }
11688                 spin_unlock_bh(&rdev->beacon_registrations_lock);
11689
11690                 if (schedule_destroy_work) {
11691                         struct cfg80211_iface_destroy *destroy;
11692
11693                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
11694                         if (destroy) {
11695                                 destroy->nlportid = notify->portid;
11696                                 spin_lock(&rdev->destroy_list_lock);
11697                                 list_add(&destroy->list, &rdev->destroy_list);
11698                                 spin_unlock(&rdev->destroy_list_lock);
11699                                 schedule_work(&rdev->destroy_work);
11700                         }
11701                 }
11702         }
11703
11704         rcu_read_unlock();
11705
11706         return NOTIFY_OK;
11707 }
11708
11709 static struct notifier_block nl80211_netlink_notifier = {
11710         .notifier_call = nl80211_netlink_notify,
11711 };
11712
11713 void cfg80211_ft_event(struct net_device *netdev,
11714                        struct cfg80211_ft_event_params *ft_event)
11715 {
11716         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
11717         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11718         struct sk_buff *msg;
11719         void *hdr;
11720
11721         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
11722
11723         if (!ft_event->target_ap)
11724                 return;
11725
11726         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11727         if (!msg)
11728                 return;
11729
11730         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
11731         if (!hdr)
11732                 goto out;
11733
11734         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11735             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11736             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
11737                 goto out;
11738
11739         if (ft_event->ies &&
11740             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
11741                 goto out;
11742         if (ft_event->ric_ies &&
11743             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
11744                     ft_event->ric_ies))
11745                 goto out;
11746
11747         genlmsg_end(msg, hdr);
11748
11749         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11750                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11751         return;
11752  out:
11753         nlmsg_free(msg);
11754 }
11755 EXPORT_SYMBOL(cfg80211_ft_event);
11756
11757 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
11758 {
11759         struct cfg80211_registered_device *rdev;
11760         struct sk_buff *msg;
11761         void *hdr;
11762         u32 nlportid;
11763
11764         rdev = wiphy_to_rdev(wdev->wiphy);
11765         if (!rdev->crit_proto_nlportid)
11766                 return;
11767
11768         nlportid = rdev->crit_proto_nlportid;
11769         rdev->crit_proto_nlportid = 0;
11770
11771         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11772         if (!msg)
11773                 return;
11774
11775         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
11776         if (!hdr)
11777                 goto nla_put_failure;
11778
11779         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11780             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11781                 goto nla_put_failure;
11782
11783         genlmsg_end(msg, hdr);
11784
11785         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11786         return;
11787
11788  nla_put_failure:
11789         if (hdr)
11790                 genlmsg_cancel(msg, hdr);
11791         nlmsg_free(msg);
11792
11793 }
11794 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
11795
11796 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
11797 {
11798         struct wiphy *wiphy = wdev->wiphy;
11799         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11800         struct sk_buff *msg;
11801         void *hdr;
11802
11803         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11804         if (!msg)
11805                 return;
11806
11807         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
11808         if (!hdr)
11809                 goto out;
11810
11811         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11812             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
11813             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11814                 goto out;
11815
11816         genlmsg_end(msg, hdr);
11817
11818         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
11819                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11820         return;
11821  out:
11822         nlmsg_free(msg);
11823 }
11824
11825 /* initialisation/exit functions */
11826
11827 int nl80211_init(void)
11828 {
11829         int err;
11830
11831         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
11832                                                    nl80211_mcgrps);
11833         if (err)
11834                 return err;
11835
11836         err = netlink_register_notifier(&nl80211_netlink_notifier);
11837         if (err)
11838                 goto err_out;
11839
11840         return 0;
11841  err_out:
11842         genl_unregister_family(&nl80211_fam);
11843         return err;
11844 }
11845
11846 void nl80211_exit(void)
11847 {
11848         netlink_unregister_notifier(&nl80211_netlink_notifier);
11849         genl_unregister_family(&nl80211_fam);
11850 }